cancel
Showing results for 
Search instead for 
Did you mean: 

"Scanning: Rootkit" in scan progress display

Jump to solution

      Am running Win XP SP3 with McAfee Total Protection 2013. As usual, both full and quick scans have percentage progress, running tally of number of files examined, and the "Scanning: xxxxxxxxxx" file being examined at the moment.

    

     MY CONCERN: Within the past couple of updates, the"Scanning: xxxxxxxxx" has changed so that an alarming "Scanning: Rootkit" appears at least 10-15 times during the scan, sometimes for several minutes. I update every day, do a full scan every day, and typically observe at least some of the scan progress. "Scanning: Rootkit" has never before appeared and I'm curious whether others have found this to be a normal item on their current scanning progress display.

    

     I know McAfee updates include program features as well as detection improvements, and I would like to think this "Scanning: Rootkit" item is a relatively new feature in the progress display rather than evidence of a rootkit-type infection. I have run Kaspersky TDSSKiller, Sophos anti-rootkit tool, Trend Micro RootkitBuster and Mcafee rootkitremover -- each of these says the system is clean. Also, the full McAfee scans have not identified any rootkit-family or other infection and have come up clean; 0 problems, 0 fixes, every time.

     Is the "Scanning: Rootkit" progress item simply McAfee's way of saying, "we are now scanning for possible rootkit infections," and thus merely a new variant of the progress display?  If not, and if McAfee scan results and several different second opinions are all wrong, there will certainly be problems to be solved. Thanks for any experience or insight you can share on this.

Message was edited by: harveytherabbit on 8/12/13 6:04:06 PM CDT
0 Kudos
1 Solution

Accepted Solutions
exbrit
Level 21

Re: "Scanning: Rootkit" in scan progress display

Jump to solution

As you said "the "Scanning: Rootkit" progress item is simply McAfee's way of saying, "we are now scanning for possible rootkit infections,"   If there were rootkits and they were detected it would tell you so and you'd see the results at the end of the scan.

9 Replies
exbrit
Level 21

Re: "Scanning: Rootkit" in scan progress display

Jump to solution

As you said "the "Scanning: Rootkit" progress item is simply McAfee's way of saying, "we are now scanning for possible rootkit infections,"   If there were rootkits and they were detected it would tell you so and you'd see the results at the end of the scan.

Re: "Scanning: Rootkit" in scan progress display

Jump to solution

Thanks for your reply. Am I correct in assuming (1) this is a very recent change in the scanning-progress display and (2) you and others are seeing the same "Scanning: Rootkit" item shown multiple times during your own scans? I know i should be doing something more productive (like maybe going downtown and watching the traffic light change) instead of spending time looking at the scan progression and wondering if something could be amiss. Again, thanks for your very prompt and logical response.

0 Kudos
Peacekeeper
Level 20

Re: "Scanning: Rootkit" in scan progress display

Jump to solution

Re number of times yes I am seeing it (scanning rootkit) several times during the scan. I stopped counting at 5 times. Re whether it is new I am unsure as the option is not mentioned on the feature list but really I would not worry about it.

Viruses/trojans/bots and rootkits are scanned automatically the option is greyed out so cannot be stopped.

Message was edited by: Peacekeeper on 13/08/13 3:58:52 PM
0 Kudos
exbrit
Level 21

Re: "Scanning: Rootkit" in scan progress display

Jump to solution

I think it is recent, but how recent I don't know.

0 Kudos
sparc4me
Level 7

Re: "Scanning: Rootkit" in scan progress display

Jump to solution

Ex_Brit wrote:

I think it is recent, but how recent I don't know.

You 'Think' -but can we get some official confirmation of this. I've been able to find no announcement regarding this 'new' functionality.

Please See-

"Scanning Progress Shows "Scanning: RootKit" AV Plus Crashes + indiscreet Pop-Up upon Internet Connection"

https://community.mcafee.com/thread/59498

0 Kudos
exbrit
Level 21

Re: "Scanning: Rootkit" in scan progress display

Jump to solution

They don't tell us these things.  Technical Support might know.   It's free to contact them - see the link under Useful Links at the top of this page.

0 Kudos
Moderator
Moderator

Re: "Scanning: Rootkit" in scan progress display

Jump to solution

Hi Tony / Peter,

I've came across this while testing the bulk media files (several Gigs) in my XP test machine.

WSS 12.8.1

12.8.310 SC build

It appears more often during the scan may be we should have a discussion in our next meeting re this.!

Regards

0 Kudos
exbrit
Level 21

Re: "Scanning: Rootkit" in scan progress display

Jump to solution

OK.  Because of the US/Canada holiday the next meeting is the 9th Sept..  I'll add it to the agenda.

0 Kudos
exbrit
Level 21

Re: "Scanning: Rootkit" in scan progress display

Jump to solution

I got an answer already:

we are still performing rootkit scan, this is the same text that has always appeared when we did rootkit scans before, it’s just that the user sees it more frequently now.

"The reason for frequent appears of this test is that rootkit scanning can take some time.  Without updating the UI that we are still scanning for rootkits (in between finishing file and registry scans) it appears to the user as though the scan has hung. The change to make this test more visible was made in 12.8 in response to a bug in which someone thought it was taking 10+ minutes to scan a small files."

 

0 Kudos