When I logon to Windows the first time each day, File Anti-Virus starts to scan files. It scans thousands of them. I do not have any startup task defined. My File-Antivirus is set to scan only new or changed files. It runs about 3 minutes and ends up scanning over 40,000 files! Why is this happening?

hi,
well, "File Anti-Virus" task is not an on-demand task rather than a RTP (Real Time Protection) one...you cannot schedule it, only configure (of course you can pause it but it wouldn't be safe at all!!!). Are you facing with a huge CPU time consumption during such a scan?
M.

Hi.

Yes, CPU consumption is high during this scan. Sometimes, it is difficult to open other applications.

ok, a GSI might help us.....
1) run getsysteminfo on your machine
2) save the automatically generated log, e.g. on the desktop
3) upload it on GSI parser site
4) paste here its URL

M.

Thanks.

http://gsi.kaspersky.fr/lire.php?hl=en&...Microsoft=0#Top

well, as you can see by yourself, this log reports that you have Kerio Outlook Connector up and running which may conflicts with KAV...i'm not sure this is the source of you problem but it could.
M.

This behavior occured before we started using the Kerio Outlook Connector.

In your policy under file antivirus > protection scope can you verify that All network drives isn't checked?

Yes, "All Network Drives" is NOT checked.

Hello,

Do you have any scripts which are executed when a session is opened ?
Also clean the File Antivirus report, reproduce this "issue", export the file Antivirus report and upload it here then we can see what objects are scanned exactly.

Hi. We are on a domain here so group policies process...as they would in most business environments. I also have a logon script but this issue occurred prior to me implementing the script. Attached is the report.

It looks like a scan task is executed each time you start your computer, all objects of C:\Windows\ and C:\Program Files\ are scanned for viruses...

Next morning when you will open your session, When the "K" icon appears in the systray right click on it and check that there is no group scan task that are being executed.

I already checked for that. There is no scan task running. I had a support call with US Support but they were unable to figure it out either.

What if you uninstall Kaspersky Network Agent from this computer ?

I'm pretty sure that was one of the things that we had tried when I first called support. I will have to wait till next time I first log on for the day to try it again. I will be unavailable for testing next week so I will have to try the following week.

OK, I was right. Even with the Network Agent uninstalled, the scan still takes place a logon.

Hello,

I've analyzed your File Antivirus scan report once again, and noticed that most of objects are not scanned thanks to the iSwift technology (column "Reason").
Then I don't think KAV is responsible for this high CPU consumption, it's a normal behaviour that thousand of objects are scanned when the computer starts because many files are loaded/accessed, plus your logon scripts are executed.

Also next time this issue occurs, open the task manager and check consumption of process avp.exe
And what if you uninstall KAV ?

Hi.

The PC doesn't always respond sluggishly while this is going on so I can't get a consumption reading readily. I discovered this during one of the times that it did. When I contacted US Support, they didn't think this was normal. KAV is scanning files that have not been changed every morning when I logon. For example, .dll files from a drawing viewer. Also, I did see installations where this behavior didn't occur however I was unable to determine what options were different. Even though this is not causing slow downs regularly, I don't want it to do this everytime I logon on...and it shouldn't be.

This thread does not appear to be resolved, and I am experiencing this issue as well.

Correct, there has not been a resolution to this.

Is the computer actually being scanned or are you seeing "Total scanned: xxxxx" on the protection status page when you first bring up Kaspersky? When the PC starts, you can open Kaspersky and watch the number increase everytime. Unless you can open the 'Scan' tab and see that there is in fact a virus scan being performed, it is likely that it is not going to stop. It's already been proved that a group task is NOT being ran, right?
For a while we thought that the PC's were still being scanned at startup even after we reconfigured all tasks, but soon realized that it is basically creating a database of files at startup, not actually scanning them for viruses. It is scanning all files for information, not infections.

The computer is being scanned. See the image in the very first post. Yes, a group task is NOT being run.

Was a resolution ever found for this? We are experiencing the same issue, and our machines are basically useless for the first 5 minutes after a login.

Check to see if "quick scan" is enabled in the tasks tab in the admin kit, by design the agent should disable this but I have had some cases of it not doing that.

Set the schedule to manual if it is enabled and test.

Quick scan is indeed running, but there doesn't appear to be a way to turn it off.

Where is the "Tasks Tab"? I can't find anywhere in Admin Kit that a Quick Scan can be turned off.

I too would like to turn this off universally from the Admin Kit. Is there a policy setting or scan task setting to disable this?

If you double click on a computer you will see a tasks tab.

I have not found an easier way other than doing each PC individually.

In my case it only happened to a 15 pc deployment so easily fixed.

I am looking for the KAV 6 MP4 equivalent policy setting as to this one from the KAV 6 MP3 policy (see attachment). With my clients, upgraded from the server to MP4, both full scan and quick scan are set to run at startup, but grayed out. I figure if I can find this equivalent policy in the MP4 policy, that will take care of it.

I do not have a "quick scan" under any of my Task tabs.

Same here, looks like the MP4 policy has a lot less options than MP3 in certain places.

Ours is scanning thousands of files... mine is currently doing 230,000 and my colleague's did ~345,000 before is stopped... just rebooting his machine now to see if it doesn't do them again when it restarts... in theory should only scan changed files... we shall see!

See here, might have a solution to this

http://forum.kaspersky.com/index.php?showtopic=142328

That task doesn't exist here. It's not a task doing this in our environment, it's File Anti-Virus.

Out of interest what's the average file count on your scans showing up the the KAV window?

I do, in the admin kit if I double click on a computer, I get a tasks tab and with mp4 machines I get a quick scan task which is greyed out on the client machine (so can't be turned off).

I had to set the schedule for this task to manual to avoid quick scan kicking in every logon.

After speaking to UK support, the agent should set this task to manual during the install - this fails on some machines for some reason.


John

On ours, it is over 40,000.

Kaspersky really needs to give us the ability to modify Scan Settings from the policies for MP4. This was available as Scan under settings in an MP3 Policy, but there is nothing in the MP4 policies. The only way I can think to configure Quick Scan and Full Scan are to install a vanilla copy of Kaspersky and export the settings to use on the deployment package.

My users are experiencing this problem as well. There is no startup scan task, scans are set to once a week at midday.

To add, I have a handful of users that are reporting that the file-antivirius is running at startup, slowing their systems down considereably. I rebooted a machine and watched its behavior: scanning is not happening but file-antivrius scanning is however. There is no way to stop this and I cannot see anything in file-antivirus that is causing this. startup scans are off, no missed tasks are happening, there is not task name when I right click the K on the systray.

When I looked at someone with MP4, they had the same behavior, but they had a quickscan startup task and in active it was labeled as active task, I removed this.

I have spoken with KAV support about this, there may be a solution, it makes alot of sense, but I am not holding my breath.

I believe this would be klrifix2.exe for sql 2008

http://forum.kaspersky.com/index.php?showt...134612&st=0