Hyper Scan takes longer than Threat Scan and other oddities

[bru]

On my Win 8 computer which has no files other than the OS and two programs (one being MBAM) I noticed my automated Hyper Scan takes about a minute longer than the automated Threat Scan.  Why would that be?  MBAM themselves say the Hyper Scan "quickly checks your system".

 

Also, both take significantly longer than their respective scans on my Win 7 workhorse which has 350GB of files. 

On the old MBAM Quick Scans took at the most three minutes.  Now my scans (both Hyper and Threat) on a basically stock Win 8 system approach 10 minutes or more.  Even the Hyper Scan on my Win 7 takes 7 minutes.  Based on files scanned it should take much longer.

[daledoc1]

Hi:

 

In order to provide some basic system data for the staff, please read the following and post back the requested logs - Diagnostic Logs

 

Thanks,

[bru]

Focusing on the Hyper scan I think its working as intened which in my mind is not proper.  Hyper scans should not take this long.

 

Hyper scans are taking 14 minutes on a system where the Quick scan used to take three at most.  Maybe its more "thorough" but it is bogging down my system and probably many others. 

OK so interestingly I ran another Hyper scan as soon as the first that took 14 minutes was run.  It took 1 min 39 secs.  So it seems the first scheduled Hyper scan that may not have run for a day or two (I have it set for daily but sometimes it is missed due to the machine not being on) takes a long time but subsequent manual Hyper scans take what would be considered normal.
 

It is the daily scheduled Hyper scan that is taking too long.

[daledoc1]

Nope, that's not normal.
 
A Hyper scan is what used to be called the Flash scan in version 1.x.
It scans FEWER items than a Threat scan (which used to be called the Quick Scan).
So, a Hyper scan should be faster than a Threat Scan.

More information about scan types.
 
Having said that, there are many factors that can influence scan times:
These include:
Size of disk
Disk type
Disk speed
Disk caching
CPU speed
Controller type and speed
Operating System used
Amount of files (including temp files!)
Amount of folders
Amount of archived files such as zip, rar, sfx, etc. (if this is enabled)
Rootkit scan or not (if this is enabled)
PUM/PUP scans
Other security programs running at the same time that may potentially be monitoring all file accesses by any other process.
Drive integrity - if a drive is failing it can take a long time to ignore and bypass sectors on a disk or simply fail period and hang the scan.
Other ongoing disk I/O processes
System infection with malware.

Also note that changes in the MBAM database can also cause scan times to increase or decrease, so that's another factor to consider, as mentioned => HERE <=
Sometimes a conflict with your antivirus may be possible as well. You may want to try adding exclusions in your AV - the files that need to be excluded can be found HERE.
(Sometimes slowdowns are not due to conflicts between MBAM and the AV, per se, but rather to older hardware, insufficient RAM, cluttered disks, excessively tight security settings, etc.)

 

If you would like to perform some routine troubleshooting, please start here:

• Please uninstall your current version of MBAM and reinstall the latest build - MBAM Clean Removal Process 2x
• If that does not correct the issue, then please read the following and post back the requested logs - Diagnostic Logs
• NOTE: There is an FAQ section with valuable information located here - Common Questions, Issues, and their Solutions

Thank You,

[bru]

I edited my post after your reply.  First scheduled Hyper scan of the day takes a long time.  Subsequent manual Hyper scans are fast, like I would expect.  Its working this way on all my machines.

[daledoc1]

Hi:
 

Yes, it is normal that subsequent scans (of the same type) on the same rig during the same Windows session will be faster, due to disk caching.

That is nothing new for MBAM, and is the norm for many security applications.

For others who might find this thread, the different types of scans were renamed in version 2:

"Flash" is now "Hyper"
"Quick" is now "Threat"
"Full" is now "Custom"

Hyper scan is available only to paid, PREMIUM users and is not routinely needed or recommended -- if anything is found, a subsequent Threat scan will be needed anyway.
THREAT scan is the most important and most useful scan -- it is the one that ought be run on a regular basis (daily is the default setting now in version 2.0).
Custom depends on what drives, folders and files are selected -- routine use of a "full" system scan is neither necessary nor recommended, as it's a task better suited to your antivirus, and could cause undue disk wear.

 

Anyway, that's the "skinny" on scan types.

If you wish to undertake some troubleshooting, the steps are listed in my previous reply.

 

Cheers!

[bru]

Thanks.  I understand the scan types. 

Not understanding why the first Hyper scan of the day is taking >10 minutes on three differet machines.  Today the scheduled Hyper scan (first one run) scanned 315xxx items and took 14 min 20 sec..  Subsequent Hyper scan scanned 253xxx, like you say due to caching and took 1 min 39 sec.  Same database.

First Hyper scan of the day is always taking an unusually long time on multiple machines.  Have to assume it is the program.
 

[daledoc1]

It's unlikely anyone will be able to explain it in anything other than "generic" terms without some diagnostic logs from your system.
 
That's why I suggested the routine troubleshooting steps.
A clean reinstall often resolves many minor issues.
If not, then the next step would be to post the diagnostic logs for the staff to review.

 

But that's certainly up to you.
 
Cheers,

[bru]

Just saw that the scheduled Threat scan on my bare bones Win 8.1 computer took 17 hours to complete.  Previous scheduled Threat scans took 11 minutes.  Ran a manual Threat scan immediately after and it took 12 minutes.

Three different computers and all have issues with scans. It can't be a coincidence. Realtime protection works fine but scanning, specifically scheduled scans, are a real problem in this new version.  I guess I'll have to live with it.

[anachromat]

When scheduled tasks run significantly slower than manually-initiated tasks (for jobs of any kind), that's usually because scheduled tasks have been set to run at a lower priority.  That's usually appropriate for scheduled tasks because they're usually "background tasks":  things that need to be done, but where the user doesn't want them to compete effectively for resources (like CPU and disk access) against things the user may be doing "by hand" while they're running.  The native Windows task scheduler, for example, runs tasks at "below normal" priority by default.

But I don't know which mechanism(s) Malwarebytes uses to schedule tasks, so maybe that's way off base.  Sounds plausible to me, though  .