Pro 4.8.1195 Boot Scan

[slybo]

I updated my Pro from 4.8.1169 to 4.8.1195 with no problem. But when I do a boot scan and it comes back to windows I then do another restart of the computer I get an error in the Notice section of the Log Viewer as follows

5/13/2008 11:30:09 AM   SYSTEM   1308   Automatic rootkit scan was not started as it didn't complete successfully during the last run.

I am using xp sp3. Can you help me with this. Thanks slybo

[Vlk]

This simply means that you restarted the OS before the background rootkit scan had a chance to complete. This is just for information.

We implemented this feature for people whose machines actually crashed during the rootkit scan.

[slybo]

I do not understand. When I did the boot scan I allowed it to finish and go to windows, then after waiting several minutes restarted the computer which is when the error appears to happen. Where did I not allow it to finish? slybo

[slybo]

I just noticed I got another one this time by just doing a restart of the computer. I also see a post below mine of someone else having this with a restart. slybo

[slybo]

The other post on this says something about 15 minutes to do a aswar scan. Does this mean even though I see nothing happening after a restart I need to wait more than 15 minutes for the rootkit scan to complete? Is that what aswar if for? slybo

[DavidR]

I don't know if this is a valid suggestion on what has happened or not Vlk I'm sure will correct me if it isn't

The normal rootkit scan after windows boot doesn't actually start for several minutes to allow windows to complete its boot. This stops the rootkit scan getting in the way of other programs loading and also ensures if there are any rootkits they too would be loaded, so when the comparison is made between what is running Vs what is reported as running, they won't evade the scan by not having been loaded.

So you might have restarted the scan during that rootkit scan and it may have been that scan that generated the errors. This is speculation on my part though and I can't be 100% sure that this is exactly what happened.

If you check the date of the other post relating to the 15 minutes it covers the beta version and that issue was corrected in beta build 1192 and shouldn't be present in the regular 4.8.1195 release.

[slybo]

When I did the boot scan I allowed it to finish and windows to load and then waited another 5 minutes before restarting the computer, are you saying the rootkit scan would take longer than 5 minutes after windows was back up? If so that could be my problem but I thought the rootkit scan took only a few seconds? slybo

[Vlk]

slybo,

1. the boot-time scan and the startup rootkit scan are two completely unrelated things. The former takes place only if you explicitly schedule it; the latter starts automatically after each reboot, on the background.

2. you don't need to wait for anything (you can restart whenever you want). It's just that if you restart in the middle of the rootkit scan, it will not start the very next reboot. That's all.


Cheers
Vlk

[DavidR]

The rootkit scan should take seconds rather than minutes, but what I don't know is what the delay is before it starts in this new version. It used to start 2 minutes after the desktop was displayed and then went to 5 minutes on an updated beta version I believe and I don't know if that has changed again with that last beta or the latest regular release, so it is possible you restarted during it.

We will need some input from Vlk or another of the Alwil team, on this delay.

@ Vlk
What is the current delay before the rootkit scan starts after the desktop is displayed.

[slybo]

Thanks for the replys. When I was talking about the boot scan I was meaning the rootkit scan that took place with it, is it right that a rootkit scan happens with a boot scan? Also what is the delay time after windows loads and the startup of the rootkit scan starts and how long does it take on average to run the rootkit scan? This could help me understand. slybo

[fazio93]

This simply means that you restarted the OS before the background rootkit scan had a chance to complete. This is just for information.

We implemented this feature for people whose machines actually crashed during the rootkit scan.

i got that too. i get it. thanks for the clarification.