Help with very slow scan.

I hope someone can help me with this problem. The scan of my system today tool 1:25:36 hrs to scan only 151967 files on two partitions!

I always find the scan a bit slow but usually it is around 40-45 mins. This latest development is very worrying.

I have the setup configured to Blackspears settings and I am using version 2.51.26 and the virus signature database is updated to 1862.

My licence has just been renewed for another two years but I am now very concerned that NOD32 is not performing as well as it should on my system. There are no other issues that I am aware of which would explain this.

My system specs are:
P4 2.4Ghz: 1GB DDR3200 RAM: 2 x 80GB HDD: Nvidia GeForce MX440:
Windows XP Home SP2: NOD32 2.5: ZoneAlarm: AdAware: Spyware Blaster: Spybot S&D:Ewido: Windows Defender.

The only other change I have made lately is upgrading the version of ZoneAlarm free to V6.1.737.000 and that seems to have slightly slowed my startup time.

Any suggestions?

Elray

Elray

 

What does make a difference - disabling archives/sfx archives, runtime packers or advanced heuristics?

 

Thanks for your reply, Marcos.

This scan time has doubled and the size of the partitions being scanned is less than 20GB. That's my main concern. Scans with other applications (ie Ewido) are performing as normal and I have not noticed any other system slowdowns at all.

I can try disabling all or any of those settings and run scans to see what happens but surely the scans are less effective that way?

Elray

 

Hi Elray,

I've had a similar problem a month ago with the trial version. I'm running NOD32 with Zone Alarm Pro, and I was able to pin down the problem to the System Restore folder. Somehow, NOD32 appears to dedicate a disproportionate amount of time scanning the System Restore folder. I still can't explain why, but whenever I disable System Restore before a scan, I get my 481489 files scanned in less than one hour; whenever NOD32 scans my hard-drive with System Restore on, I might end up with scanning times of up to 2 hours, with a large proportion of CPU resources being drained by the program on its way. Just out of curiosity, would you be using OpenOffice.org by any chance?

Hope this might be of some help!

Cheers,
Handinglove

 

Hi Handinglove,

Thanks for your suggestion. That may be the answer to my problem. I usually have System Restore turned off (I use GoBack instead) but last week I had reason to enable System Restore and had not remembered to turn it off again. I must be getting old!

Next time I scan I will try changing the settings as Marcos suggested and make sure I have System Restore turned off.

Cheers,

Elray

 

Well, it's actually not a good idea to disable advanced heuristics and runtime packers as both improve detection to a significant extent. Disable these options just for a test and then re-enable them.

 

The problem must be somewhere else . I , as well as millions of users all over the world , use System Restore and keep it ON all the time . I have no problems with NOD32 and it . Check out Marcos's suggestion .
Also what have you done before everything was fine and now where you encounter problems . Recall everything ...
Does scanning in Safe Mode makes some difference ? Remember that Safe Mode scan will always be slower than the one in Normal Mode but ...

 

Just an update for those who have made suggestions trying to help me. Sorry for the delay in posting back but I am in Australia and the time difference means I didn't read some of the posts until a few hours ago.

Handinglove - disabling System Restore made no appreciable difference to my scan time. It was 1.23.53 hrs so just 2 minutes less.

Marcos - I will try a scan with runtime packers and advanced heuristics disabled next chance I get, but I really don't want to do that. They have always been enabled and my scans were never this long so there must be another explanation.

HiTech_boy: I have "upgraded" to the most recent version of ZA free firewall and that definitely takes longer to load at startup so it may be an issue but I don't quite see how. I also installed IE7 last week but didn't like the way it installed so have uninstalled back to IE6. I haven't noticed any problems since that in any other application.

I don't scan in safe mode and I notice that NOD32 is on Program Files/Microsoft Office for a very long time and also on Windows/Service Packs/ Uninstall files for a considerable length of time. I wonder if there is a way of exluding them?

Perhaps I need to uninstall and reinstall. Something may have corrupted the program.

Thanks for your attempts to help me.

Elray

 

I would suggest repairing Winsock, then repair IMON; see post number 40 HERE

Let us know how you go...

Cheers

 

Hi Blackspear,

Thank you for your interest and suggestion.

I am not having any connection issues as such. I found that the newer version of ZA was slower in loading after startup but I have experienced no loss or interruption to my connection and NOD32 updates seamlessly. As a result I held off trying the Winsock/Imon repair.

I actually uninstalled ZoneAlarm today and installed another firewall to check the difference. The new firewall loads much more quickly and my tests show that it is effectively 'stealthing' my computer.

As I mentioned in an earlier post I am considering downloading a fresh copy of NOD32 and reinstalling. Do you think that's worth a try?

Elray

NB: Also I wasn't feeling very brave about doing the Winsock/Imon repair when I read the details.

 

Yes, that's worth a try.

My suggestions regarding Winsock was due to your mention of ZoneAlarm and slowness, this can be one sign of the requirement to repair the Winsock Layer.

Using the WinsockXPfix tool is really simple, as well as repairing IMON, and should you try it later on, you won't have an issue.

Cheers

 

Sorry for the late answer . Blackspear took the words directly from my mouth Repairing Winsock should do the trick + reinstalling the program .

Here are instructions how to reinstall (by the way , if you like , you can install NOD32 2.7 Release Candidate)


1) Download a fresh copy of NOD32 for your correct operating system
Full paid version

2) Goto Control Panel-> Add/Remove programs and Uninstall NOD32

3) Reboot

4) Goto C:\Program files and manually delete the folder ESET

5) Install NOD32 from the file you just downloaded in step 1
Use Typical settings

6) Make sure you have stable i-net connection and NOD32 (nodkrn.exe) is allowed to go through your firewall and Update NOD

7) Configure NOD32 as shown here


8 ) Enjoy!

 

Thanks for the reassurance, Blackspear. If repairing Winsock isn't likely to have issues beyond my abilities I will try it and then repair Imon.

HiTech_boy - thanks for the detailed instructions. I've uninstalled and reinstalled before but fresh instructions are always good to have. Then I suppose it's back to Blackspear's settings.......

I'll tackle the job in the next couple of days. Might try the new release candidate.

Cheers,
Elray

 

Repairing Winsock is needed because ZA is firewall which sometimes messes with this . NOD32's IMON works in Winsock level and IMON needs it in perfect condition . ZA may have corrupted something .

You are welcome !

 

I would suggest you to do as Marcos advised. Try to turn of (temporarily) advanced heuristics, scanning of archives, runtime packers and self extracting archives only just to find out if turning off one (or more) of these settings makes any difference.

There can be some corrupted archive(s) or damaged file(s) on which scanning engine needlessly hangs too long while rest of disk could be scanned quickly.

 

That's exactly why I believe NOD32 painfully drags when going through my System Restore folder: apparently there's a faulty archive installed by OpenOffice.org (C:\Programas\OpenOffice.org 2.0\program\python-core-2.3.4\lib\test\testtar.tar »TAR - archive damaged) backed up in the System Restore folder, and that might be why NOD32 hangs endlessly there. I tried to turn System Restore off and reinstall OpenOffice.org, but somehow the damaged archive seems to persist.

Cheers

 

Well, I proceeded to download and run the Winsock repair and Blackspear suggested. All seemed to go well but when I went to repair Imon the option to repair was greyed out!

That may well indicate that my copy of NOD32 is corrupt in some way and I am quite happy to download and install a fresh copy.

There may be some system or program files corrupted which cause NOD32 to hang but I'll try this fix first (in the next day or so) and post back if that helps.

Cheers to all,

Elray

 

Did you reboot the system and start IMON? After this it requires a repair in IMON.

Cheers

 

Hi Blackspear,

In answer to your question, yes, I did reboot after the Winsock repair and started Imon but the option to repair was still greyed out. No joy there.

I have now uninstalled version 2.51.26, deleted the Eset folder, rebooted and installed version 2.70.12 RC. Leaving the Typical settings alone, I updated and then ran a scan of the two partitions that have been taking so long to complete. That scan took only 9 minutes 32 seconds.

Just finished going through and setting up the program as per your recommendations. Feeling pretty tired and old so hope I didn't miss anything vital in the process!

Next scan will tell the story of whether the Winsock fix and reinstall have sorted me out.

Thanks for your time and trouble and the other experienced people who are prepared to offer suggestions on this forum. It is much appreciated by people like me.

Regards,

Elray

 

You are welcome Elray.

Let us know how you go...

Cheers

 

Just a final (I hope) report on my slow scan issue.

After setting up my Profile with all options checked I ran a scan of my C & D partitions again today and the result was a much more reasonable 149758 files scanned in 39:49 minutes.

NOD32 2.7.12 RC seems to have fixed the issue I was having.

Thanks once again to all who took an interest and offered suggestions.

Regards,

Elray

 

Yes , NOD32 2.7 is a little bit faster when scanning . However , I still believe it was ZA which caused the problems . Anyway , I'm glad you are OK now

You are welcome !