Are automated scans working?

[Michael Drury]

Hi Guys,
I've installed the professional version of Spybot on Win7 and set it up to run the automated scans.
That is, the MRU scan, updates, system scan and immunization are set up to run regularly.
But I've noticed the system scan doesn't take long when it should take about an hour.
When I've started system scan myself from the Start Center it always takes about an hour.
Also, when I go into system scan and updates from the Start Center they show the last time I ran them from the Start Center.
But they don't show the more recent automated scans.
Why is this?
Are the automated scans actually working?
Any help would be appreciated.

Mike

[Zenobia]

But they don't show the more recent automated scans.

I'm on ChromeOS,so unfortunately I have no Spybot to doublecheck this.But,I am fairly certain I remember that the last time an automated scan was run is not shown in the start center,unlike the manual scan.

Approximately how long is the automated scan taking? :)

[Michael Drury]

I'm on ChromeOS,so unfortunately I have no Spybot to doublecheck this.But,I am fairly certain I remember that the last time an automated scan was run is not shown in the start center,unlike the manual scan.

Approximately how long is the automated scan taking? :)

Hi Zenobia,
Thank you for your reply.

It sounds like a good explanation, but I'm not sure that's what is actually happening, at least in my case.
Since I posted, I've had the chance to look at it again.
I'd previously noticed the system scans appeared to be only taking a few seconds to run instead of about an hour when run from the Control Center.
And both the scans and the updates that had been run automatically were not being reported in the Control Center.
This morning I ran immunization from the Control Center after it had run automatically just a few minutes earlier.
I was surprised when it reported that 1,000's of entries needed immunizing.
So running immunization automatically doesn't appear to have actually done anything.

The user account all these scans are run from is SYSTEM, and they're run with the highest privileges, so they should get full priority.

Mike

[Zenobia]

The default system scan is usually scheduled for once a month.When setting it up to run more often,did you do so through the scheduling page in Spybot settings?That's viewable here:
https://www.safer-networking.org/wp-content/uploads/2013/07/Task-Scheduling-Automation.png
And did you edit the task that was already currently in task scheduler,or did you set up a new task yourself?
The reason I ask is because in the past,I've known people to sometimes accidentally set up a task using the wrong .exe of spybot,when creating one from scratch. :)

I'm not sure why the immunization task did not immunize everything.What did it say on the Spybot task scheduler page,if you viewed it?

Also,I remember that automated updates do work normally,but as there is possible trouble with your Spybot scheduled tasks,could you do a manual update if you haven't already done one since yesterday,just to be on the safe side? :)

[Michael Drury]

Hi Zenobia,
Thank you once again for your reply, and I apologise for taking so long to respond, I've been really busy.

I did modify the scan settings via Spybot, which of course then takes you through to Windows Task Scheduler.
And it was existing settings that I changed.
I did that in order to try and check that the automated scans were working properly, because I wasn't convinced they were.
Since your last post I've tried a few things, although I haven't been able to go through and check and recheck everything, which is needed.
Anyway, here's what I believe is happening.
Running Spybot and initiating the various scans etc where I start the process works properly.
Updates, system scans, immunizing, all fine.
With automating them however, only the updates process and scanning the most recently used files appear to work properly.
The system scan and immunization processes start but don't finish, and don't seem to do anything.
That's where I'm up to at the moment.
As I say, I need to go back and check everything.
I have wondered whether system scan and immunization don't have permission to run.
When I start a scan or immunization myself I get a popup asking for permission to run the program, whilst I don't with updates.
But surely I would get a message saying something like "This program does not have permission to run", and redirected to settings?

Once again, thank you for taking the time to help.

Mike

[Zenobia]

Thank you once again for your reply, and I apologise for taking so long to respond, I've been really busy.
No problem. :)

I'm on Chrome OS,so can't double check,but this I'm almost 99% sure I remember.When Spybot creates the System Scan task,and the immunization task,it also selects Run With Highest privileges for that task.That bypasses the need for the UAC prompt,and allows the task to run without it.So,when you get chance,could you go back into task scheduler and check to be sure Run With Highest Privileges is selected for the Spybot Scheduled Scan in properties.Instructions in the quotes:

To change an existing task by using the Windows interface
If Task Scheduler is not open, start Task Scheduler. For more information, see Start Task Scheduler.
Find and click the task folder in the console tree that contains the task you want to change.
In the console window, click the task that you want to change.
Click Properties in the Action pane. The Task Properties dialog box will appear.
In the Task Properties dialog box:
Click the General tab to view the task's general properties that you can change. For more information about these properties, see General Task Properties.
(Instructions are from this page:https://technet.microsoft.com/en-us/library/cc766442.aspx)

And this is the picture of the General tab in Task Scheduler Properties so you'll know you're in the right place:
http://tr1.cbsistatic.com/hub/i/2008/07/01/a30153c1-c3b8-11e2-bc00-02911874f8c8/wva-fig_b.png
(From this article:http://www.techrepublic.com/blog/windows-and-office/run-uac-restricted-programs-without-the-uac-prompt/)

[Michael Drury]

Hi Zenobia,
That's a very good suggestion.
Unfortunately I've already set all the Spybot scans etc to run with the highest privileges.
I can't help thinking that the problem is caused by something very similar to what you suggested here.
Once again, thank you for taking the time to help me.

Mike

[Zenobia]

You're welcome,and my apologies,I re-read your previous post from before,and see that you already indicated you had the scheduled scans set to run with highest privileges. :oops:

It might be worthwhile to have a look at the arguments.Click the Start button,and type task scheduler in the search bar.Rightclick Task scheduler and Select Run As Administrator.Click Task Scheduler Library,then locate the Spybot scheduled scan.Rightclick the scheduled Spybot scan and select Properties.I believe the arguments are viewable under the Actions tab.Please post what they are here. :)
It will be something similar to this:
C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe /scan /cleanclose

[Michael Drury]

Hi Zenobia,

Here are the arguments for Scanning the system and for Immunization:

Scan the system: "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe" /scan/cleanclose

Immunization: "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe" /immunize

One thing that did occur to me was the user account setting in Task Scheduler under the General tab.
When I first encountered problems I changed the user account settings from SAMSUNG\SAMSUNG to SYSTEM.
The idea was to ensure Spybot had the highest priviledges in case that was the problem.
Unfortunately that made no difference, nor did checking the box 'Run with highest priviledges'.

Once again, thank you for your help.

Mike

[Zenobia]

You're very welcome. :)

There should be a space between scan and cleanclose,to look like this /scan /cleanclose.However,when setting up arguments within task scheduler the arguments are separated by default,as I recall,so this is most probably a case of just missing the space when you typed it here.I did want to mention it though,just to confirm with you.
Other than that,the arguments look fine.


When I first encountered problems I changed the user account settings from SAMSUNG\SAMSUNG to SYSTEM.
The idea was to ensure Spybot had the highest priviledges in case that was the problem.
I remember my own Spybot scheduled scan was set to use the System account,and I had no problems.And I found a post here that seems to indicate that would work without a password(if you do not have one),as long as you were doing so from an account with administrator privileges.That is indicated in the second post here:
http://superuser.com/questions/942482/windows-7-scheduled-task-stops-working-after-changing-windows-password
So,I don't believe that should cause a problem,but lets keep it in mind for looking at later,if need be,as long as the account you are working from is an administrator one. :)

This isn't guaranteed,but it might be useful to Enable All Tasks History.That will give you a history tab to look at regarding the Spybot tasks.It does sound like the task is launching sdscan,(as well as the immunization task also launching immunization),and nothing is happening from there,so it is possible that nothing will be shown in history,however,with any luck,an error might be shown that you can work with.This page has instructions on how to do that,you probably already know how,but I'll post it just in case:
http://itknowledgeexchange.techtarget.com/information-technology/task-scheduler-enable-all-tasks-history/
The next time that the scheduled Spybot scan starts,then closes,please go into task scheduler,rightclick the scheduled spybot system scan,click properties,and then view the history tab.If there are any errors listed in there,please post them here.

[Michael Drury]

Hi Zenobia,

I checked the spacing with the scan arguments and the missing space is down to my typing.
If I've been able to insert an image correctly this should be a screengrab of the arguments:
12425


I enabled the All Tasks History as you suggested.
Here is the text file task history from running Immunization - there are no error messages:

Level Date and Time Event ID Task Category Operational Code Correlation Id
Information 02/12/2015 16:03:18 140 Task registration updated Info 00000000-0000-0000-0000-000000000000 "User ""S-1-5-18"" updated Task Scheduler task ""\Safer-Networking\Spybot - Search and Destroy\Refresh immunization"""
Information 02/12/2015 16:01:10 111 Task terminated Termination 86f9a1d3-2ae7-4c68-8aca-af8f44f10711 "Task Scheduler terminated ""{86f9a1d3-2ae7-4c68-8aca-af8f44f10711}"" instance of the ""\Safer-Networking\Spybot - Search and Destroy\Refresh immunization"" task."
Information 02/12/2015 16:01:10 329 Task stopping due to timeout reached Info 86f9a1d3-2ae7-4c68-8aca-af8f44f10711 "Task Scheduler terminated ""{86F9A1D3-2AE7-4C68-8ACA-AF8F44F10711}"" instance of the ""\Safer-Networking\Spybot - Search and Destroy\Refresh immunization"" task due to exceeding the time allocated for execution, as configured in the task definition. User Action: Increase the configured task timeout or investigate external reasons for the delay."
Information 02/12/2015 15:31:11 129 Created Task Process Info 00000000-0000-0000-0000-000000000000 "Task Scheduler launch task ""\Safer-Networking\Spybot - Search and Destroy\Refresh immunization"" , instance ""C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe"" with process ID 6204."
Information 02/12/2015 15:31:10 200 Action started (1) 86f9a1d3-2ae7-4c68-8aca-af8f44f10711 "Task Scheduler launched action ""Run"" in instance ""{86F9A1D3-2AE7-4C68-8ACA-AF8F44F10711}"" of task ""\Safer-Networking\Spybot - Search and Destroy\Refresh immunization""."
Information 02/12/2015 15:31:10 100 Task Started (1) 86f9a1d3-2ae7-4c68-8aca-af8f44f10711 "Task Scheduler started ""{86F9A1D3-2AE7-4C68-8ACA-AF8F44F10711}"" instance of the ""\Safer-Networking\Spybot - Search and Destroy\Refresh immunization"" task for user ""WORKGROUP\SAMSUNG$""."
Information 02/12/2015 15:31:10 319 Task Engine received message to start task (1) 00000000-0000-0000-0000-000000000000 "Task Engine ""S-1-5-18:NT AUTHORITY\System:Service:"" received a message from Task Scheduler service requesting to launch task ""\Safer-Networking\Spybot - Search and Destroy\Refresh immunization"" ."
Information 02/12/2015 15:31:10 107 Task triggered on scheduler Info 86f9a1d3-2ae7-4c68-8aca-af8f44f10711 "Task Scheduler launched ""{86F9A1D3-2AE7-4C68-8ACA-AF8F44F10711}"" instance of task ""\Safer-Networking\Spybot - Search and Destroy\Refresh immunization"" due to a time trigger condition."

It shows the Immunization task started and ran for 30 minutes before timing out (I'd set it at 30 mins because it should run for less than 1 minute).
I'm currently running System Scan but it is likely to do exactly the same thing - starting and doing nothing until it is timed having run much longer than it should.

One thing I did notice is that in the General Properties tab at the bottom the configuration setting is for Vista rather than Windows 7.
I'm not sure if that would make any difference.
I don't know if the insert image is working but here is a screengrab showing this:
12427

I'm now going to stop the System Scan manually because it's now been running longer than it should take - it's taken over an hour.
Typically I've found it takes between 45 and 50 minutes to scan the entire system - or so the information at the end of the run says.
I've not actually timed it independently myself.
Here's the history of the scan again saved as a text file:

Level Date and Time Event ID Task Category Operational Code Correlation Id
Information 02/12/2015 16:51:26 111 Task terminated Termination 08e64d56-d796-4fb6-b05d-f36953cc509d "Task Scheduler terminated ""{08e64d56-d796-4fb6-b05d-f36953cc509d}"" instance of the ""\Safer-Networking\Spybot - Search and Destroy\Scan the system"" task."
Information 02/12/2015 16:51:26 330 Task stopping due to user request Info 08e64d56-d796-4fb6-b05d-f36953cc509d "Task Scheduler stopped instance ""{08E64D56-D796-4FB6-B05D-F36953CC509D}"" of task ""\Safer-Networking\Spybot - Search and Destroy\Scan the system"" as request by user ""WORKGROUP\SAMSUNG$"" ."
Information 02/12/2015 16:40:40 140 Task registration updated Info 00000000-0000-0000-0000-000000000000 "User ""S-1-5-18"" updated Task Scheduler task ""\Safer-Networking\Spybot - Search and Destroy\Scan the system"""
Information 02/12/2015 16:20:24 140 Task registration updated Info 00000000-0000-0000-0000-000000000000 "User ""S-1-5-18"" updated Task Scheduler task ""\Safer-Networking\Spybot - Search and Destroy\Scan the system"""
Information 02/12/2015 16:16:32 140 Task registration updated Info 02ebac40-f800-0000-641e-3014152dd101 "User ""S-1-5-18"" updated Task Scheduler task ""\Safer-Networking\Spybot - Search and Destroy\Scan the system"""
Information 02/12/2015 15:48:10 129 Created Task Process Info 00000000-0000-0000-0000-000000000000 "Task Scheduler launch task ""\Safer-Networking\Spybot - Search and Destroy\Scan the system"" , instance ""C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe"" with process ID 6716."
Information 02/12/2015 15:48:09 200 Action started (1) 08e64d56-d796-4fb6-b05d-f36953cc509d "Task Scheduler launched action ""Run"" in instance ""{08E64D56-D796-4FB6-B05D-F36953CC509D}"" of task ""\Safer-Networking\Spybot - Search and Destroy\Scan the system""."
Information 02/12/2015 15:48:09 100 Task Started (1) 08e64d56-d796-4fb6-b05d-f36953cc509d "Task Scheduler started ""{08E64D56-D796-4FB6-B05D-F36953CC509D}"" instance of the ""\Safer-Networking\Spybot - Search and Destroy\Scan the system"" task for user ""WORKGROUP\SAMSUNG$""."
Information 02/12/2015 15:48:09 319 Task Engine received message to start task (1) 00000000-0000-0000-0000-000000000000 "Task Engine ""S-1-5-18:NT AUTHORITY\System:Service:"" received a message from Task Scheduler service requesting to launch task ""\Safer-Networking\Spybot - Search and Destroy\Scan the system"" ."
Information 02/12/2015 15:48:09 107 Task triggered on scheduler Info 08e64d56-d796-4fb6-b05d-f36953cc509d "Task Scheduler launched ""{08E64D56-D796-4FB6-B05D-F36953CC509D}"" instance of task ""\Safer-Networking\Spybot - Search and Destroy\Scan the system"" due to a time trigger condition."

Once again it shows the task being initiated and continuing to run without doing anything until timed out or terminated.

I hope this is useful.
Again, thank you so much for taking the time and effort to help.

Mike

[Zenobia]

Hello. :)

Yup,those arguments look fine.

Being set to Windows Vista,Windows Server 2008 should be okay.

I'm not sure why the immunization task is running for 30 minutes and then terminating without immunizing,you are right,it should only take about a minute.Especially since you are able to immunize manually.Nor am I sure why the system scan is doing the same thing.

That's a bit beyond my understanding,so I suggest opening a support ticket here:
https://www.safer-networking.org/support/ticket/
You'd want to choose technical support.When requesting help,it probably would be helpful to them to be able to look at the logs you have included,so you could include a link to your posts here in the message: https://forums.spybot.info/showthread.php?72916-Are-automated-scans-working

After you are done investigating/talking with support,you might want to disable All Tasks History once again,to avoid unnecessary logging.

[Michael Drury]

Hi Zenobia,

I've started a Technical Support Request, as you suggested.
I'll post an update on what we find out.

Thank you so much for your help, I've really appreciated it.

Mike

[Zenobia]

You're welcome. :)


I'll post an update on what we find out.
Yes,please,and thank you very much for doing so :)