I have 2 PCs, a fairly recent/fast desktop and a laptop which is 'getting on a bit'. Both run Windows XP SP3, fully updated. On both, I run scheduled virus scans once a week. These scans start at midnight and I leave them to complete overnight. On my desktop, the scan usually completes in about an hour. My laptop takes around six hours. I lockdown both firewalls before the scans start.
Last night, the weekly scans ran as usual but when I got up this morning, both machines were still scanning. The laptop was at 65% and the desktop at 87%. There was almost nothing happening. On both machines, the scanned item count was ticking over at roughly one item per minute.
Wanting to check my emails, I unlocked the firewall on my desktop, with the scan still in progress. Almost instantaneously it burst into life again and continued normally, completing within a few minutes. The scan came up clean. I decided to try the same on the laptop and unlocked the firewall there. The result was equally immediate with the scan bursting into life again and completing within less than 2 hours and again coming up clean.
I've not seen anything like this before. Does VirusScan need to be online now?
After posting this I noticed the post from IdNewton2 a couple of weeks ago linking VirusScan hanging to Firefox. I too have Firefox 3.5 installed on my machines. I wonder if it's the same problem.
VirusScan's active protection needs to compare notes with a central database plus the Security Center updater checks every few minutes for updates in general. So yes, don't cut off internet access. It shouldn't be necessary anyway.
If you don't want to allow internet access for a while turn the machine off rather than set firewalls to abnormal settings which can cause a whole bunch of issues.
I'll do as you suggest in future although I'm still left a bit puzzled. I've been using McAfee for about four years now in exactly the same way I described and never seen anything peculiar happen as a result of locking down the firewall before the scan. Now, suddenly, it happens on both my machines :confused:.
I never really thought of firewall lockdown as being an abnormal setting - just a security option that could be selected when desired.
This suggests to me that something may have changed in McAfee that has made locking-down more of an issue. If that is the case perhaps it would be useful if McAfee published something (if only in Help) to tell users not to lockdown before a scan. I've certainly not come across anything to that effect anywhere.
Anyway, as I say, I'll leave it unlocked next time and see how things go. Thanks again for the response.
I should have added that, in the current version, a new feature called "Active Protection" was added. It "phones home" if something unknown is discovered and compares notes with an online database.
That could be what is the culprit here. It can be turned off if you wish, but then one layer of protection is removed.
To configure it on SC9.3 & later, double-click the taskbar icon to open Security Center Click Advanced Menu (bottom left) Click Configure (left) Click Computer & Files (top left) Click Advanced (right) Select Active Protection (left) You can turn it off at the right.
Unfortunately, these options are not things that can be 'played with' quickly and easily for investigative purposes. Scheduled scans take a bit too long for that.
Active Protection sounds a distinct possibility for the source of the problem but, as you say, disabling the new feature would remove one layer of security so I'm inclined to leave it in place for now and try leaving the firewall unlocked for future scans.
If any issues remain (or if I find myself with a lot of spare time on my hands - most unlikely), I may come back to this and try disabling the feature but otherwise I'll go ahead with the unlocked firewall.
I'll get back here after my next scheduled scan and report what happened. I'm guessing the problem will not recur.