Jump to content

Recommended Posts

2 minutes ago, MussharrafHossenShoikot said:

malwarebytes does not show which file in which path is being scanned while scan is running. fix this and allow viewing which file is being scanned as scan is ongoing

I will ask for you post to be moved to https://forums.malwarebytes.com/forum/12-malwarebytes-for-windows/

All suggestions should be posted there in the future.

Share this post


Link to post
Share on other sites

Unfortunately, since Malwarebytes' engine is multi-threaded (a fact which can be verified by watching your CPU usage during a scan viewing the load on each individual core and thread (for CPUs with SMT/HT) meaning at any given moment, it is likely to be scanning multiple files, potentially spanning multiple locations/paths/folders, meaning there often is no one path to show.  Additionally, scanning each individual file goes by so fast that it would likely not be legible if displayed accurately/in real-time.  If you use a tool to monitor disk, registry and memory access by a process (such as MS Sysinternals Process Monitor), you can see what Malwarebytes is analyzing at any given time while the scan is running (for example, if you are monitoring the scan to diagnose an issue such as the scan getting hung up).

Share this post


Link to post
Share on other sites
1 hour ago, exile360 said:

Unfortunately, since Malwarebytes' engine is multi-threaded (a fact which can be verified by watching your CPU usage during a scan viewing the load on each individual core and thread (for CPUs with SMT/HT) meaning at any given moment, it is likely to be scanning multiple files, potentially spanning multiple locations/paths/folders, meaning there often is no one path to show.  Additionally, scanning each individual file goes by so fast that it would likely not be legible if displayed accurately/in real-time.  If you use a tool to monitor disk, registry and memory access by a process (such as MS Sysinternals Process Monitor), you can see what Malwarebytes is analyzing at any given time while the scan is running (for example, if you are monitoring the scan to diagnose an issue such as the scan getting hung up).

 

27 minutes ago, AdvancedSetup said:

No need to move the topic. Exile360 correctly replied.

Thank you

 

i say still modify malwarebytes to allow showing which files are being scanned even if multithreaded. other antimalwares show it, make this one show it

Share this post


Link to post
Share on other sites
Posted (edited)

I'm sorry but it cannot  be done but thank you for your feedback.

Any other multi threaded antivirus showing you files are showing you a fake representation. As an example my own computer scans almost half a million files and thousands of registry entries in just over 60 seconds. How are you going to see that many files. It would take more time and resources to even attempt to show that in real time.

 

Partial example

-Scan Summary-
Scan Type: Threat Scan
Objects Scanned: 426282
Time Elapsed: 1 min, 7 sec

 

 

Edited by AdvancedSetup

Share this post


Link to post
Share on other sites

I suspect that what other anti-malware scanners show is likely just a queried value from a single thread for a single instance/object; they probably do not show each individual object which is being analyzed, because scanning objects goes by so quickly (especially once you get to the registry; something you can verify watching the counter of objects scanned in Malwarebytes once it reaches that part of the scan) unless they aren't taking advantage of multi-core and multi-threaded CPUs, though most engines seem multi-threaded these days which makes sense given the prominence of multi-core and multi-threaded CPUs today.

I just did a quick scan with Windows Defender to see how Microsoft handles it, and like Malwarebytes, they simply show a counter, and watching the counter rapidly increase as the scan proceeds, it appears that they too are having to truncate the information displayed because of how rapidly the scan engine combs through most files and objects (save for those that are either large in size or require additional processing, such as archives and installers which must be extracted for analysis).

I know that Spybot S&D used to show what it was scanning for, but that was due to the fact that their entire engine was composed of targeted signatures designed to look for specific threats and threat families.

Now, with all of this said, I will still pass this suggestion on to the Product team for their consideration, however having worked on Malwarebytes with the Developers directly in the past, I know that the information displayed during scans, even when the engine was still single-threaded and we displayed the current path/object being analyzed, it still was not possible to accurately display where and what was being scanned (this is why, even when a user could indicate exactly which file/folder a scan appeared to be stuck on when scans were having issues on their systems, we had to use a tool such as Process Monitor in order to accurately determine where the scan/engine was really getting stuck) and I suspect it is the same for all the scanners that show the current path being scanned, so the actual usefulness of such a feature might be limited.

Share this post


Link to post
Share on other sites

@exile360 @AdvancedSetup not all possess the extremely fast ssds you people possess so scan would not always be fast for all. even under the assumption that scan goes very fast and which file and registry entry being scanned appears like a blur, the folder and drive inside which scan is ongoing is slower to update depending on size of it and content number. i prefer that be visible. think like avast, avg, avira, bitdefender, eset, kaspersky and other antimalwares outside of windows defender. i strongly support being able to see the estimate if not exact of which file, folder, drive is being scanned

Share this post


Link to post
Share on other sites

@exile360 @AdvancedSetup not all possess the extremely fast ssds you people possess so scan would not always be fast for all. even under the assumption that scan goes very fast and which file and registry entry being scanned appears like a blur, the folder and drive inside which scan is ongoing is slower to update depending on size of it and content number. i prefer that be visible. think like avast, avg, avira, bitdefender, eset, kaspersky and other antimalwares outside of windows defender. i strongly support being able to see the estimate if not exact of which file, folder, drive is being scanned

Share this post


Link to post
Share on other sites

It's not about SSDs, the time I was referring to when we were trying to show the current file/path being scanned, all of my testing/validation with the Devs was using an old Samsung 14" laptop with a slow 5400RPM hard drive, not an SSD and all I had was a dual-core CPU (no HT/SMT) which was much slower than modern CPUs, but even with all of that, the information displayed was still never accurate.

Share this post


Link to post
Share on other sites

Now, as I said, I will be passing on your request to the Product team, so what I think and my past experiences don't matter.  I was simply informing you why we pulled the feature to begin with (because it was never accurate, even on slow systems, even when the engine was single-threaded), and the scan engine in Malwarebytes works very different from a typical AV/AM scanner; there are a lot of heuristics and pattern analysis, not only within individual objects/files, but also the Linking Engine which connects files with running threads/processes, startup entries in the registry and other locations, as well as installation directories and software and services keys etc. in the registry; it isn't a raw/flat file scanner the way a traditional AV/AM engine would be, so showing it is very difficult with any accuracy (you'll see this if you look at Process Monitor during a scan as I suggested; you can see it for yourself, all the registry calls and other analyses, even during the file scanning portion of the scan).

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.