Failing to schedule scan v5.0.95.0

I installed the listed version thinking it was the latest current as described in http://kb.eset.com/esetkb/index?page=content&id=SOLN2854&ref=wsf

Seams to work OK for me but on a computer used as a file server (so rarely powered off) it fails to run a scheduled disk scan. The schedule is for 3 nights a week. In practice scans only run as catchup after I restart the machine.

Probably worth fixing prior to the official release.

Btw, running Windows 7 sp1 32bit fully updated.

 

The versions of NOD32 AV on that KB Article are the home version of the product which won't work properly on a file server. You'll need the Business Edition and download ESET NOD32 File Security (file name will start with efsw rather than eav). If you have a license for NOD32 BE, on the ESET Download page, you can click on Business Downloads, then File Servers and download the proper version there.

 

The machine runs W7 32 bit Professional. It is not running server specific OS.
The machine is used as a general computer. Peer to peer sharing is used to enable it to run as a file server.

Since the first post a scheduled scan has occurred. I am now wongering if a reset is required after any schedule changes.

 

Could you please provide us with step-by-step instuctions on how to configure the very same scan task as you did?

 

Scan log
Note set up scheduled scan on afternoon Saturday 26/11/2011. Configured to scan at 12:30am on Tuesday, Thursday Saturday, Sunday.
So should have triggered early Sunday morning 27/11/2011. Didn't so I think I restarted the computer Sunday morning and it scanned on restart (but I may have manually triggered it).
Should have triggered Tuesday 29/11/2011, Thursday 1/12/2011. Didn't so I Restarted computer, triggering catch up scan 1/12/2011 6:17:10 AM
Should have triggered Saturday 3/12/2012 am, but did scan Sunday 3/12/2011 am.
Missed scan Tuesday 6/12/2011
Changed trigger time to 2:30 am as wanted to exclude a conflict with ShadowProtect (ShadowControl Image manager was giving occasional errors and runs at 12:00 am each day). Restarted computer triggering scan 7/12/2011 6:25:07 AM.
Scan Thursday 8/12/2011 occurred as scheduled.

Code:

8/12/2011 2:30:24 AM	Operating memory;C:\Boot sector;C:\;D:\Boot sector;D:\;E:\Boot sector;E:\;F:\Boot sector;F:\;G:\Boot sector;G:\;I:\Boot sector;I:\;R:\Boot sector;R:\	819255	0	0	Completed
7/12/2011 6:25:07 AM	Operating memory;C:\Boot sector;C:\;D:\Boot sector;D:\;E:\Boot sector;E:\;F:\Boot sector;F:\;G:\Boot sector;G:\;I:\Boot sector;I:\;R:\Boot sector;R:\	797533	0	0	Completed
4/12/2011 12:30:41 AM	Operating memory;C:\Boot sector;C:\;D:\Boot sector;D:\;E:\Boot sector;E:\;F:\Boot sector;F:\;G:\Boot sector;G:\;I:\Boot sector;I:\;R:\Boot sector;R:\	803455	0	0	Completed
1/12/2011 6:17:10 AM	Operating memory;C:\Boot sector;C:\;D:\Boot sector;D:\;E:\Boot sector;E:\;F:\Boot sector;F:\;G:\Boot sector;G:\;I:\Boot sector;I:\;R:\Boot sector;R:\	916946	0	0	Completed
27/11/2011 8:33:38 AM	Operating memory;C:\Boot sector;C:\;D:\Boot sector;D:\;E:\Boot sector;E:\;F:\Boot sector;F:\;G:\Boot sector;G:\;I:\Boot sector;I:\;R:\Boot sector;R:\	918128	0	0	Completed

As for how this was scheduled:
Tools -> Scheduler -> Add... -> Computer scan -> Next -> Name "Full disk scan" Weekly -> Next -> 12:30 am days Tue, Thur, Sat, Sun -> Run the task as soon as possible -> next -> finish -> check Computer -> Set up -> check Objects all (+ Email file), Options all (+ unwanted applications), rest on default -> OK -> OK

Later time schedule was altered, timing as described above by:
Tools -> Scheduler -> Select "Full disk scan" -> Edit -> Next -> Next -> Alter time 2:30am -> Next -> Next -> Finish

 

Still not doing a scheduled scan for me. Will do the scan if I restart the computer and it runs a missed scan immediately.

Has anyone got this working, or is it just me it doesn't work for?

 

Works fine for me on latest version.

 

Good Morning ! I'm using ESET Smart Security and am amazed at it's lack of bloat very responsive and nimble. As far as initiating scans it's very no fuss straight forward. I initially had it scanning daily then changed too fewer weekly scans. When you try to set up scheduled scans are you entering the type of scan in the set-up screen;before proceeding ? Sincerely...Securon

 

To update on where I have got with this problem.
1) Clean reinstall makes no difference.
2) The failure to initiate a scheduled scan is not entirely predictable,
3) but appears to be much more common if multiple users are logged onto the computer when the scan is suppose to be initiated, and conversely works more reliably if no or only one user is logged in over night when the scan is suppose to be triggered.

Note the failing computer is shared by many family members, each with their own user account. Program maintenance is by a single administrator account reserved for computer maintenance activities.
Runs W7 32bit fully updated.
I will eventually do a W7 clean reinstall, which may or may not fix the problem, but as the only fault with the computer is ESS 5 scan scheduling it is taking some time to reach a critical priority.

Yes. See the full description listed above https://www.wilderssecurity.com/showpost.php?p=1985779&postcount=5

 

Update 2
Installed the Microsoft hot fix https://www.wilderssecurity.com/showthread.php?t=319288
and schedules scan was run.
Too early to tell if it is really fixed but a hopeful sign.

 

Update 3
Microsoft hot fix was of no help.

I currently believe the problem is an interaction between
ESET ESS 5 task scheduling
Shadow Protect disk image incremental backup
Microsoft Windows 7 System protection

Apparently both shadow protect and Microsoft use VSS to take snapshots of the disk to enable capture of a valid disk image. However if two processes run it concurrently the results are unpredictable. As both Microsoft system protection backup, shadow protect backup / image management, and ESS5 disk scan were all being run when users where unlikely to be on the computer (late at night). This interaction ended up intermittently blocking ESS 5 scheduled disk scan.

Disabling Microsoft system protection appears to have fixed the problem, or at least ESS 5 scheduled scans have occurred for the last 2 nights

 

Update 4
Hot fix did not solve the problem.
Still believe it is an interaction between ESET SSS and shadow protect.
Now I look I see scheduling also fails on my laptop (W7Sp1, ESEST SSS v5.0.95.0, ShadowProtect 4.2.5.16175 ie all current software). Clean build done a couple of months ago.

Looking at ESET SSS -> Tools -> Running processes shows few other ESET users run ShadowProtect as its processes only get on person Icon and an orange question mark, 3 days old time of discovery (Current version of ShadowProtect released 4 days ago).

Will see if I can narrow it down a bit more but it looks like I will have to choose shadow protect or ESET scheduling but not both.

 

ShadowProtect 4.2.5.16175 is now coming up in "ESET live grid" with threat level showing as a red exclamation mark and number of users showing as a 2 person icon. The results are the same on the 3 computer running this combination of software.

Does this mean my copy is infected some how or ESS is incompatible with it?
Is anyone else running ESS and shadowprotect concurrently?

Specific file is:
shadowprotectsvc.exe
Size: 4664104
File version: 4.2.0.0
Available from http://www.storagecraft.com/shadow_protect_desktop.php with free 30 day trial.

Edit: I think the previous version of shadow protect 4.2.1 displayed the same way but version 3 apparently doesn't (according to my brother)

 

Hey patch
No it do not necessarily mean that you downloaded software is infected. It's most probably because the files hash/version number has changed?
From Eset's User Guide : http://www.eset.com/download/documentation/ I have found this from page 85: Hope that it will somehow will help you.

 

Thanks, the rating has dropped back to orange now.

Scans have worked 6/7 times on the 3 computers I run with this combination during the last week. An improvement but I'm not sure if it is good or bad news as it makes it harder again to isolate the fault and I didn't do anything to fix it. Looking at the ESET component update (About) updates on or about 21/4/2012 were:
Virus signature
Cleaner module: 2012/04/24
Antivirus and antispyware 2012/04/23
Archive support module 2012/04/16
Personal firewall module 2012/04/12
Database module 2012/04/04

One of these may have added more reliable handling of scheduled scans. Hard to know as I'm not aware of public access to a change log.

 

Update
Current theory is ESET smart security fails to do a disk scan if an error occurs elsewhere on the computer.

Failure to scan is reproducible on my laptop (Asus U50vg, Windows 7 32 bit home premium).
I use Shadowprotect to backup from the laptop to a peer to peer share on a W7 desktop computer (the one above initially reported).
I schedule the laptop to do an ESET Smart security full disk scan overnight.

If it has been off overnight (so missed the scan), when I start it in the morning it should immediately do the scheduled scan.
It will fail to do the scan immediately if the laptop is away from home (so can't do the ShadowProtect backup, recording a shadowprotect error in the event log).
It will mostly do the scan if the laptop is at home so has access to the shared drive and does the shadowprotect backup.


On the sharing desktop computer a similar behaviour is noted. It appears if an error is reported in the Windows event log, the scheduled scan does not occur. It is more difficult to demonstrate it as clearly as the computer is normally left on, runs a larger variety of programs, I installed a USB card at about the time I noticed the fault initially, and external disks connected via these USB3 ports occasionally report an error (every few days). Removing shadowProtect from this computer does not ensure ESET can reliably schedule disk scans. I have now removed the USB3 card and will report results when available (intermittent fault takes over a week to confirm it doesn't occur).

Note I do always use the manual firewall setting and enable logging of all blocked connections in ESET SS. Displaying them does take a long time to refresh and I wonder if it is a crash risk.
ie Advanced set up -> Network -> Personal firewall -> IDS and advanced options -> troubleshooting

 

Btw
If I "Generate a system health report"
It shows "The Security Center has not recorded an anti-virus product"
Via Control panel -> System and security -> System -> See also "Performance information and tools" -> Advanced tools -> Generate a system health report"

Yet if I look in
Control Panel -> System and Security -> Action Center -> Security ->
ESET Smart Security is listed under "Network firewall", "Virus protection", and "Spyware and unwanted software protection"

I have tried the solution described here but it made no difference http://kb.eset.com/esetkb/index?page=content&id=SOLN217&ref=wsf

I assume the difference is one refers to the Microsoft solution and the other recognises third party solutions like ESET

 

Problem appears to persist with ESET Smart Security 5.2.9 (Home edition)
Keeping the computer busy when a scan is scheduled seams to increase the probability of it missing a scan (eg load up VidCoder (a Handbrake GUI) to reformat a few videos). Occurs on W7 laptop with ESET Smart Security 5.2.9 and old XP desktop with ESET Smart Security 4 (4.2.71.3).

Unfortunately failure does not occur 100%.
Will try V6 beta, hopefully that will fix it.

 

Problem appears to persist with ESET Smart Security V6 beta.

The problem can be demonstrated by setting up a daily or weekly disk scan schedule and loading the computer in the hours prior to the scan. This limits testing to at most once a day.

To reproduce the problem (most rapidly).
1) Delete previous disk scan.
2) Create a new scheduled disk scan, to start an hour or more in the future. I have set it to occur each day and run as soon as possible if it is missed.
3) Set the computer to do a task which will keep it busy. I have done this by using VidCoder to load the CPU 100% transcoding videos.
4) Watch to see if the scheduled scan occurs as set. Note do not restart the computer during this time as a scan will should occur on restarting complicating what should happen at the scheduled time.

I make changes to ESET and install programs via an administrator account but run VidCoder via a user account but this probably makes no difference.

Using this method the scheduled scan was missed on my ASUS laptop running W7 32 bit Home premium and ESET Smart Security V6 beta.

Repeating the same procedure I could reproduce the failure on my brothers desktop computer running W7 32 bit professional and ESET Smart Security 5.0.95.0 I think it is unlikely to be caused by an infection as I have not connected my computer to his network and regular ESET scans have found no abnormality. A driver incompatibility is also unlikely as the fault is demonstrable on a wide range of computers.

Interestingly when I ran the above test with an ESET scan scheduled only 15 minutes in the future, it ran as scheduled on both computers (no program bug observed).

I have ran the above 4 tests only once but would not expect the result to be 100% reproducible as I suspect a race condition causes the fault so will be intermittent.

I now suspect the relationship I have found to various programs in the past are just different ways of loading the computer around the time a scan is scheduled.

The fault is reproducible on ESET Smart Security v4.2.71.3, v5.0.95.0, v5.2.9, v6.0.11.0 Windows XP, Windows 7 32 bit Home premium, W7 32 bit Professional and 4 different computers at home and one at an independent site. The fault only occurs under load particularly prolonged load but even then is intermittent. Hopefully ESET can reproduce this now (and fix it eventually).

 

Seams to be mostly working since about 31/5/2012.
I'm not aware of any change at my end which would have fixed it so I hope it was something ESET did.
Database module 2012/06/01
Advanced Spam module 2012/06/01
Cleaner module 2012/06/01
Antivirus and spyware scanner module: 2012/05/10
Archival support module: 2012/05/11
Virus signature database: regularly updated

Only problem I have noticed it now does is: if I schedule a daily disk scan then turn my laptop (ESET SS 6.0.11.0, W7 32bit) on after the scan it runs the missed scan as expected.
It does not however run the next scheduled scan. Rebooting the laptop doesn't get it to do the now missed scan till near to the time the last catch up scan was run.
It is behaving as if it has a 20 something lock out on repeat scheduled scans, or perhaps my scheduled job was somehow corrupted so the displayed scheduled time was not the actual scheduled time. Will have to do more testing.

I'm yet to run my stress test either, will do some time.

Just hope the improved performance is due to an ESET improvement rather than a rootkit/trojan update to avoid detection.

Edit
Btw I recently switched on HIPS logging and get frequent errors like this ever hour or so. Are they normal

Code:

12/06/2012 9:19:39 PM	C:\Windows\System32\svchost.exe	Get access to another application	C:\Windows\System32\winlogon.exe                    	some access blocked	SelfDefense: Do not allow modification of system processes	Modify state of another application
12/06/2012 9:07:50 PM	C:\Windows\System32\svchost.exe	Get access to another application	C:\Program Files\ESET\ESET Smart Security\ekrn.exe	some access blocked	SelfDefense: Protect ekrn and egui processes             	Terminate/suspend another application,Modify state of another application
12/06/2012 9:07:50 PM	C:\Windows\System32\svchost.exe	Get access to another application	C:\Program Files\ESET\ESET Smart Security\egui.exe	some access blocked	SelfDefense: Protect ekrn and egui processes             	Terminate/suspend another application,Modify state of another application

 

Anyone else having this happen again?
Was working well but seems to be playing up again for last month or so. Same symptoms as originally in that scheduled scans often do not occur but are much more likely to be run as catch up scans on restart.
BTW, I have noticed it on 2 windows 7 machines (32 & 64 bit) running ESET Smart security 5.2.9.1

 

Yes, mine was working fine until two weeks ago and then it stopped scanning. I now have to do it manually. I set up another schedule but that does not work now either.

 

I only have a scheduled scan once per week. It ran as scheduled. I also run Shadow Protect to do incremental backups every hour that I am awake and a weekly full but the full runs on Sunday the day after ESS is scheduled to run the weekly deep scan. So they aren't actively working concurrently.