New MB 3.2 and Heuristics Scan

[Phone Man]

A friend notice this and I have just seen this on my systems.

When running a scheduled Threat scan it will do the Heuristic scan very quickly , just a few spins of the icon.  With a manual scan run at high priority it will take a lot longer for the Heuristic scan. I saw this on 2 systems.

Windows 10 1703 fully updated and MB 3.2.2.2018 CP 1.0.188.

mb-check-results.zip

Jim

 

[dcollins]

I don't see any ScanResults from a manual scan in your logs. Can you run another manual scan, make sure it shows up in the reports section, then upload a new mb-check?

[Phone Man]

My bad. I was testing 2 PC's and lost track.

Schedule scan on 8/31 4:00 PM

Manual scan on 8/31 4:26 PM and 9/1 8:30 PM

Jim

mb-check-results.zip

 

 

[dcollins]

So let's look at the last four scans

8/31 @ 3PM: Scheduled Hyper scan set to not scan for rootkits, startup locations, or use heuristics. Scans 2418 items

8/31 @ 4PM: Scheduled threat scan that will scan for rootkits, startup locations, and use heuristics. Scans 358730 items

8/31 @ 4:36PM: Manual threat scan that will scan for rootkits, startup locations, and use heuristis. Scans 358764 items

8/31 @ 8:30PM: Manual threat scan that will scan for rootkits, startup locations, and use heuristis. Scans 358909 items 

The second scheduled seems to line up pretty well with the two manual scans. Are you sure there's not some confusion with that scheduled hyper scan that's throw in the mix?

[Phone Man]

My manual scans look fine.

On the Scheduled Threat scan the file scan goes to approx 285,000 and then the Heuristics runs for just a split second and then closes and shows approx 359,000

I see this in another post also.

https://forums.malwarebytes.com/topic/209661-heuristic-analysis-scan-gap/

Jim

Edited September 5, 2017 by Phone Man

[dcollins]

I just heard back from our engineers on this. We start our heuristic scans earlier in the scan process than the UI indicates, which can make it look like the scan finishes almost instantly. The scans are still running to their full extent though

[Phone Man]

Thanks Devin, that's good to know.

Jim