MSE ?

[PaulB]

I recently downloaded driver software for my mouse from Logitech. As I do with all downloads, I scanned with both MSE and Malwarebytes. I right-clicked on each .exe (in turn) and selected "Scan with Microsoft Security Essentials..."

I don't understand the results for MSE:

MSE.PNG

[HansV]

Is this consistent? When I scan a .exe with Microsoft Security Essentials, the number of scanned items is always more than 0...

[PaulB]

Good catch, Hans. I've only noticed it with the two execs in the graphic but I went back to check. All the execs that I checked with MSE had 1 or more items scanned except for device driver execs. These all reported 0 items and the scan time was instantaneous.

Can you verify this on your system? I run Win 7 HP x64.

[HansV]

I don't have any device driver downloads at the moment, sorry.

[tedshemyers]

I have downloaded the same software from Logitech with no problems. You should be OK. Don't know why you should have had this problem with MSE.

[PaulB]

Thanks, Ted. I'm not worried about the download from Logitech, nor do I think there is a problem with MSE. Based on what I see, MSE does not appear to scan drivers. In addition to the Logitech mouse drivers, I get the same result (0 items scanned) scanning my nVidia driver, the APC UPS driver, the Bamboo pen tablet driver, a BIOS update, a DVD firmware update, external USB HDD software and my Samsung monitor software. Could it be that MSE does not scan real-mode software?

[JoeP]

Are you scanning the installer file or the installed drivers?

Have you checked the MSE settings for exclusions?

Joe

[PaulB]

Thanks, Joe, you nailed it. All my example execs above were located in a series of folders that were excluded from scanning. While my intent was to ignore these folders during full scans, it appears that nothing in an excluded folder will be scanned even when explicitly requested. Something to be aware of...

[JoeP]

Glad you found it. Strange behavior though. I would've expected that if you specifically requested a scan it would ignore the exclusions. Good to know.

Joe

[ChrisGreaves]

... it would ignore the exclusions.

... or at least ask you.

Thanks Joe. Good catch!

[johjue]

Thanks, Joe, you nailed it. All my example execs above were located in a series of folders that were excluded from scanning. While my intent was to ignore these folders during full scans, it appears that nothing in an excluded folder will be scanned even when explicitly requested. Something to be aware of...

Good catch, indeed! I observed the same behavior last week but didn't give it a lot of thought at the time. I remember thinking, "What the heck does 'O' files scanned mean?". I had done the exact same thing, setting up some exclusions to make full scans go faster. I had assumed that a manual scan of a single file would be unaffected. So I have been following this thread with particular interest. Thanks for clearing this up, Paul and Joe! We all just became a little bit more knowledgeable.

John

[Argus]

I don't understand the results for MSE:

I've been caught by exactly the same thing months ago. The only downside, for me, using MSE is that it, compared to other AV software I've used, takes a long time to scan some folders as you open them, i.e. the real time monitoring of folders with many, or for AV software, interesting files, such as my download folder. (I do use several sub folders and occasionally move files around, so it’s not all in one.) I've found that it many times can take quite a few seconds before the folder is completely updated and the explorer window responds, then all is fine and dandy until after next boot time. It’s the same thing with some of my image folders, most of the time. A quicker disk drive did help to some extent.

So I did what some have done for full scans, but for real time scanning, excluded some folders. Couldn't believe my eyes when it ignored an on demand scan, as the one Paul did, so back to square one.

Slightly off topic: As most know, there is scanning done at the end of the download with for example Fx; indeed, MSE will warn you even before you have opened an Explorer window. And above all, if all is working, it's pretty impossible to even click on a file; so as long as the on demand scanner doesn’t do something the real time monitor can’t do, the on demand scan before execution of a file is most of the time just therapy. The real time monitor could perhaps have problems if there are several archives (zip files) within archives, something that the on demand scanner should cope with, but I’ve found that the real time monitor can easily detect test files in double zip files, so it’s quite capable.

However, the post download scan in Fx isn’t done if you download to a folder that is excluded, MSE will not step in.

I find it very, very odd of MSFT to let MSE exclusions not only mean exclusions from full scans, on demand or scheduled, but also on demand scans via the context menu and real time monitoring. The latter was my reason to try it, but a full exclusion wasn't worth it for those folders. One could perhaps set up a folder that is monitored and then move files to non monitored folders, then there wouldn't be any delays working with the files and folders.

[ChrisGreaves]

The only downside, for me, using MSE is that it, ... takes a long time to scan some folders as you open them, ...

Ah HAH!
Win7 64-bit Explorer Sluggish
Thank you, Argus

(wanders off to experiment ....)