Thank you for ruining . . . . .

[Chunker]

another good program! I've been using Spybot for over 3 years and the program "was" great. Never had one problem. Updates were easy and fast along with everything else. I ran weekly full pc scans which completed in an average of 25 minutes. Now, with the recent program updates, scans now take anywhere over 4 hours. I've never really finished one, got tired of waiting. It seems to scan only 1 file at a time whereas it used to fly along. What have you done to destroy this program? I see from the forums many people are experiencing the same problem. Needless to say Spybot is no longer welcome on my machine and has been removed. The biggest laugh is when all the Spybot techs try to put the blame on the individuals machines instead of finding the problem within Spybot and fixing it!

[PepiMK]

Do you by chance have the phone number of some good mafiosi at hand, who would be willing to get rid of the malware writers their way? It's indeed not us who invent all the new malware we need to detect. A wire cutter to cut of all Internet lines to RBN lang might be an alternative of course.

Three years ago (since you mentioned that timespan), we used about 30.000 detection patterns. Before the update to 1.6 in July, we used 174.120 detection patterns. Today, we have nearly doubled the amount of thing we detect to 340.806 patterns, and ten times as much as three years ago. Doubling the amount of detections since 1.6 has eaten up all speed improvements in 1.6 I'm afraid :-( Time for new ones in 2.0

Three years ago, malware was still mostly "static" for weeks. Today some malware is generated in thousands of variants each day.

Detecting more (and more sophisticated) malware isn't possible without getting slower

And whether you believe it or not, individual machines can be the reason (not "blame") for scans slower than the average. Example? If a morphic malware usually has files between 12 and 20 KB of size, we use a very deep specifir scan not on all, but only the files in that range. If you now have an "unusual" amount of files in that range, it hits you worse than other machines.

So... there's no "fixing", there can only be constant optimizations. Please feel free to visit my blog on Spybot 2.0, where I hopefully will hae some text on scan engine issues and optimizations ready next weekend.

[md usa spybot fan]

Chunker:

What version of Spybot - Search & Destroy are you running (Spybot » Help » About)?

Scans using the current detection rules run more efficiently using Spybot 1.6 than previous versions.

If you are not running Spybot 1.6.0.30 or above, consider upgrading. The downloads are located here:

• Mirror selection - The home of Spybot-S&D!
  http://www.spybot.info/en/mirrors/index.html

[Chunker]

what you're saying doesn't explain why Spybot in a period of the last 3 weeks jumped from scanning at a total of 25 minutes to a total of about 6 hours! Sure, I've had it for the last 3 years and the bots were updated almost twice a week but the scanning rate "never" increased, but kept steady around 25 minutes. Only after a "major" update about 3 weeks ago did the scan speed slow to a snail's pace. It has nothing to do with the number of bots, but something in the way the program now scans compared to how it used to scan. I'm assuming they made a major change in the scanning engine. As for what version I'm running, unknown cause it's now gone. I put my faith in Spybot and accepted all their updates over the 3 year period. It was a good program while it worked.

[PepiMK]

It does explain exactly that, tough maybe in too technical terms.

Malware evolves all the time, so the methods to scan for them need to get more complicated, and more complicated means more time spent on each file.

Even in just three weeks, the database has grown from 264,737 to 340,806 detection patterns. And while one could assume that this could be a linear increase, it is not, since as I said malware gets more complicated, as do the countermeasures.

We use a bunch of optimizations to reduce the additional load, but see my example above: some optimizations affect all systems, but for some, there are cases where optimizations are doing very well, and other cases where they are not.

To repeat the example: if you by chance have some totally legit software installed that has a thousand files of about the same file size (I mention file size because it's something everyone knows, there would be other similar patterns involved that in themselves does not say a thing about good or bad) as one of the newly added threats uses, you'll get hit by the update much worse than others.

So actually, it is working much better now, just much slower

A (temporary) graphical overview:



"Temporary" since I intend to add some average scan times to it as well.

[Terminator]

After seeing that chart it's no wonder scan times have increased (though in my case the increase is negligable).

There are also many other reasons why scan times can increase e.g a fragmented Hard Drive, too many resident programs, too little RAM etc. If your having trouble with long scan times try looking at your system first before blaming Spybot as sometimes the unlikeliest thing can cause alot of trouble.