For anyone interested:
The discussion referred above is in this dslreports.com thread:
There is also a screen print of CPU utilization here:
Mele20:
Your scan increase time is very small. I don't think it can be compared to mine.
I showed those scan times to demonstrate that there was apparently no radical change in Spybot's detect rules that could account for your increase in scan time.
Some of the detection files (Includes) were split with the updates of 2006-10-13. Although this change corresponds with the time you noticed the problem, I don't think this could be the cause of the problem. The following Includes files:
- Beta.sbi
- Beta.uti
- Cookies.sbi
- Dialer.sbi
- Hijackers.sbi
- Keyloggers.sbi
- Malware.sbi
- PUPS.sbi
- Revision.sbi
- Security.sbi
- Spybots.sbi
- Tracks.uti
- Trojans.sbi
Became (new file names in bold):
- Beta.sbi
- Beta.uti
- Cookies.sbi
- Dialer.sbi
- DialerC.sbi
- Hijackers.sbi
- HijackersC.sbi
- Keyloggers.sbi
- KeyloggersC.sbi
- Malware.sbi
- MalwareC.sbi
- PUPS.sbi
- PUPSC.sbi
- Revision.sbi
- Security.sbi
- SecurityC.sbi
- Spybots.sbi
- SpybotsC.sbi
- Tracks.uti
- Trojans.sbi
- TrojansC.sbi
Can you use your computer during a Spybot scan?
I can and I usually do, although the elapsed time of the Spybot scan increases if I use the system heavily.
What is the load on your CPU?
During a Spybot scan, at or near 100% except certain points during the scan (there is more on CPU time below).
My friend Jack who posted in this thread has a computer very similar in speed and processor. His hard drive is the same size as mine and he has used 92GB of his 160GB hard drive. I have used 106GB of mine. His recent scans took 6 minutes. Why would it be normal for mine to take 30 minutes? I have nothing unusual on my drive and no new applications in the past several months.
The size of the drive and amount used may or may not be a significant factor in the difference in the scan times. Unlike anti-virus programs and some other anti-spyware programs, Spybot does not do an in-depth scan of every file on the primary drive. For a brief description of how Spybot scans see:
There is a special scan for Spyware installers that will inspect the names of all the files on your drive if you mistakenly set it up to do that. I will also cover that later.
You feel it is normal for the CPU to be occupied 70% when I am doing nothing but a Spybot scan?
Processor: Intel - Pentium 4 CPU (2.40GHz)
Processor Speed: Between 2.34 GHz and 2.39 GHz depending on what monitor I use.
System Bus: 533 MHz
Memory (RAM): 512 MB (2 [matched pair] - 256 MB Dual Channel DDR SDRAM @ 333MHz)
Operating System: Microsoft Windows XP Home Edition (Version 5.1.2600 -fully updated)
Hard drive: Western Digital - 80GB – ATA/100 – 8MB buffer – 8.9ms average seek time - 32% used – not defragmented recently
A Spybot scan doing little else (times are in seconds):
Code:
Elapsed CPU Percent
Process Time Time CPU
SpybotSD.exe 644 581 90.22%
Mcshield.exe 644 28 4.35%
System Idle Process 644 6 0.93%
aolsoftware.exe 644 3 0.47%
TeaTimer.exe 644 2 0.31%
svchost.exe 644 2 0.31%
explorer.exe 644 1 0.16%
WINWORD.exe 644 1 0.16%
services.exe 644 1 0.16%
waol.exe 644 1 0.16%
System 644 1 0.16%
vsmon.exe 644 1 0.16%
Other or unaccounted for 644 16 2.48%
Total 644 100.00%
From the above, you see that my Spybot scan runs at 90.22% CPU with all but 2.5% unaccounted for.
It is normal for the Kernel access to be extremely heavy throughout the scan?
The amount of CPU used by the Kernel on your system seems extremely high compared to my observations during the running of the Spybot scan above. Although I did not attempt to quantify the utilization, I would say on the average it was maybe 20% - 25% and during extended periods of time was near zero.
It is normal for one CPU to be heavily taxed by the Spybot scan while the other is lightly taxed?
I don’t know since I have a single CPU system and never had the occasion to look at CPU utilization on a HyperThreading system. Perhaps Jack can answer that if he has a HyperThreading CPU.
Things that I know will increase the elapsed time of a Spybot scan (but not necessarily to the extent nor as suddenly as you experienced).
Excessive number of Windows Temporary Files. You should periodically delete your Windows Temporary Files. One method is to go into Start > Run > type %temp% > click OK > delete everything older than your last reboot.
Excessive number of Temporary Internet Files. Periodically delete Temporary Internet Files by going into Internet Explorer > Tools > Internet Options > General tab > … the exact method varies from here because of the change from IE6 to IE 7.
Excessive number of Bookmarks. It appears that the checking of Bookmarks (Favorites) takes a significant amount of time at or near 100% CPU utilization.
There is a special scan for Spyware installers (files not installed yet) that can be limited to specific directories (actually it should be limited) which can be located on either internal or external drives. To activate this feature go into Spybot > Mode > Advanced mode > Settings > Directories and add directories. There is more on what this feature scans for here:
If entire drives are added to this feature for scanning it can result in elongated scan times as well as cause false positives. It is suggested that if you uses this feature that it is limited to only the directories were you store download executables or installers.
*********************
I don't think that any of the above will real help solve your problem. Do you keep backups that would allow you to return Spybot to the state it was in on 2006-09-24? That way running Spybot with those detection files would conclusively point to whether or not it was changes to Spybot or something that changed in your system that caused the radical change in the elapsed time of the Spybot scan.
Then several months later, I have this strange problem with Spybot. I've never had it take a long time to scan until Oct 14 in all the years I have used it on three different computers.
