External drive scan very slow

[jhipp117]

I am scanning an external 50 GB hard drive, of which only 15GB is used, and the scan is still running after 36 hours. Is this normal or is something wrong?

My computer is a Pentium Core 2 duo, with 2GB RAM, running Windows XP pro SP3. The drive being scanned was taken from an Acer laptop believed to be infected. Having been removed from the laptop it is connected to my computer using the external SATA port. I am using Spybot version 1.6.0.30. I started Spybot from the context menu in Windows Explorer by right clicking on the drive icon and selecting "scan using spybot".

My task manager shows Spybot file scanner running. My CPU's are running at 40-60%, RAM usage 50% (1GB). There is a little window visible on the desktop listing lots of files, some of which are "waiting" and some say "nothing found". There is an empty progress bar at the base of the window and just above that a message saying scanning <filename>. The filename changes from time to time, giving the impression of activity, albeit at a very slow pace.

[Matt]

Hi jhipp117,

:welcome: to Safer Networking Forums.

First of all, you should know that scanning whole drives is not what you should do with Spybot's single file scanner. It wasn't developed for such a usage :nono:, but only for single files or small folders.

Moreover, your version is old. New version: Spybot 1.6.2 (http://www.safer-networking.org/en/mirrors/index.html)

[jhipp117]

:thanks:Many thanks (vielen danke) for your reply.

So how do I scan a passive/external drive, or is that again not what Spybot is designed to do? Most AV applications allow you to select a specific drive for scanning, but I am guessing that that is not how Spybot works. If I want to scan this drive using Spybot I guess I must put it back into the computer for which it is the system drive.

I must say I was quite surprised to see Scan with Spybot in the context menu (I was looking for scan with CAAV), but as it was there, I thought I'd give it a try, just for fun.

As a matter of curiosity, if I let it keep running, will it eventually identify any infected files, or am I just wasting processor time?

[Matt]

Hi jhipp117,

Well... you could let spybot finish this run... :laugh: Spybot should flag infected files if this external drive is infected and Spybot has this kind of Malware in its detection rules. However, it seems to me a little bit waste of time... ;)

I don't know, whether there is a possibility to scan your external drive with Spybot on another way... but I would say no... :sad:

Perhaps other users or a member of TeamSpybot know more than me and will answer here. :bigthumb:

I'm glad I could help a little bit.

If you have any questions, just let us know.

[MisterW]

Hello,
One possibility would be to start Spybot with the advanced parameter "/allhives" . So Spybot would recognize every windows installation e.g. the one on your computer and the one on the external harddrive and scan it like you would scan it on the notebook.

To do so please edit the shortcut of your Spybot - Search & Destroy and write behint the target /allhives e.g. target: "c:\program files\spybot - search & destroy\spybotsd.exe" /allhives

Best regards, viele Grüße
Markus

[jhipp117]

Many thanks (viele danke - you can tell my knowledge of German is very patchy), I'll try that.

[jhipp117]

OK I've tried that. I didn't actually edit the shortcut, because I don't want to do this every time, but I used the run command window to run:

"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /allhives

When the app opened, there was some interesting new text in the main window, but it said:

Found installations (including registry and whole drive)
C:\Windows

And it gave a list of users.

But it did not seem to find any other installations of Windows, of which there are at least four (including Win7 beta, Win7 RC and WinXP) on various drives inside my computer and the drive I have temporarily attached for scanning.

Does the /allhives switch look on all drives, or is there an /all drives switch? In fact, where will I find a list of all command switches for spybot?

[jhipp117]

Hello, I am sorry, before making my last post I missed this FAQ: :oops:

http://www.safer-networking.org/en/faq/30.html

However, I have now read it, but it is not quite clear. When it says:

/allhives
Scans all windows installations on your system, even inactive ones ...

Does it mean all installations on your C drive, or all installations on all drives? Certainly when I used the switch, it only seemed to be looking on my C drive.

I'd be very grateful if anyone could clarify this point.

[MisterW]

Normally it should look for all Windows installations on the system that can be reached from the system. So if there is a hidden partition or something like that this partition would not be scanned.

Are you sure the external drive was plugged in correctly? I thought that it should be found by Spybot...