I’d like to essentially run a full system scan (version 11.1.2253, in Win 7 x64), however I don’t need to scan one of my folders (which amounts to 1.5TB of data, approx), because it mostly just contains old files and folders from past computers and I’m more interested in Windows, system files, running processes, etc, and by skipping that folder I’m basically cutting the scan time down by about 3-4 hours or so, at a guess. I know - not really a full, complete scan, then, but full enough for me to be satisfied as the only nasties in that folder would be dormant ones.
Anyway, I don’t seem to be able to actually exclude the folder and all its subsequent ones. When I go to the Exclusions tab in the Full Scan settings and use the browse button to the add the path (which adds the asterisk to the end of the path), it seems fine, but when I OK it all and run the scan it does show the folder getting scanned. At least it looks that way; it does seem to go through it a lot quicker, but why isn’t it just skipping it completely? If I left it at that speed it would still take an age to process; just not quite as long.
If I try and create a custom scan and add every top folder on my computer/drive except that specific one, it still shows it in the scanning list once the scan is run.
If I try and create a custom scan with zero folders/drives and just modules, running processes and the like, once again it starts going through folders in the usual fashion (albeit quicker, possibly, as written). Why? Is this normal, and if not, what can be done? I don’t know if this is simply the way avast! ‘reads’ a hard drive, or what. A different sort of program, I know, but when I use Malwarebytes and exclude the folder in a full scan it simply doesn’t scan it, cutting the scan time down by about 7 hours.
Avast is not scanning those files - you can verify by enabling the report file for that scan, and letting all types of records to be written into that report; you should see those files are marked as “skipped”.
But yes, they can show in the progress of the scan (though I don’t believe it can affect the speed).
It’s connected to the option “Speed up scanning by reading files in the order they are stored on disk” on the Performance page of the scan settings. When checked, the whole disk is pre-enumerated from the MFT, sorted and then scanned. The exclusions apply, but they are not silenced from the progress.
If you disable that option, the files will be enumerated like you are used to (i.e. the files from the excluded folders won’t be shown). But it shouldn’t be faster (besides the actual file order, that option also makes it possible to ignore hardlinks, i.e. avoid scanning some content twice - which helps e.g. in the case of Windows/WinSxS folder; on the other hand, if that’s the one you’re excluding, it probably won’t make much difference).
That is weird… can you give a few examples of what you see and what is in the scan areas?
So what exactly do you have in the scan areas? Only “Modules loaded in memory” and/or “Auto-start programs”, or also something else? (For example, an antirootkit scan may look like it’s enumerating the whole drive again, because it basically does… and exclusions may not apply there; it’s not really opening the files, just enumerating and checking of something’s “hidden”).
Well, I tried to do a Quick Reply and somehow ended up losing the entire post. Bah. I’ll do a summary.
When I did the Excluded Folder scan it was indeed a lot quicker even with the excluded files showing throughout - 45 mins instead of 4.5 hours. I tried again with the report function turned on (with all reporting options) but had to cancel after 10-15 mins because of bad weather (risk of power cut). Oddly the excluded files don’t say ‘skipped’, though, they say ‘[ + ] is OK’ alongside all the other files that aren’t set to be excluded. I don’t really get that.
As for the custom scan(s) part of my post, I just meant even if I go through the effort of setting a custom scan to exclude folders (not in the Exclusion section, but in the main one where you select what you want scanned), it still shows them being ‘read through’ on the actual scan. But that could be just because of what you mentioned earlier in regards to not actually being scanned.