• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos1 Stats

Puzzled by recent Norton Security Quick Scan times

I have a Windows 7 PC with a SSD boot disk. A Norton Security Quick Scan normally takes around 2min 30 secs.

On 9th Sep I noticed that a Quick Scan took much longer than usual - around 10 min 40 secs.
The number of items scanned had not significantly increased.
Two further Quick Scans on 9th and one on 10th Sep also lasted around 10 min 40 secs.

The following day (11th) I ran 12 Quick Scans - all took around 2 min 30 sec (i.e. back to the usual duration).

On 13th, 14th and today (15th) the Quick Scans are taking much longer again - around 10 min 30 secs.

The Quick Scans are run when the PC is otherwise idle and all scans have found zero security risks.

The Norton Security History filtered by Scan Results gives the following information for recent Quick Scans:


Date / time              Time taken  Items scanned
        
15/09/2018 13:48    00:10:27    10,940
15/09/2018 00:10    00:10:30    11,177
14/09/2018 23:56    00:10:27    10,817
14/09/2018 21:52    00:10:33    10,928
13/09/2018 19:19    00:10:35    10,813
11/09/2018 20:55    00:02:31    10,849
11/09/2018 20:05    00:02:28    10,931
11/09/2018 19:54    00:02:26    10,927
11/09/2018 19:43    00:02:29    10,949
11/09/2018 19:30    00:02:27    10,931
11/09/2018 19:19    00:02:31    10,949
11/09/2018 18:01    00:02:34    10,834
11/09/2018 16:49    00:02:25    10,831
11/09/2018 15:25    00:02:29    10,956
11/09/2018 14:41    00:02:30    10,932
11/09/2018 13:31    00:02:31    10,991
11/09/2018 12:28    00:02:45    10,834
10/09/2018 19:18    00:10:46    11,083
09/09/2018 13:12    00:10:38    11,122
09/09/2018 12:55    00:10:40    11,197
09/09/2018 11:57    00:10:44    10,933
08/09/2018 13:54    00:02:24    10,803
08/09/2018 13:37    00:02:30    10,923
08/09/2018 13:03    00:02:37    11,238
07/09/2018 20:25    00:02:29    10,892
07/09/2018 20:12    00:02:26    10,896
07/09/2018 20:03    00:02:31    10,963
07/09/2018 18:32    00:02:37    10,845
07/09/2018 16:27    00:02:30    10,925
06/09/2018 19:34    00:02:43    17,125
06/09/2018 19:30    00:02:57    17,183
05/09/2018 19:30    00:02:39    10,869
05/09/2018 19:05    00:02:43    11,415
05/09/2018 18:52    00:02:39    10,910
05/09/2018 18:12    00:02:39    10,905
05/09/2018 15:33    00:02:35    10,916
05/09/2018 15:00    00:02:36    10,917
05/09/2018 13:48    00:02:31    10,878
05/09/2018 13:40    00:02:33    10,893
05/09/2018 13:26    00:02:36    10,949
05/09/2018 13:15    00:02:28    10,747
05/09/2018 12:31    00:02:36    10,894
04/09/2018 22:10    00:02:41    10,941
04/09/2018 21:21    00:02:37    11,536
04/09/2018 21:16    00:02:45    11,663
03/09/2018 21:41    00:02:33    10,950
03/09/2018 13:40    00:02:25    10,804
03/09/2018 13:26    00:02:29    10,901
03/09/2018 13:04    00:02:35    10,967
03/09/2018 12:36    00:02:32    10,962

I attach a graph of this data.


I am a bit puzzled by this.
I can't think of any changes that I have made that could cause this large increase in Quick Scan time.
It is odd that the scans went back to normal duration on 11th Sep.
I was wondering if anyone else has noticed that their Norton Security Quick Scans took much
longer than usual recently (you can check by looking at Norton Security History filtered by Scan Results).

File Attachment: 

Replies

Kudos2 Stats

Re: Puzzled by recent Norton Security Quick Scan times

I have noticed that an occasional Quick Scan will take longer than normal.  My best guess is that there may be other processes running in the background that cause the PC to slowdown, which affects Norton as well as anything else that happens to be running.  Norton scans are resource intensive, so if the CPU happens to be busy doing other things it could definitely cause scans to take longer.

Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

I also notice constant idle scans just keep running and running when I'm doing stuff. I would like to see a setting where you can disable or set a schedule Idle scans.; I do not need to be constantly getting defrags and file clean ups 

Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

blue50moon:

I also notice constant idle scans just keep running and running when I'm doing stuff...

Hi blue50moon:

Like the OP Snowman1, I sometimes see a Quick Scan take slightly longer to run to completion during system idles (10 min or so) but as SendOfJive suggested, this usually happens when there are other CPU-intensive tasks running while my system is idle (e.g., Norton Insight, Malwarebytes Threat Scan, Windows Disk Defragmenter, etc.).   I occasionally see an Automatic LiveUpdate run outside of system idles if my computer has been powered off (or stays in sleep/hibernation mode) for a long period of time but in general all automated Norton background tasks listed at Settings | Administrative Settings | Background Tasks | Configure should only run when your system is idle.  This assumes that you have not deliberately scheduled a Quick Scan or other scan to run outside of idle mode at Security | Scans | Scans and Tasks | Custom Scan | Go as described in the support article Schedule a Quick Scan.

If you move your mouse or do something to take your system out of idle while a background task is running the task should temporarily pause (i.e., the Status at Settings | Administrative Settings | Background Tasks | Configure should temporarily change from Running to Canceled) and the task should resume from where if left off the next time your system goes into idle.  If background tasks like Quick Scan and Insight Optimizer (a.k.a Idle Time Optimizer, a disk defragger that runs during system idles) running outside of idle mode that might indicate that your Norton installation is corrupted and needs to be reinstalled. I've posted instructions in C_Swords' thread My CPU is Being Abused by Norton on how to use the Norton's Performance Graph (Performance | Graphs | Usage | CPU tab - nortonsecurity.exe activity is displayed as yellow peaks) and Norton Background Tasks window (Settings | Administrative Settings | Background Tasks | Configure) to determine when Norton is consuming high amounts of CPU and whether this CPU consumption is related to a specific Norton background task.

...I would like to see a setting where you can disable or set a schedule Idle scans...

Background Norton Quick Scans are automatically scheduled to run during system idles each time an Automatic LiveUpdate delivers a new virus definition set (now called the SDS Definitions) and can't be completely disabled. You can create and/or re-schedule scans (open the main Norton window and go to Security | Scans | Scans and Tasks | Custom Scan | Go) but it shouldn't be necessary to schedule additional Quick Scans. If you want to schedule a deeper Full System Scan to run every month or so during system idles this can also be done at Settings | Antivirus | Scans And Risks | Computer Scans | Full System Scan | Configure.

I do not need to be constantly getting defrags and file clean ups 

C_Swords' thread My CPU is Being Abused by Norton also has a list <here> of Norton settings that you can safely disable (or reschedule) to reduce Norton's consumption of system resources (e.g., both types of disk defragmenters, Windows temporary file cleaning, etc.). Most scheduled disk cleaning tasks are managed at Settings | Tasks Scheduling.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.15.1.8

Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

Thank you for the suggestion that there may be other processes running in the background that cause the PC to slowdown. I thought that I should investigate this possibility in more detail. I tried two approaches.

The first approach was that I plotted the Quick Scan times for the maximum history available up to 16th Sep - this is attached as Quick Scan time 2.pdf.
You can see that the majority of scan times lie on a gradually rising trend line from around 2 mins to 2 mins 30 secs.
I am assuming that this is the normal behaviour when the PC is otherwise idle.
There are some points above this trend line - I am assuming that this is probably due to other processes running on the PC.
However note that none of these points lie much above 4 minutes.
The most recent cluster of points are around 10 minutes 30 seconds - much higher than anything seen previously.
There is one outlier at around 13 minutes which could be due to other processes running on the PC.

The second approach was that over the last few days I have ensured that the PC was idle and monitored the CPU usage during Quick Scans that take around 10 minutes 30 seconds. My PC has an Intel Core i7-3770K CPU with 4 Cores / 8 Threads.
During the Quick Scan I could see that the overall CPU usage was mostly around 12.5% - Norton Security was mostly fully using one of the 8 threads and the other 7 threads were mostly idle.

So at the moment it doesn't look like other processes running in the background are likely to be the cause of the extended Quick Scan times.

I should mention that I am running Norton Security 22.15.1.8.

At various points recently I have also checked the following to try to explain what is happening:

- The configuration of Norton Security doesn't seem to have changed.
- The CPU is clocking at the correct multiplier during a Quick Scan.
- The SSD is not showing any errors in SMART statistics.
- Check disk on the SSD reports no errors.
- I recalculated the Windows Experience Index and the performance subscore for the SSD had not reduced (still the maximum allowed score of 7.9).
- sfc /verifyonly reports no errors.
- The BIOS settings have not changed.

So no obvious explanation there.

I also attach Quick Scan time 3.pdf which shows the times for the most recent Quick Scans.
It shows that there are two very distinct bands of scan time with little scatter around each band.
It also shows that today (18th Sep) it has flipped back to the normal 2 mins 30 secs (for all 4 Quick Scans performed so far today).

I will be monitoring over the next few days to see if it stays at 2 mins 30 secs or flips back to over 10 mins.
If it continues at around 2 mins 30 secs then I will be happy!

During the time shown on the graph there have been multiple Live Update downloads.
I am wondering if these could be causing the changes in behaviour.
It does seem very odd that nobody else has reported much longer Quick Scan times though.

However I did encounter a situation about a year ago where two PCs with the same Norton Security product that were both up-to-date according to Norton Live Update were actually running with different versions of software / definitions.

https://community.norton.com/en/forums/norton-security-crashes-module-sdsappendix1x64dll-during-full-system-scan

Not sure whether this was due to them connecting to different update servers or Norton deliberately phasing the deployment of new software / definitions.

So still a bit of a mystery.
The Quick Scans seem to be completing successfully, but I don't like it when my PC starts behaving strangely!
(I wonder if anyone from Norton might be able to explain what is going on...)

Kudos1 Stats

Re: Puzzled by recent Norton Security Quick Scan times

Hi Snowman1:

Do you recall installing or updating any software just before 09-Sep-2019 when your first cluster of 10 min Quick Scans were occurring? I checked the scan results in my Norton security history when I read your original post and haven't seen any unusual scan times or number of items scanned for my Quick Scans going back to 07-Sep-2018, although I don't have a Win 7 SP1 OS.

If your Quick Scans start running slowly again try disabling Settings | Antivirus | Scans and Risks | Computer Scan |  Compressed File Scans.  I've heard of instances where Norton scans sometimes get stuck on a compressed file (e.g., a newly downloaded .zip file or self-extracting .exe installer), and the problem will usually resolve itself after the archive is unzipped / extracted.

One other possibility is that you downloaded an executable file or applied an update for software that was recently released or isn't widely used in the wider Norton community.  When this happens Norton Insight will initially give the file a poor trust rating / low reputation and scan the file(s) during a Quick Scan. As more users in the wider Norton community install the update and there are no reports of adverse effects via Norton Community Watch in the wider Norton community Symantec will eventually change the file rating to trusted and it will be skipped during subsequent Quick Scans.  You can sometimes speed up this process by going to Security | Scans | Norton Insight | Go and forcing an update of your file trust ratings instead of waiting a day or two for the background Norton Insight task to run during a system idle.

Your second cluster of long Quick Scans occurred just after Microsoft's September 2018 Patch Tuesday updates were posted on 11-Sep-2018 and there was also a Norton v22.15.1.8 product update that started rolling out about the same time - this Norton update was released in two parts and I received the second part of the product update that changed my version number from v22.15.0.88 to v22.15.1.8 on 13-Sep-2018.  It's possible there was a minor glitch during your Norton update (or even your Patch Tuesday updates) that eventually resolved itself, but if the problem returns a refresh of your Norton installation using the Norton Remove and Reinstall (NRnR) tool as instructed at https://www.norton.com/nrnr might solve the problem.

If one of the Norton employees doesn't jump into this thread (the user name will have a red badge with the label ADMIN or EMPLOYEE) then you might have to contact Norton Customer Support via Live Chat at https://www.norton.com/chat and ask them if other users have recently reported these longer Quick Scans.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.15.1.8

Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

Hi Imacri,

Thank you for your thoughts on this puzzling problem - I have tried to follow up on them below.

The extended Quick Scan times of above 10 minutes have appeared in two distinct periods so far:

Period 1 started after 08/09/18 13:54 and before 09/09/18 11:57.
Period 1 ended after 10/09/18 19:18 and before 11/09/18 12:28.

Period 2 started after 11/09/18 20:55 and before 13/09/18 19:19.
Period 2 ended after 17/09/18 22:58 and before 18/09/18 12:07.

Looking at the changes made via Norton Live Update during the four transition intervals:

Interval 1 - after 08/09/18 13:54 and before 09/09/18 11:57.
Changes to:
Norton Antispam definitions
Norton Reputation Revocation List
Norton SDS Definitions X64
Norton Web Protection Definitions
Norton Whitelist

Interval 2 - after 10/09/18 19:18 and before 11/09/18 12:28.
Changes to:
Norton Antispam definitions
Norton IPS definitions
Norton Reputation Revocation List
Norton SDS Definitions X64
Norton Web Protection Definitions
Norton Whitelist

Interval 3 - after 11/09/18 20:55 and before 13/09/18 19:19.
Changes to:
Norton Antispam definitions
Norton IPS definitions
Norton Reputation Revocation List
Norton SDS Definitions X64
Norton Web Protection Definitions
Norton Whitelist
ENGINE, NGC, INSTALLDIR
MUI, NGC, MUIDIR

Interval 4 - after 17/09/18 22:58 and before 18/09/18 12:07.
Changes to:
Norton Safe Web Statistics
Norton Antispam definitions
Norton IPS definitions
Norton Reputation Revocation List
Norton SDS Definitions X64
Norton Web Protection Definitions
Norton Whitelist

So all of these transition intervals included 5 or more changes to Norton Security components.

I installed the September Patch Tuesday Windows updates on 14/09/18.
14/09/18 falls during Period 2 but is not within a transition interval.

Looking at other software changes I have recorded during the period 08/08/18 - 18/09/18:
I updated NoScript on 09/09/18, 10/09/18 and 14/09/18.
I updated Flash Player and Adobe AIR on 11/09/08.

I also migrated my DNS Servers away from Norton ConnectSafe (because it will be closing down in November) on 17/09/18.

I do have Compressed File Scan enabled. If the Quick Scans go over 10 minutes again in future I might try disabling it temporarily to see if it changes anything.

When I was watching a Quick Scan that took over 10 minutes it appeared to be doing the normal activities but much more slowly than usual. By this I mean that it took longer to display the first activity being performed (at the right of the yellow bar) but after that the activity being performed changed regularly (rather than it appearing to be stuck on a specific activity for a very long time).

My current guess is that changes to Norton Security components seem to be the most likely cause of the extended Quick Scan times. If anyone at Norton is aware of what caused the problem then it would be good if they could post here so that we can be confident the issue has been resolved.

Today the Quick Scans are continuing to run normally (around 2 mins 30 secs) - see attached file Quick Scan time 4.pdf. I'll keep an eye on them for the next few days.

File Attachment: 
Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

Quick Scans ran normally (around 2 mins 30 secs) from 18th to 22nd Sep.
However today (23rd Sep) they have gone back up to 10 mins 30 secs again  - see attached file Quick Scan time 5.pdf.
The transition took place after 22/09/18 19:36 and before 23/09/18 11:42.
In this transition interval I did not install any software on my PC but Norton Live Update did change several Norton Security components.

I did try temporarily disabling Compressed File Scan but this did not resolve the problem.

My best guess is that the problem is being triggered by changes to Norton Security components made via Norton Live Update.

As no Norton employee has engaged with this thread so far I will try raising it via Live Chat.

File Attachment: 
Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

Snowman1:

Quick Scans ran normally (around 2 mins 30 secs) from 18th to 22nd Sep. However today (23rd Sep) they have gone back up to 10 mins 30 secs again...

Hi Snowman1:

I had one long Quick Scan last night around 5 PM CDT local time (~ 20 hours ago) on my 32-bit Vista SP2 machine but my Norton Performance Graph at Performance | Graphs | Usage shows that I also had a Malwarebytes Threat Scan running to completion during the same system idle.  I zoomed out to 1 Day for the graphs below and looked at both CPU and RAM consumption on my system for 5 PM last night.

None of my Automatic LiveUpdates that have run since last night have delivered a new SDS (virus) definition that would trigger a Quick Scan, but I'll monitor my system for a few days and post back if I see any unusual scan times.

I don't know how you monitor your system to see which processes are consuming CPU and/or RAM during your Quick Scans, but I find that Microsoft Sysinternal's Process Explorer can be useful for diagnosing these types of problems.  Just unzip the ProcessExplorer.zip file and then double-click the appropriate executable (procexp.exe for a 32-bit OS; procexp64.exe for a 64-bit OS) - no software installation required.  If you sort the CPU column (with processes consuming the highest CPU consumption at the top) you might be able to catch a spike in CPU consumption by svchost.exe (the Windows Service host process) or some other executable while Quick Scan is running during a system idle.  Process Explorer also has a graph that will trace processes consuming CPU and RAM in real time, but it only has a short 5 minute window.

I posted details in the VistaForums thread Processes in Task Manager During Updates about how I was able to diagnose a Windows Update problem on my computer using Process Explorer that might be helpful, but your problem will be a bit more difficult to catch because your background Quick Scans will be cancelled (paused) every time you bring your system out of idle.  If you haven't already done so, adjust the current power plan for your Win 7 computer to increase the amount of time your system remains in idle mode before Windows turns off your screen to save power as instructed <here> so you can watch Process Explorer and/or the Norton Background Tasks window (Settings | Administrative Settings | Background Tasks | Configure) while your system is idle.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * NS v22.15.1.8 * Process Explorer v16.21

Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

Hi Imacri,

Attached are two CPU usage graphs for a recent Quick Scan that took 10 mins 35 secs - one was taken with Process Explorer, the other with Norton Security. You can see that Norton Security is the process with the highest CPU usage.
It takes 12.5% (mostly kernel mode), which is fully loading one Thread of my 4 Core / 8 Thread CPU.
The other 7 CPU Threads are mostly idle.
My PC has 16GB of memory so memory usage does not appear to be an issue during Norton Security Quick Scans.

I'm still puzzled (my Live Chat today didn't manage to identify what is causing the recent oscillation between normal duration and extended duration Quick Scans).

Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

Hi Snowman1:

I brought my system out of sleep mode this morning at ~10:45 AM and left my computer alone for about an hour to show you what my Norton Performance Graph and Background Tasks window look like when background tasks run during a system idle.  I had an Automatic LiveUpdate and and Quick Scan both run during the same system idle before my system went back into sleep mode.

Notice that:

  • The performance graph confirms my tasks ran during a system idle (Sleep Mode is shown as a dark grey background; Idle Mode is shown as a light grey background)
  • There was a short background Windows task that ran automatically under the Windows Service host process svchost.exe during the same system idle around the 42 min mark (probably a short defrag of my system boot files or the search indexer).  This Windows svchost.exe activity is shown as blue peaks of CPU (versus the yellow peaks of CPU activity by nortonsecurity.exe).

You shouldn't be overly concerned with the amount of CPU that Norton background tasks like Quick Scans consume.  It's normal for Norton to max out an entire CPU core when running idletime background tasks - it's designed this way to complete these tasks as quickly as possible while you computer is not in use.

Two minor things I did notice in your own Norton Performance Graph, however.

  • If you confirmed in your Background Tasks window that this period of high CPU occurred at the same time as Quick Scan, then it appears to have run outside of a system idle (i.e., the background is white, not light grey).  This might not be true and your Quick Scan might have actually run during a system idle - my Norton Performance Graph doesn't always correctly identify when my system goes in or out idle (a glitch I've observed many times).
  • You had an unknown non-Norton process (i.e., blue peaks of activity) constantly consuming about 4% of your CPU.  Even your Process Explorer graph doesn't identity this unknown activity.

Do you have any idea what might be consuming this small amount of CPU?  For example, was your browser open when you captured the images of your CPU consumption, or do you have other security software that loads at boot-up and runs runs in real-time protection mode along with Norton?  Do you have the same .NET Framework NGEN (Native Image Generator) tasks scheduled in your Windows Task Scheduler that will cause Norton to "wake up" during system idles and monitor ngen.exe as described in mickhardy's thread CPU Usage About 30% (a common issue which Norton has never fixed)?  Your Process Explorer graph shows nortonsecurity.exe consuming ~ 12.5% of your CPU but doesn't show what process is consuming the remaining 4%.

If you cannot identify what process is consuming this low level of CPU activity, it might be worthwhile to run a Norton Full System scan (Security | Scans | Scans and Tasks | Full System Scan).  If that Norton scan doesn't detect any threats, run a second-opinion scan with the free Malwarebytes scanner to see if it can any threats missed by Norton.  See the instructions in BevStr's thread MyWay Search if you haven't used Malwarebytes before, and be sure to disable the 14-day trial of Malwarebytes' real-time protection (Settings | Account | Deactivate Premium Trial) before starting your Threat Scan.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * NS v22.15.1.8 * Malwarebytes v3.5.1
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

 Hi Imacri,

You shouldn't be overly concerned with the amount of CPU that Norton background tasks like Quick Scans consume.  It's normal for Norton to max out an entire CPU core when running idletime background tasks - it's designed this way to complete these tasks as quickly as possible while you computer is not in use.

I agree that I should not be concerned that Norton Security fully loads one CPU Thread during a Quick Scan.

If you confirmed in your Background Tasks window that this period of high CPU occurred at the same time as Quick Scan, then it appears to have run outside of a system idle (i.e., the background is white, not light grey).  This might not be true and your Quick Scan might have actually run during a system idle - my Norton Performance Graph doesn't always correctly identify when my system goes in or out idle (a glitch I've observed many times).

The background is correctly white because the Quick Scan was initiated by me rather than run during a system idle.

You had an unknown non-Norton process (i.e., blue peaks of activity) constantly consuming about 4% of your CPU.  Even your Process Explorer graph doesn't identity this unknown activity.

I don't think this few % of CPU in blue is anything to be concerned about - I was running Windows Task Manager and Process Explorer and they use a bit of CPU time.

do you have other security software that loads at boot-up and runs runs in real-time protection mode along with Norton?

I don't have any security software other than Norton (I'm assuming that Firefox add-ons such as Norton Safe Web, NoScript and IBM Security Rapport shouldn't cause a problem).

it might be worthwhile to run a Norton Full System scan

I have run several Norton Security Full Scans recently. I attach a graph of the time taken for a Full Scan.
The three points above 35 mins are at times when a Quick Scan took much longer than usual.

No Quick Scan or Full Scan has detected any threats.

I have just tried running a couple of Quick Scans when the PC is not connected to the internet (what Norton Security warns is a 'Limited Scan') to see if there might have been any delays due network access to a remote server during a Quick Scan.
The 'Limited Scans' also take around 10 mins 30 secs at present so this seems to rule out slow network access or a slow remote server being the cause of the problem.

I haven't been able to identify any hardware problem with my PC. Programs other than Norton Security seem to be behaving normally. The times at which the Quick Scan times flip from normal (2 mins 30 secs) to much longer (10 mins 30 secs) or vice versa don't seem to correlate with anything I have done (e.g. installed new software). Nobody else on this forum seems to have reported a similar problem so far.

So I am still puzzled.

I think I might overwrite my boot disk with a system image I took some time before the problem started.

File Attachment: 
Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

At 24/09/2018 22:45 a Quick Scan took 10 mins 37 secs.

I initiated a Live Update at 25/09/2018 00:17. There had been no other Live Update after 24/09/2018 22:45.
It updated 3 modules:
Norton IPS Definitions
Norton SDS Definitions X64
Norton Web Protection Definitions

Then I initiated a Quick Scan at 25/09/2018 00:20 which took 2 mins 38 secs.

It seems possible that the change to one or more of the 3 modules above triggered the flip back to normal Quick Scan times.

Another Quick Scan at 25/09/2018 00:28 took 2 mins 34 secs. The CPU graphs for this are attached (the Quick Scan is marked by the red arrow). The CPU graphs look similar to the previous ones for a 10 mins 30 secs scan apart from the duration of the scan.

I would very much appreciate it if someone appropriate from Norton could review this thread and respond. This behaviour of repeated flips in Quick Scan times seems very odd to me (I have not seen anything like this on my PC previously). If there is an explanation (e.g. Norton have recently changed the way something works) then I don't want to waste any more time worrying about it or overwriting my boot disk with an old system image unnecessarily.

Kudos1 Stats

Re: Puzzled by recent Norton Security Quick Scan times

Hi Snowman1:

I have no way of escalating your issue to the Norton employees, so unless one of the Norton Gurus brings your thread to the attention of a Forum Moderator you might have to start another Live Chat at https://www.norton.com/chat (give them the Case # of your previous chat) and ask them if they could provide instructions for collecting and sending diagnostic logs to second tier technical support.

It's still possible that your Norton installation was corrupted during the recent update to v22.15.1.8, so before you re-image your system you might want to perform a clean re-install of Norton using the instructions posted in freespace77's thread Windows Defender Still Active and see if that solves the long Quick Scan times.  I've had glitches like this appear after a Norton product update and a clean re-install often fixes the problem. Just note that running the Norton Remove and Reinstall (NRnR) tool in advanced "Remove Only" mode (STEP # 3 of the instructions) will also remove other Norton products like Norton Utilities, Norton Family, etc. so post back for modified instructions if you want to try a clean re-install and have other Norton software installed.

The product update announcement Announcing Norton 22.15.1 Update for Windows has a change log for both v22.15.0.88 (rel. ~ 11-Aug-2018) and v22.15.1.8 (rel. ~ 13-Sep-2018). According to my Security history at Security | History | Show | Intrusion Prevention my IPS engine (v8.2.1.10) and IPS driver (v16.2.1.22) haven't changed in over a month and were last updated on 13-Aug-2018, although IPS and other definition sets listed on Symantec's Virus Definitions & Security Updates page are updated several times a month.

 -----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * NS v22.15.1.8 * Malwarebytes v3.5.1

Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

Hi Imacri,

I had another Live Chat using my existing case number as you suggested and referred them to this thread (again).

I was not happy at one point when they wouldn't escalate to the next level of support unless the automatic renewal service was enabled. It seems to me that I have bought Norton Security and they should support it while my licence is valid - any decision on subsequent renewal and the mechanism for doing so should not be relevant!

Norton are not interested in any diagnostic logs at the moment (not sure I agree with that either...oh well... at least I tried...).

I'll try a remove and re-install of Norton Security. I have not had to do this before so I have a couple of questions:

1) For the period in which Norton Security is uninstalled what will protect my system? - Is the Windows Firewall automatically turned on for this period?

2) I do have other Norton software installed (Norton Ghost 15 and Norton Utilities 15) - Is there a way of removing and re-installing Norton Security without modifying the other Norton software?

Further advice / instructions appreciated.

(Meanwhile another Live Update today has flipped Quick Scans back to 10 mins 30 secs)

Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

Snowman1:

I was not happy at one point when they wouldn't escalate to the next level of support unless the automatic renewal service was enabled...Norton are not interested in any diagnostic logs at the moment (not sure I agree with that either...oh well... at least I tried...).

Hi Snowman1:

If you purchase your Norton product from their online store and have automatic renewal enabled I believe your subscription includes the Norton Virus Protection Promise.  When they said they couldn't escalate your problem they might have meant they couldn't run a remote of scan of your computer to look for malware that might have been missed by your Norton Full System scan.  That's why I suggested a second-opinion scan with the free Malwarebytes scanner.

I've complained in the past about the lack of support in this forum from Norton employees (see my 2014 thread Better Tech Support by Symantec Employees Needed in the Forum) but no one in Symantec/Norton management seems to be listening.  These days it usually has to be a critical error (e.g., a buggy Norton driver that's causing a BSOD) before one of the Forum Moderators will jump in to a thread and ask for diagnostic logs.

I'll try a remove and re-install of Norton Security. I have not had to do this before so I have a couple of questions:

1) For the period in which Norton Security is uninstalled what will protect my system? - Is the Windows Firewall automatically turned on for this period?

2) I do have other Norton software installed (Norton Ghost 15 and Norton Utilities 15) - Is there a way of removing and re-installing Norton Security without modifying the other Norton software?

Using the Norton Remove and Reinstall (NRnR) tool in advanced "Remove Only" mode as instructed at https://www.norton.com/nrt will also damage the Veritas/Symantec System Recovery software that replaced Norton Ghost when Norton Ghost was discontinued on 30-Apr-2013  - see Pcloverxp's comment in the thread BUG-Norton Security 22.10 degrades system performance.  It would be fairly easy to uninstall Norton Utilities before running the NRnR tool in advanced "Remove Only" mode and then reinstall Norton Utilities after the NRnR wipe, but it might be more difficult to uninstall and then reinstall / re-configure Norton Ghost.

You could try a simple refresh of your Norton installation using the NRnR tool in "normal" mode as instructed at https://www.norton.com/nrnr.  Those instructions specifically state that running the tool in normal mode will not remove Norton Utilities or Norton Family and I assume that Norton Ghost would also be unharmed, but you might want to confirm that with Norton Customer Service first before proceeding.  I don't know if a simple refresh of your Norton installation using the NRnR tool in normal mode would help but I don't think it would do any harm.

Yes, your Windows Firewall should automatically re-enable itself while Norton is uninstalled. If you don't want to refresh your Norton installation using the NRnR tool in "normal" mode let me know the exact Norton Security product (e.g., Norton Security Standard, Deluxe, or Premium) and I'll provide customized instructions to use an offline installer that you can use to reinstall your Norton product while disconnected from the internet.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * NS v22.15.1.8 * Malwarebytes v3.5.1

Kudos1 Stats

Re: Puzzled by recent Norton Security Quick Scan times

You know, of course, that repeating a scan shortly after an initial scan will result in faster times because Norton will skip unchanged files that were scanned previously.  Norton will only re-scan those skipped files if they have been modified or new definitions have been received.

As I mentioned, I also experience some scans taking significantly longer than others.  I am not sure why this would be considered an issue, as long as the scans are completing normally.  I certainly would not go to the trouble of re-imaging my PC or even reinstalling Norton over this, as the situation is likely to continue as it does not seem to be a defect or anything that is indicating a problem with the product.

Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

SendOfJive:

You know, of course, that repeating a scan shortly after an initial scan will result in faster times because Norton will skip unchanged files that were scanned previously.  Norton will only re-scan those skipped files if they have been modified or new definitions have been received.

Hi SendOfJive:

I'm not sure that's the explanation in this case.  Snowman1 listed both the scan times and number of items scanned in their original post <here> and there doesn't seem to any correlation.  For example, two of their shorter scans (< 3 min) on 06-Sep-2018 scanned over 17,000 files.  The exact number of Trusted and Skipped files are listed in the advanced of each scan at Security | History | Show | Scan Results if Snowman1 wants to follow up on that.

As I mentioned, I also experience some scans taking significantly longer than others.  I am not sure why this would be considered an issue, as long as the scans are completing normally.  I certainly would not go to the trouble of re-imaging my PC or even reinstalling Norton over this

Nor would I, but I'm happy to throw out a few more ideas if Snowman1 wants to pursue this.  A 10 min Quick Scan for a computer with their specs (i7-3770K CPU, 16GB RAM, SSD) seems a bit excessive.  I'm still wondering if there's some program loaded into memory that triggers these slower scans, even if the program isn't hogging noticeable amounts of CPU and other system resources.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.15.1.8

Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

Hi SendOfJive,

I have tried to investigate the potential issue that you raised about the number of items scanned and the skipping of files during a scan.

I reworked the spreadsheet used to produce Quick Scan time 2.pdf (originally attached to my 18th Sep post and also attached below for convenience).

The total items scanned in each scan is plotted in Quick Scan items 1.pdf (attached).
The main feature is a gradually rising trendline, with some points above and below the trendline (mainly in localised clusters).

I then combined these two datasets to get ms / item which is plotted in Quick Scan ms 1.pdf (attached).
This is elapsed ms per item, but since the Quick Scan uses most of one CPU Thread it should also be a good approximation for CPU time per item.
You can clearly see the enormous change in behaviour after 9th Sep - it suddenly takes around four times longer to scan an item.
Before 9th Sep the trendline in Quick Time ms 1.pdf is flatter than in Quick Scan time 2.pdf (because of the gradually rising trendline in Quick Scan items 1.pdf).

I am not sure whether the total items scanned figure includes or excludes skipped files and trusted files.

Expressing the number of skipped files in a scan as a percentage of the total items scanned in that scan gives the following figures for the 1854 data points in the spreadsheet - Minimum = 0%, Maximum = 2.31%, Average = 0.92%.
So it would appear that any impact due to skipping files is likely to be very small.

Expressing the number of trusted files in a scan as a percentage of the total items scanned in that scan gives the following figures for the dataset in the spreadsheet - Minimum = 5.13%, Maximum = 8.87%, Average = 6.34%.
So this doesn't seem to explain the sudden fourfold increase that started on 9th Sep.

As a Norton Guru please could you ask Norton to read this thread and either:

1) State that the recent large increase in Quick Scan times was a deliberate act (ideally explaining why this fourfold increase was necessary and where this change was announced to warn users that it was coming).

2) State that they do not understand why I have experienced the recent large increase in Quick Scan times (and say what, if any, further information they need from me to investigate further).

Thank you.

Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

Hi Imacri,

I decided that restoring an image of my Windows 7 partition taken well before the extended Quick Scan times started should eliminate more possible explanations than just removing and re-installing Norton Security. I went back to June 7th. I have no reason to think that my PC had any issues at that time - it ran normally for 3 months afterwards up until 9th Sep.

(Out of curiosity I did run the Norton Remove and Reinstall tool first to see what happened - in addition to removing Norton Security it annoyingly also removed Norton Ghost. It did not remove Norton Utilities.)

After restoring the June 7th image of my Windows 7 partition but before connecting to the internet I ran an offline Quick Scan. This took 2 mins 18 secs (i.e. normal behaviour). At this point the Norton Security version was 22.14.2.3.

I then connected to the internet, ran Live Update once and immediately disconnected from the internet.
Live Update updated 19 modules. I then rebooted the PC but did not reconnect to the internet.
The Norton Security version had changed from 22.14.2.3 to 22.15.0.88.
I ran an offline Quick Scan which now took 10 min 36 secs.
I repeated with another offline Quick Scan which took 10 min 22 secs.
Neither scan reported any security risks. An Offline Full Scan also reported no security risks.

So the major change in Quick Scan times to 10 min 30 secs seems to be entirely due to changes in Norton Security modules made via Live Update.

We now seem to have eliminated the following possible explanations:

- Changes to Windows 7 since June 7th (e.g. Patch Tuesday updates).
- Changes to software other than Norton Security since June 7th.
- Changes to the DNS Servers I am using (moving away from Norton ConnectSafe).
- A hardware problem with my PC (e.g. the SSD having errors or reduced performance).
- An unknown problem that has only ever occurred once (e.g. a rare software installation / upgrade error).

The fact that the increased Quick Scan time has now been seen with Norton Security 22.15.0.88 seems to imply that it was not introduced in version 22.15.1.8.

The increased Quick Scan time seems to have been triggered by a change in one of the 19 modules that were updated.

Combined with the information in my earlier posts one of the following 3 modules seems most likely to be the trigger:
- Norton IPS Definitions
- Norton SDS Definitions X64
- Norton Web Protection Definitions
(all of these were included in the 19 modules that changed)
Norton IPS Definitions may be a less likely candidate because it was not updated in Interval 1 (see my post of 19th Sep).

Kudos0

Re: Puzzled by recent Norton Security Quick Scan times

Snowman1:

...Combined with the information in my earlier posts one of the following 3 modules seems most likely to be the trigger:
- Norton IPS Definitions
- Norton SDS Definitions X64
- Norton Web Protection Definitions

 Hi Snowman1:

Keep in mind that correlation doesn't equate to cause.  You seem focused on one possible trigger (your definition updates) but haven't followed up on other possibilities. For example, you haven't reported the results of a second-opinion Malwarebytes scan or confirmed what other processes are running on your computer when these longer Quick Scans occur [recall my comments <here> about ngen.exe or other unidentified process(es) that could be running at the same time as your Quick Scans].

Here's what my Norton performance graph looks like when I run a manual Quick Scan outside of a system idle while Process Explorer and Firefox are running.  I always see this "U-shaped" yellow peak of activity by nortonsecurity.exe with higher CPU consumption at the beginning and end of every Quick Scan with my dual core CPU.  Your CPU consumption is much flatter, and as you noted before, it looks like your nortonsecurity.exe activity is maxing out during these longer Quick Scans at 12.5% activity and saturating one thread of your CPU (100% / 8 total threads).  Perhaps this is an issue that's specific to the way hyper-threading works on your quad core i7-3770K CPU (launched April  2012) vs the way that Norton v22.15.x is designed to access available system resources when running low-priority tasks like Quick Scans.

-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * NS v22.15.1.8 * Malwarebytes v3.5.1-1.0.365
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

This thread is closed from further comment. Please visit the forum to start a new thread.