MSE 2.0: Quick Scan Issue?

I've posted this question over at the MSE site but thought I'd check in with you good folks to see if you had a thought or two...

...I've noticed that occasionally there is a great disparity in the number of files scanned when using the "Quick Scan" option.

Ordinarily it's about 32,000 files (plus or minus).
Occasionally it drops to about 9,000 (plus or minus). That's a big change.

The scan is ordinarily run every four days.

(I may not have rebooted during this period as my habit is to put the system to "sleep" at night rather than shut it down completely.)

Does MSE scan only "new" unscanned files or is the program just not operating properly for some unknown reason?

System: Windows XP Pro SP 3

Thanks in advance for your time and replies.

 

As a follow-up:

After just rebooting, it's back to 32,000+ files again.

(Was 9,000+ this morning, which is the pattern I see intermittently after being run a time or two over several days.)

 

elapsed's your man for MSE, PM him.

 

Thanks for the tip. I'll do so.

 

Despite what some of you may think I'm not an MSE man, or an AV man. I dislike AV and I'd ditch it if I wasn't too lazy. I want an AV that I can install and simply forget it even exists, MSE suits this role. AV is my backup layer that I do not want to care about, and as so, I barely invest any time whatsoever in learning about the various ways it does things. My frontlines are ClearCloud and system hardening/EMET.

If I was to take a logical guess, I'd say that the amount of files it scans is influenced by if that file has been scanned before with the same detection database, or as some AV companies sell it to you by name, a "smart scan". This "memory" of previous files scanned is probably reset every time the database is updated.

 

Apologies then. But I couldn't think of anyone off the top of my head who new it better. Thanks for helping out.

 

Well, thanks, elapsed...guess the question still remains open.

I do download the definitions twice daily so as it stands I don't know if it's a glitch with MSE or it "remembers" that it had scanned certain files already that haven't changed since the last scan (four days earlier)...perhaps someone else may have some insights.

 

First Quick Scan: 71044 items.
Second Quick Scan: 13650 items.

I seem to have the same symptoms, but on Windows 7 64-bit. Not sure of the reasons for this either.

 

Thanks for the corroboration, J L. So now we know that the behavior is exhibited across more than one Windows OS.

My wife's XP Pro ThinkPad also exhibits the same behavior. (I checked this earlier this evening.)

I haven't received any response from the MSE Forums thus far but will be sure to report here if I hear something.

 

i just tried it

1st : 14804
2nd: 14813

hmm i dont know what to say. mines close so far.

 

Brocke,

The issue does not always present the "next" time I run the Quick Scan but might be the second or third time I've run it over a period of days. (Especially if I hadn't rebooted in the interim.)

 

Just Quick Scanned a third time without rebooting. It continues to be low (13693).

 

After a reboot, it now scans 70812 items.

 

Pretty much confirms my guess with the exception of it resetting the "scanned file memory" on reboot rather than on database update. By the fact it seems to be hapenning to everyone, I'd wager it's probably normal behaviour.

 

What about Brocke? Is it happening to you?

 

Wanted to say thank you to J L and everyone else taking the time to help explore this issue.

FWIW, there has yet to be a reply from the MSE Forum.
(I do not have a ticket open with Microsoft support, however.)

EDITED TO ADD:

I decided to open a ticket with MS earlier today so we'll see if I get any info back from them regarding this matter.

 

Got a lame, canned (overseas) reply from MS Support late last night which (incorrectly) attributed the issue to needing to clean out the %temp% folder.

However, since I ordinarily run CCleaner prior to scans, the "temp" files are already taken care of prior to scans.

(And the one remaining "temp" folder, which is related to a recurring scheduled task, always remains "in use".)

I was disappointed to receive such a poor, disjointed reply from MS support which so confidently (but incorrectly) addressed the reported issue.

 

That's gotta make everyone feel warm and fuzzy about the program itself.

 

Well, I still like the program if not the email response.

Apparently this issue has been reported before on the MSE forums, I just wasn't aware of the prior threads when I posted.

 

I've noticed this behaviour on both 32 bit & 64 bit systems. I'm assuming it is normal behaviour. I just ran two quick scans in succession (32 bit Vista laptop) the first - 27114 items, then the second - 7456 items. It usually returns to around 27 thousand or so after a reboot.

 

i just scanned with a reboot and i got

14,734 not to far off from my 14804 and14813

 

Did you reboot between your other scans? What's your OS?

 

no the others i did not.
my OS is windows 7 32bit

 

Nothing to worry. On the 2nd scan it simply skips some archive files e.g. isos.

Panagiotis

 

New information has been posted by Rob Koch in the MSE Forum regarding this issue.

It did leave one question remaining to my mind, (which I posted), but it gives a pretty good general explanation imho.