Hundreds Of "autoscan Settings Changed" Alerts In 4 Days

Hi Chimel,

Are you referring to these or something different?

I know they occur on my laptop (with Laptop mode enabled) each time I connect or disconnect the laptop from a/c power. Is your PC a laptop? But the quantity is not in the hundreds.

Regards,

Yes, I saw the 2 threads about the laptop connect/disconnect issue in my search for this event name, but this is my desktop.

I counted 70 events today, 4 yesterday, 210 2 days ago, 110 in just 6 hours 4 days ago. Usually at very short intervals.

These are the same events shown in your screenshot.

Regardless of the number, these "events" are non-events and should not be reported if it's really about idle/active switch.

I ran a full system scan just now, and I noticed that there was no "Autoscan settings changed" events for over 1 hour, while the scan was running.

The events did not restart until after the manual scan, but they seem to be the opposite of what I would expect:

The first event after the manual scan completed happened when the computer went idle and says "Autoscan was disabled."

As I understand, Autoscan is supposed to run while the computer is idle, so if anything, it should have said "Autocan was enabled."

When I came back to the computer which was running the screensaver, another event was logged at that time, saying "Autoscan was enabled."

Being a desktop, I find these events very peculiar. :huh:

When Cristi B. reads your posts, he should have some idea how to proceed with investigating. I'll be following this topic as you have peaked my interest.

Do you have the latest Build 15.0.34.1416?

Regards,

The very same build.

What I find also peculiar is the difference between the dozens or hundreds of such events every day, except for Tuesday (4 events.)

As far as I can remember, I used my computer Tuesday exactly the same way as I did Monday or today (Wednesday.)

I used my computer rather intensively, and these events appear only during usage time.

For instance, my computer was idle for 2 hours before this post. There were no events during this time, except for the one when the computer went idle, and when I resumed usage.

I noticed the Update log also has hundreds of events. A few "Update succeeded" but mostly a conflicting "Reboot required" with a description "The update process was completed after your computer was restarted" which seems to indicate that the reboot already happened and is therefore not required. Oh well, better focus on the Autoscan log for now...

Do you power off your PC, say, at night, leave it running, or hibernate/sleep? The reason I'm asking is because of the question asked in this topic & my posted reply.

It almost sounds like Auto Scan is starting & stopping with system activity & recording the event. Have you tried switching Auto Scan OFF for a period of time to see if events are no longer recorded?

Regards,

I've also been getting this problem for the last couple of weeks. This has happened 3 times in the last 1.5hrs alone, the longest period of it being reported off is over half an hour.

I also started getting Safebox Auto Sync disabled warnings even though I have never used Safebox or ever switched on autosync for Safebox.

Can someone please advise what is going on?

I assume it's caused by Autoscan being switched on, but switching it off to double check. I'll report the results later today.

After reenabling Autoscan, I'll use different apps, such as Internet Explorer instead of Firefox, WMP instead of VLC, etc.

I don't think the computer was switched off at night these past 4 days, but it was definitely restarted a couple of times.

Again, this morning, there was no event between 10PM and 7AM.

The computer is set to never go to sleep, and hard disk spin-off is set to 20 minutes, but it's not linked to that either.

There is also no Windows system event recorded at the time of these Bitdefender events.

These events are not linked to specific activities such as switching to a specific application or switching tabs when browsing in Firefox.

It's not caused by mouse/keyboard idle times either, as these events sometimes are only at a few seconds interval.

The only differences from a standard setup are:

- I disabled Auto Pilot

- I disabled Show Bitdefender Toolbar

- I disabled Search Advisor

- I added several drives/folder exceptions

- I forced an update after installing BDAV Plus 2012 4-5 days ago

- I ran a full system scan yesterday because there is no way to know if Autoscan is doing its job

I have BDAV set up on my laptop the same as you have on your desktop:

- I disabled Auto Pilot

- I disabled Show Bitdefender Toolbar

- I disabled Search Advisor

- I added several drives/folder exceptions

The only obvious difference is I turn on Laptop Mode when I boot my laptop.

I wonder if there could there be some other program running in the background on your desktop that is "triggering" BD? You might want to try using msconfig to do a Selective or Diagnostic Startup just as a test.

We'll have to see what Cristi B. thinks.

Regards,

So as expected, there was no Autoscan event for the past 3 hours since I disabled Autoscan.

I'll reenable it now and try to switch or disable apps one at a time to see if it affects results, as soon as I see the events are back.

I'll use XYplorer, Process Lasso, IE, WMP and no Wizmouse instead of the apps I use. I'll disable Google Update if it lets me.

I have a very clean system, the only (5) startup tasks are Bitdefender, Windows Explorer, Firefox, Google Update, and WizMouse.

Other user processes include the usual crss.exe, dwm.exe, winlogon.exe, 2 Nvidia driver processes, and Windows Task Manager.

I don't see any unusual system processes or apps at the time the Autoscan events happen. 2 Live ID processes, but they hardly count.

There it goes again, Autoscan disabled at 12:37:21PM, enabled at 12:37:24, disabled at 12:37:25, enabled at 12:38:31, disabled at 12:38:39, enabled at 12:39:16, disabled at 12:39:22, enabled at 12:39:58.

All I did was watch part of a movie in VLC Player and some browsing in Firefox.

Starting to investigate services and processes...

glamrustics

I am having the same issues with autoscan enabling and disabling at seemingly random, very short intervals. Bitdefender has recorded hundreds of these events in the last few days. Any clues as to what is going on?

I am having the same issues with autoscan enabling and disabling at seemingly random, very short intervals. Bitdefender has recorded hundreds of these events in the last few days. Any clues as to what is going on?

What kind of PC do you have - brand, desktop or laptop?

Which Windows OS - WinXP, Vista or Win7? 32-bit or 64-bit?

What BD 2012 product do you have installed - Antivirus, Internet Security or Total Security?

I'm trying to figure out what all of your PCs may have in common.

I am running BDAV Plus 2012 on a Win7 Pro 64-bit, lenovo ThinkPad T410 laptop, with an Intel i7 CPU & 4GB RAM and I am not seeing Events in large numbers.

Awaiting your reply,

So I traded Firefox 7 for IE9, Windows Explorer for XYplorer, VLC for WMP, Task Manager for Process Lasso and stopped using WizMouse, and no Autoscan event appeared for almost 5 hours. I did not stop Google Update, and I relaunched WizMouse 3 hours ago, so it's not these two either.

Potential suspects are then Firefox, VLC or, less likely, Windows Explorer or Task Manager.

I am running the latter two for now, and closed XYplorer and Process Lasso. Let's see how this goes.

As expected, Windows Explorer and Task Manager did not generate any Autoscan event.

Switching back to Firefox 7.0.1 to see if it's the culprit, no Autoscan event for the past 15 minutes with Firefox.

Kind of a funny thing happened an hour ago: 2 Autoscan events were generated.

- The first one at 10:11:22PM ("Autoscan was disabled") seems to correspond to when the screensaver started.

- But Autoscan reenabled exactly 20 minutes later, which is when the display monitor was turned off

This was all without user intervention. I actually came back to the computer 30 minutes after that last event.

My screensaver is triggered after 10 idle minutes, monitor is turned off after 30 idle minutes.

There was no Autoscan event when I started using the computer again and the monitor turned on again.

For me it looks like the Autoscan events are now kicking in when Game Mode is active.

I've just tested this and sure enough I'm getting events logged when in Game Mode, maybe someone else can check this by switching off Game Mode to see if the events still happen?

Why has this just started happening, more to the point how do you stop it without switching off event logging?

As already said this has only started happening in the last couple of weeks.

For me it looks like the Autoscan events are now kicking in when Game Mode is active.

I've just tested this and sure enough I'm getting events logged when in Game Mode, maybe someone else can check this by switching off Game Mode to see if the events still happen?

Why has this just started happening, more to the point how do you stop it without switching off event logging?

As already said this has only started happening in the last couple of weeks.

According to the User's Guide, turning on Game Mode will disable Auto Scan, so in this case, the behavior you are seeing appears to be normal (as designed).

2.7.1. Game Mode

Game Mode temporarily modifies protection settings so as to minimize their impact

on system performance. While in Game Mode, the following settings are applied:

● All Bitdefender alerts and pop-ups are disabled.

● Auto Scan is turned off. Auto Scan finds and uses time-slices when system resource

usage falls below a certain threshold to perform recurring scans of the entire

system.

● Auto Update is turned off.

● The Bitdefender toolbar in your web browser is disabled when you play

browser-based online games.

@Chimel - also keep this in mind (from the User's Guide): Auto Scan is a light on-demand scan that silently scans all your data for malware and takes the appropriate actions for any infections found. Auto Scan finds and uses time-slices when system resource usage falls below a certain threshold to perform recurring scans of the entire system. Your general system usage from any combination of applications may be causing your system resources to fall "below a certain threshold" and turns off Auto Scan. In other words, what you are seeing may be normal which means the Events logged in BD can be ignored. Now, if this is what is causing Auto Scan to turn ON and OFF in your system, then you could argue that you believe that logging such Events is unnecessary. Then it would become a Feature Request to not log such Events.

So, these Events may not be a "problem."

Regards,

@NightGaunt I didn't use Game mode when I had the events or during this investigation.

It would make sense in that case to have a single event "Game mode is on, Autoscan has been paused" (certainly not disabled) or just "Game mode is on" if Autoscan was already disabled by the user. Maybe a link listing all the actions that the Game mode takes.

Hi Gary, I didn't change patterns between the time the events appeared and disappeared, I only switched apps.

I know the scan is resumed every time the computer turns idle, but my point is:

The event should be "The automatic scan has started" or "stopped", not "Autoscan was disabled" or "enabled".

The Autoscan feature itself is always enabled or disabled by the user, it does not switch on and off hundreds of times a day.

It looks like Bitdefender is using "Autoscan" for 2 different types of things, which makes things confusing for a new feature.

In any case, you're right, I strongly suggest that Bitdefender reassess the need to log an event that can happen as frequently as 1 second interval. I assume that as it is a new feature, logging was added to check if it was working, but it's not telling me that, I have zero indication that Autoscan is actually scanning my system, only that it was disabled/enabled, which is not even true.

It would be a thousand times more useful to customers if the event said something like "The automatic scan has resumed (35% of your system already scanned)" or "Your system has been scanned entirely, starting rescanning." Even so, I think it would be stupid to log such events because of their high frequency, better indicate the system's scan status in the main screen so users have this important information available at a glance in their dashboard screen.

There is also the fact that half of these events are "critical" (that's what the red color stands for) alerts, not just events to ignore.

Of course, this is not true either.

Let's agree that the word "Autoscan" is the name of the new v. 2012 feature that is enabled by default and can be disabled/enabled by the user. In my case, it is turned on, so I expect it to stay enabled at all times and not see a single event to the contrary.

For instance, in the case of the Game mode, it makes sense that the event is about the Autoscan feature, but in the case of idle systems, it should be about the scan resuming/pausing.

Resuming my investigation, dumping IE for Firefox didn't generate any other Autoscan event.

I am now running VLC instead of WMP, which is the last app I switched, but I don't expect to see Autoscan events there:

I am very suspicious that the Autoscan events disappeared not because I changed my apps usage, but because I disabled/reenabled Autoscan earlier during my first attempt to investigate the issue. Just like "Show Bitdefender Toolbar" works fine in Settings|Privacy Controls|Antiphishing within the same Bitdefender session, but gets systematically disabled at next reboot.

All this investigation was performed within the same Windows/Bitdefender session, without rebooting.

We'll see how it goes in a few hours, but so far, using exactly the same apps in exactly the same usage pattern as before, I don't have a single Autoscan event. In that case, I'll then reboot the system to see if the mess of events comes back.

My point on the Game Mode causing this is I've always used Game Mode and never had these alert messages until a few weeks ago.

Surely it's a pointless alert, we know what Game Mode does, it would be better if you did not get any alert recorded when Game Mode is activated/deactivated.

Yep, it's a bug similar to the "Show Bitdefender Toolbar", which needs to be enabled/disabled after each reboot:

I had barely any Autoscan event before I rebooted, and now in less than 2 hours since rebooting, I have already 22 Autoscan events, with the same apps and usage pattern.

I have now disabled and reenabled Autoscan, so I probably won't get any Autoscan event during this session anymore.

Chimal - interesting troubleshooting results. Based on your last post I'm thinking that I may not be seeing the large number of Events because I am using a laptop and immediately after booting I turn laptop mode ON. As soon as I disconnect the laptop from a/c power, BD automatically switches OFF Update & Auto Scan (logs an Event). When I reconnect the laptop to a/c power, BD automatically switches ON Update & Auto Scan (logs another event), all of which is "as designed."

Regards,

http://forum.bitdefender.com/index.php?showtopic=29927

Hi Chimel

Thank you for all your feedback. Interesting subject.

Could you please check if the Event related to AutoScan are also related to the update process? (look in Events under the Update module to see if Auto Scan is turned on/of when an update is performed).

Please follow the steps explained in the article below and send me via PM the generated log file:

Thank you.

Well it's not that either, I had 14 Autoscan events in just over an hour since I disabled/reenabled Autoscan.

Bitdefender support team should kick in now before I go back to v. 2011, I am at the end of my wits there.

Sorry, I didn't see the 2 posts above before posting, I'll answer them ASAP.

@nikki605 Hi Gary, I don't think this specific issue should be investigated from a laptop, since we know there are Autoscan events linked to laptops.

@Cristi, I an sending you the log by PM. There is no relationship between the autoupdates and the Autoscan events.

I will take a look over that log and get back to you ASAP.

Thank you.

Thanks, Cristi. Take any time you need.

Autoscan events are still going on, there has been 10 of them between 8:30-9:30PM, but none since then for the past 2½ hours. Weird.

Welcome back Chimel

I am trying to reproduce this issue on some test machine. It will take a while.

I will get back to you these days.

Thank you very much.

Thanks. Also, due to the huge number of events, it takes 40 seconds for the "99+" notification to appear in the Security Center main page, and it takes about 4 seconds for the first page of events to start appearing in the Events page. I don't know how the devs designed it, but these delays are not acceptable. Surely the total number of events can be stored somewhere so it can be retrieved instantly, and the first page of events can be displayed instantly too while the buffer is loading, or use a faster sorting index.

I rebooted the computer, disabled and reenabled both the Bitdefender toolbar and Autoscan, I still get dozens of Autoscan events per day (134 yesterday).

Regardless of whether you can repro or not, an option to unselect the logging of such automatic events would be great.

I still want to log these events when the user manually enabled or disabled Autoscan, just not these useless noisy automatic events.

Welcome back Chimel.

In Bitdefender 2012 it's all about silent security(stock settings with Auto Pilot turned ON).

If your disable automatic Events, you won't be able to monitor the state of the product(in your case, some modules).

What happens if one function fails to load(nothing is perfect on this world)? Without logging, we can not troubleshoot the issue.

The situation is interesting, but I think that disabling the automatic Events is not desired in some rare cases.

Thank you.

I don't want to disable all automatic events in general, just this specific class of events once you have identified what causes it.

And it does not prevent Bitdefender from logging the events in some internal log either, but I hope you'll agree there is zero advantages into making 100+ events a day visible to the user in the main interface. Just hiding these events from the user might be even better than a checkbox option that adds complexity to the user interface.

But I seriously doubt this specific class of events should be logged anyway, visible or not. It's just a symptom that points to something that's wrong with the design and should be fixed.

Best of luck on the repro side, I am totally weirded out by this bug, and can't see any cause to it.

I am running the same Windows session as yesterday (134 events), and there's no Autoscan event since 8AM, it's now 12:23PM.

I have been on the computer since 9:45AM or so, there hasn't been an event even when getting the monitor out of sleep.

It could be that the disabling/enabling Autoscan I did yesterday takes some time to take effect.

Or that Bitdefender needs a good night's sleep to propagate settings changes... ^-^

One more thing.

Could you restart your machine or tun it off over the night and tell me if you still receive those evens?

Make sure that you press Mark all as read before doing this.

Thank you very much. Have a nice day.

Hi Cristi. As mentioned, I didn't get any Autoscan event since 8AM.

I got 2 around 1PM 30 minutes ago, but these were the usual Autoscan events caused by disk shutdown/screensaver while I was away.

But I'm about to reboot anyway, performance is too sluggish at 2.1GB memory used by Firefox and WMP only.

I'll update you on that.

Wow. 2 GB for a browser and a video player.

Thank you for the feedback.

We are looking forward to hearing from you.

Have a great day.

No change at all after the reboot, just like after the other reboots. About 10 Autoscan events per hour.

The large memory usage comes from heavy browsing usage and file downloads. I had the same memory usage in Chrome.

The browser process itself would move from 500MB at the start, to 700MB at the end of the session, with about 40 open tabs.

Total memory usage is not reflected in the processes, but would move similarly from 1.6GB to 2GB or so.

Hmm, my whole Antivirus event log was purged automatically this morning, only 43 events were left so I couldn't check precisely how many events I had since the reboot.

Is that a new bug? I never asked to purge the event log, and even if it does clean automatically, it should certainly leave all the events from yesterday, instead of deleting even those from yesterday night. If the clean-up is based on the number of events, please add another criteria based on the date too.

You see, that's what I mean, Bitdefender keeps logging events that are useless and just noise to me, but when it purges the log, there is no event telling the customer it did so, all I can think of is that it's a new bug and it did something I explicitly did not authorize. But nevermind, let's focus on the Autoscan events bug, and let me know what the files I sent yesterday told you.

Welcome back Chimel

Could please pack this file in an archive and send me a PM with it?

C:\ProgramData\Bitdefender\Desktop\Events\history.xml

Thank you very much.

Done.

mitza97

With apologies to post in this topic, but after the reading here, I realized that this problem appears in my situation. Attach a print screen and send you via PM history.xml file.

http://forum.bitdefender.com/index.php?sho...st&p=126306

Hello everyone.

Please read this post:

Chimel, in your case, those changes are triggered by VLC Media Player and as for mitza97 the screensaver does the thing.

vent source="Antivirus" timeStamp="1320649135" type="2" evflags="0" bodyLength="124">
<subject>Autoscan settings changed</subject>
<action>Autoscan was disabled</action>
<message>Autoscan is off</message>
</event>
<event source="PTweaks" timeStamp="1320649135" type="0" evflags="0" bodyLength="142">
<subject>Game Mode</subject>
<action>Game Mode is enabled</action>
<message>1|1||C:\Program Files (x86)\VideoLAN\VLC\vlc.exe|2</message>
</event>
<event source="Antivirus" timeStamp="1320649411" type="0" evflags="0" bodyLength="122">
<subject>Autoscan settings changed</subject>
<action>Autoscan was enabled</action>
<message>Autoscan is on</message>
</event>

<event source="Antivirus" timeStamp="1320496359" type="2" evflags="2" bodyLength="124">
<subject>Autoscan settings changed</subject>
<action>Autoscan was disabled</action>
<message>Autoscan is off</message>
</event>
<event source="PTweaks" timeStamp="1320496360" type="0" evflags="0" bodyLength="131">
<subject>Game Mode</subject>
<action>Game Mode is enabled</action>
<message>1|1||C:\Windows\System32\ssText3d.scr|2</message>
</event>
<event source="Antivirus" timeStamp="1320496465" type="0" evflags="0" bodyLength="122">
<subject>Autoscan settings changed</subject>
<action>Autoscan was enabled</action>
<message>Autoscan is on</message>
</event>
<event source="PTweaks" timeStamp="1320496465" type="0" evflags="0" bodyLength="100">
<subject>Game Mode</subject>
<action>Game Mode is disabled</action>
<message>0|1|||2</message>
</event>

Thank you.

mitza97

OK, so what is the solution ? Disable screen saver ? I hope this will not be permanently... :mellow:

Hello

The answer is no.

I'm testing some things and I will get back to you with further information.

Thank you.

Thanks, Cristi. Looking at history.xml, it seems that VLC is not actually causing the Autoscan event, but the game mode event. Which in turn causes the Autoscan event. So @Nightgaunt had something there.

I already mentioned the relationship with the screensaver earlier in this thread, so it all seems to point to Bitdefender mismanaging full screen apps such as media players and screensavers.

I do switch frequently between windowed and full screen mode in VLC, so that could very well be what triggers the game mode.

To double-check, I just opened a video in VLC and switched to full screen and back several times.

To be sure, history.xml now included several game mode/Autoscan events in the last few seconds.

Can Bitdefender exclude all .scr files and identify and exclude all media players such as VLC from the game mode events?

I checked full screen mode in Windows Media Player 12, Arcsoft TotalMedia Theater 5 and Miro 4.1 but couldn't repro the events.

glamrustics

What kind of PC do you have - brand, desktop or laptop?

Which Windows OS - WinXP, Vista or Win7? 32-bit or 64-bit?

What BD 2012 product do you have installed - Antivirus, Internet Security or Total Security?

I'm trying to figure out what all of your PCs may have in common.

I am running BDAV Plus 2012 on a Win7 Pro 64-bit, lenovo ThinkPad T410 laptop, with an Intel i7 CPU & 4GB RAM and I am not seeing Events in large numbers.

Awaiting your reply,

I have a custom built desktop PC with an Intel Core2 Duo CPU with 2 GB of RAM; running 32-bit Win7; running BD Internet Security 2012. These events have continued at random intervals regardless of whether I was using the computer or not. Any ideas? It's pretty frustrating...

I have a custom built desktop PC with an Intel Core2 Duo CPU with 2 GB of RAM; running 32-bit Win7; running BD Internet Security 2012. These events have continued at random intervals regardless of whether I was using the computer or not. Any ideas? It's pretty frustrating...

Thank you for providing that information.

Do you use a screen saver like Mitza97? How about full-screen programs like Chimel? Please see the recent posts above.

Did you happen to read the last post on page 2 of this topic from Cristi B. of BD tech support? They are trying to narrow down the reasons this might be happening, looking for common trends or uses.

Thanks for your help,

It's definately not a screen saver in my case as I do not have one in use.

As already stated in my previous post it only seems to happen when Game Mode is checked, the alerts happen when starting a game or something else running in full screen mode triggers it e.g. playing a dvd movie full screen as per the observation by Chimel.

mitza97

Hello

The answer is no.

I'm testing some things and I will get back to you with further information.

Thank you.

Thanks Cristi. Have a good day !

http://forum.bitdefender.com/index.php?showtopic=30243

Hello everyone

Chimel, please add this process

C:\Program Files (x86)\VideoLAN\VLC\vlc.exe

to Exclusions and let me know if you still receive those Events.

Also, please make sure that you have Game Mode set to automatic(like in the initial state).

Regarding those screensavers, I will provide further information these days(I haven't finished the tests on these).

Thank you.

Hi Cristi, I already had the game mode set to automatic, I didn't change the default setting.

Autoscan events still happen when switching to full screen even after setting both process and file exclusions and rebooting.

History.xml shows exactly the same event data, with game mode on and off and the program listed as vlc.exe.

At this stage, the bug is clearly identified, and I assume you can repro on your side too, so I expect Bitdefender to take over.

I am using VLC 1.1.11 and the "Always on top" option. As for screensavers, I was using the Bubbles one.

glamrustics

Thank you for providing that information.

Do you use a screen saver like Mitza97? How about full-screen programs like Chimel? Please see the recent posts above.

Did you happen to read the last post on page 2 of this topic from Cristi B. of BD tech support? They are trying to narrow down the reasons this might be happening, looking for common trends or uses.

Thanks for your help,

Thanks for your reply. I do use a Win7 screen saver and have done the same 1 minute test as another user above. In my case, the screen saver is setting off the notifications. However, I find it completely unacceptable that my built-in Win7 screen saver should interfere with BD settings. Any thoughts on a fix?