Every full scan giving different file count

[vickyme]

Every full scan is resulting in a different file count. The very first full scan was quick however got stuck at 99% & the file count was 746,282. I stopped it & did a quick ran which was pretty quick

After this, I did couple of full scans once again to ensure all is well. The reason I did this was there were pop ups I suddenly saw stating “ you have Trojan, click to remove ” something like this. I didnt click on anything & quickly did the windowd built in scan which came clean.

Again to be on safe side I purchased Kaspersky & hence quickly did back to back scans. Though the scans have reported all is well I am just wondering why the scan counts are different and why the first one is showing such a huge number of 746282.

** I dont visit any rogue sites so for the pop looks like a phishing sort of thing. Anyways please advise on the different counts because I know that once Trojan enter it is very difficult to get rid of it.

Report attached, take a look at the time stamps.

[Berny]

@vickyme Welcome.

After the first scan , Kaspersky scanned the modified and new files.

[vickyme]

Hi Berny

Thank you for the response. I was just wondering, why the first scan when it reached around 670,000 & showed 99 %, time remaining less than a minute however it kept rotating and kept going & the file count increased & stopped at 746,282 however even when the file count stopped the progress circle just kept going.

I started thinking of there is indeed a virus which seems to be self propagating and creating newer files to escape

[vickyme]

Also the count was higher in the first scan & then immediately the count fell from 746,282 to 462,800 Approx and now every scans reports approx 462,000

[Schulte]

Hello @vickyme,

probably at the end of the first scan some archives were unpacked and every file in them was analyzed.

With subsequent scans this is no longer necessary. If the archive itself is unchanged, the files included in it are also ok.

If an archive contains 1000 files and all of them are unpacked and scanned, the counter is increased by 1001. If only the integrity of the archive is checked, the counter increases by 1.

[vickyme]

Hi Schulte

I think it makes sense because I had downloaded and kept virtual box & couple of exe for VMs to create a lab. Of these there was metasploit as well.

I didnt run these file - Windows was a zip of around 7 GB &  I was playing around the scan interface & see that all these exes are in quarantine which is a good thing because some descriptions say Trojan however they seems to purposely built vulnerable Vms for practicing my stuff.

But yes, your point on the zip files does make sense to me now.

 

Thank you, really appreciate your take on it , i’ll keep a close watch though :), thats the fear of Trojan lol.

 

Regards

Vicky