Jump to content

microsoft security essentails scan time


fivealive
 Share

Recommended Posts

so i turned my computer on and i told mse to update and run a scan and i noticed after 2 minutes it had burned thru almost 250,000 files. Generally a scan takes about 13 minutes to complete for my computer its now doing it in half the time which is great but in concerns me on why its doing it so fast when nothing on the computer has changed.

Link to post
Share on other sites

Hello fivealive,

One wonders if the MSE scan engine would have been "souped up" via a very recent update. If I were you, I'd be posing your question on the MS Answers forum for MS Security Essentials

http://answers.microsoft.com/en-us/protect/forum/protect_scanning

The "regulars" there may have a better clue.

Cheers.

Link to post
Share on other sites

I was running a full scan. I will admit I generally don't watch the scan but I took longer then normal to close the program, so as I went to close it I noticed how quickly it was burning thru the files.

The computer is like 4 months old got it back in december. Maurice you could be correct I had just updated. The program.

Link to post
Share on other sites

@fivealive & goldhound

What is your version details on MSE ?

Here is mine

Security Essentials Version: 2.1.1116.0

Antimalware Client Version: 3.0.8402.0

Engine version: 1.1.8202.0

Antivirus definition: 1.123.664.0

Antispyware definition: 1.123.664.0

On an old Compaq laptop, Win XP (2 GB RAM) a quick scan with MSE took about 9 minutes.

Link to post
Share on other sites

my version details is as follows :

Security Essentials Version: 2.1.1116.0

Antimalware Client Version: 3.0.8402.0

Engine Version: 1.1.8202.0

Antivirus definition: 1.123.664.0

Antispyware definition: 1.123.664.0

Network Inspection System Engine Version: 2.0.8001.0

Network Inspection System Definition Version: 11.0.0.0

Link to post
Share on other sites

You are current, then.

per "rhab" on MS Answers, the version #s I listed are the current ones (at the current time).

In addition, he provides the following resources.

Antimalware Engine Notifications

http://blogs.technet...0-mar-2012.aspx

Antimalware Engine 1.1.8202.0 is released to all Microsoft Security Essentials and Forefront Client Security, Forefront Endpoint Protection, Windows Intune Endpoint Protection customers on 20 Mar 2012. Signature package 1.123.0.0 is the first that contains this engine.

Microsoft Malware Protection Center-Definition Change Log

http://www.microsoft.com/security/portal/Definitions/WhatsNew.aspx

Link to post
Share on other sites

  • Staff

You can use a tool such as tasklist.exe (command line tool built into Windows) to see what modules are loaded under rundll32.exe. It is an application used for running DLL's as processes (executables) and is an essential system component.

For info on how to use tasklist, just open a command prompt (START, then type cmd and press Enter) and type tasklist /? and press Enter.

Link to post
Share on other sites

Dynamic Link Libraries (DLL files) are executables that have have a series of functions. There are a few ways they are loaded...

1. An EXE file calls a routine from that DLL and the EXE will load that DLL into memory and use said routines

2. Register the DLL into the system, such as; regsvr32.exe mydllname.dll

3. Run the DLL by loading RUNDLL32.EXE and load the DLL routine such as; rundll32 mydllname.dll,myroutine

RUNDLL32.EXE is a legitimate OS file and is found in; c:\windows\system32 if RUNDLL32.EXE is executed from a different location, it is probably malware.

Link to post
Share on other sites

  • Staff

Well, infections (and MANY) other programs can certainly use rundll32 in order to execute, but that doesn't make rundll32.exe in and of itself a risk. You can actually learn a lot about how it works by looking at the modules loaded under its process (as described by myself and David above). I just don't recommend trying to terminate anything or unload any modules, but there's certainly no harm in looking.

Link to post
Share on other sites

so ran tasklist and this is what i found

rundll32.exe 1492 ntdll.dll, kernel32.dll, KERNELBASE.dll,

USER32.dll, GDI32.dll, LPK.dll, USP10.dll,

msvcrt.dll, imagehlp.dll, IMM32.DLL,

MSCTF.dll, nvinitx.dll, ADVAPI32.dll,

sechost.dll, RPCRT4.dll, shell32.dll,

SHLWAPI.dll, uxtheme.dll, dwmapi.dll,

ole32.dll, CRYPTBASE.dll, CLBCatQ.DLL,

OLEAUT32.dll, CRYPTSP.dll, rsaenh.dll,

RpcRtRemote.dll, actxprxy.dll, comctl32.dll

no clue what any of it means

Link to post
Share on other sites

  • Staff

Well, all of those DLL's are loaded by RunDLL32.exe. If you wish, you may do some research as to what each file is. I suggest using a search engine, though not all results will be reliable (some sites simply say that any file you search for is or could be an infection, even when the file you're searching for is a perfectly safe system file).

The following sites are reputable and will let you know info about each DLL, and if a file is listed, that means that a file by that name exists within a default installation of the operating system:

Windows 7 DLL File Information

Windows XP DLL File Information

Link to post
Share on other sites

so heres a list of dll files in that isnt listed on that site

nvinitx.dll

and doing a search for the file on my computer and opening up its properties brings up the digital signature as belonging to nvidia which makes sense since one of my graphics cards is an nvidia card.

thanks for all the help exile im learning quite a bit by doing this thank you

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.