Suspend/Resume Scan. What happens if I use the PC and then resume after?

[Abes_D300]

Hi forum,

I'd like to know how the Suspend and Resume feature works. In particular, what does it happen if I pause (Suspend) a Scan, then I don't close Malwarebytes program and I start using the PC - like opening programs (browsers in particular), creating/deleting files, etc .. - and then Resume?

Is Malwarebytes able to scan all the files not scanned before the suspension action, also the new created or downloaded in the meanwhile?

Or it simply continue scanning the list of "not scanned until now" files created at the moment Malwarebytes Scan was Suspended, a list based on the files in the System under Scan at the moment of Scan launch? In this case the new files not existing in the System under Scan at the moment of Scan launch would be ignored. 

Thanks in advance!

Sebastiano
Malwarebytes version: 2.2.1.1043, OS: Win7 Professional 64bit SP1

[dcollins]

If you pause a scan, download new files, then resume the scan, the new files might be picked up by the scan depending on how far along the scan is in the process. For example, if your Downloads folder was already scanned, we won't scan the Downloads folder again in the same scan.

[Abes_D300]

Hi Devin, thank you for your answer, it so works as I supposed.

I don't know what criteria the program follows when it starts and when it runs the scanning, but I'd suggest to add an option if possible, for the payment version eventually.

If this new option is selected, the program makes a "pre-scan", creating the list of all the objects it's going to scan (of course, the list depends the selection criteria the users checks, so it might be files only of a specific drive, i.e. C:).

While scanning, the program logs the objects just scanned in a file, so when the user Suspends the Programs fully knows what just scanned and what is not yet.
When the Program Resumes the scanning, it first make a differential comparison of the Object just scanned with the same object list at the moment of the Scan Resume. If any of the objects is changed (i.e. a new file is in the download directory or a file changed any property - i.e. its size), it is moved in the list of objects to scan, performing a scan again.

This would allow large Systems to be scanned, paused, and resumed with a true full inspection.

Thank you in any case for you attention, Sebastiano