Unscheduled scan runs 1Hr after system start-up (every time)

For anyone following this, I read on Reddit that BD are working on a fix for this that will be pushed out in an outdate. No ETA atm though.

I have managed to hide the drives from the BD scan using a ****** which offlines the drives with diskpart before the scan starts and then onlines them again after. Come on BD, customers should not have to do this...

Yesterday we switched over to summer time where I am and this morning (next system startup) the unwanted scan ran 2Hrs after startup instead of 1 as it has been doing so up until now. This may mean that other people are seeing this scan occur 2hrs after system up depending on where they are in the world. Seems a bit weird, not sure how the math involved in working out when to run the scan is varying in that way. I have my update period set to 8hrs currently - so it isnt that. I have every drive in my system (apart from the OS) excluded from scans and this is just ignored and they all get scanned. I have looked at an older second W10 system I have which uses the same BD licence and that also has these unwanted scans running. To me this eliminates any possibility of it being something caused by my system.

NB: This is not windows update. I have taken multiple videos of the disk activity any time I hear the drives power up. Windows own activity tends to occur right after the system is powered up or later and at what seem random times. These only last a minute or so at the longest. The BD scans last nearly 10mins. If I hide my drives it takes 6mins.

I know why you might think it was Windows related, but the activities that Windows may do are usually on a 24hr cycle in the task manager. So once it has done it, it wont do it again for a while. If I turn on my system the BD scan will run withing 1-2hrs. If I then restart the system, it will do it again. It will do it every time the system is restarted. If the system is left on for many hours, BD does not do another scan. This only occurs after a system restart.

The BD scan causes 100% disk usage on my older other system. On my main system, Im just concerned about the noise and potential needless wear, but on older systems you may see a serious performance hit if you were using the drives for something else at the time.

On my main system, I see CPU usage of about 1-2% at idle before a scan. During the scan this can go as high at 15%. And this is on a 5800x. All the other issues aside, how much electricity in the world is being wasted by all these BD clients running wasteful scans?

Well the scan is back to 1Hr again today, so yesterday was just a blip. I have sleep disabled on my system (Sleep = Never). Hibernate is disabled. BD email support already have my system logs and have responded that the behaviour is normal or that the logs dont contain anything - im not sure which as the responses were confusing.

I ran the application capture log before and only stopped after one of these scans ran, so for BD support to tell me there is nothing unusual in the logs seems bizarre. At the very least there must be something in there that says why BD is scanning the drives I would have thought. I asked for the password for the log file (it is encrypted) so maybe I can find it for them, but it hasnt been provided. (Case = 1007239418)

Both I and the other person on Reddit with exactly the same problem, tried turning off the entire Vulnerability module weeks ago. It has no effect at all. I even went through the entire client and turned everything off that had an off switch and this made no difference. The only way I found to stop the scans was to uninstall BD. When I do that there is no unusual disk activity after 1Hr of system up.

I have taken a video of the scan activity in resource monitor and am planning to upload it. Im a bit worried about it accidently sharing something that would be a security issue for me, which is why I havent done it yet. Let me know if this is something you would be interested in.

My feeling is that it may be related to TiWorker.exe which seems to run at the same time as the scans start. BUT this doesnt run exactly 1hr after startup if BD is uninstalled. TiWorker.exe does run on a clean system, but at other times and doesnt scan drives. At the very least, if Windows is the trigger for these scans, it is BD that triggers Windows into doing this at the 1Hr mark which then triggers BD, i.e. BD is the root cause.

Ive edited and uploaded my video to YouTube. I'll try to send the link to you in a private message.

I dont think your design should be changed because of me. It should be changed because it is wrong. If you have a look at the video Ive uploaded, I dont see how any rational person could think this was acceptable to force on anyone's system and give them no control of when it occurs or what can be excluded from it.

Hi Camarie, thanks for your private reply about this and your explanation that this is an additional scan which was deliberately put in place to address a vulnerability to all computers. It doesn’t explain though why this has to run 1Hr after startup and why it has to run at every startup. Even if it ran as soon as the system started up it would be better because all the drives have spun up anyway at that time and to some extent the activity would be hidden among all the other activity going on.

But even if it worked that way, I personally think that would still be wrong. If I restart my system 10 times today, I get 10 scans. Why? Why does it need to scan more than once a day? Why does it need to scan the same files over and over that have not changed since the previous scan? This seems to have been implemented incredibly poorly and whoever is responsible should have a talking to imho.

This also brings up the question of why BD support on the forums and email (multiple support people). Couldn’t have said weeks ago, ‘Oh, that is a deliberate scan that does X’ instead of telling me they can’t see anything wrong and implying there is something wrong with my system. Why do support personnel not know about this ‘feature’? How many BD customers have contacted support about performance hits and been told the problem is with the customer instead of the client?

I can imagine a lot of customers just giving up and changing to a different AV. I almost did myself, it was only the 3yr licence I have that made it worth me persevering in trying to get BD to realise this was a problem with their client and not with me.

Just FYI, I don’t restart my system 10 times a day. Maybe 4 or 5 would be a max for me, most often maybe 2 or 3. I don’t leave my main PC on all the time every day. I don’t think this is unusual. I switch it off and turn it back on later in the day when I might use it again. Before I worked out how to hide my drives, I was leaving my system on longer unused just to avoid having to deal with the scans from restarting it later. I would turn on my system in the evening and have to set a timer so I could turn the system off before it got to 1Hr. My only alternative being to uninstall BD and reinstall it next time I switched my system on, which for obvious reasons was not something I wanted to do.

Please note that the thing absent from the video I sent you was what happens to mechanical drives. They get hammered with 100% usage for longer periods because they are slower than solid state drives and, in my case, have a much greater capacity. The scanning of the mechanical drives was my initial reason for pursuing this, but I did not show it in my video because those drives are where all my data is stored and I wasn’t happy about even just sharing the file names.

Please try to be careful about how you talk about the timing of the scans, because it can come across as if you are justifying what occurred. There is no justification for this. Arbitrarily choosing 1Hr after startup is careless and obviously untested. Would it not have been possible to check if the system was in use for something else first, such as happens with the profiles to avoid AV load when the PC is doing something else? After 1Hr we are going to hammer your system and we don’t care at all what you might be doing at that point? That is not a position you can defend, please don’t try, as you risk starting to sound like a lawyer trying to avoid liability.

I’m still confused by what you and the other BD support people keep saying; that my system is somehow unique or unusual. If anything, I would think my system gets less impact from this than other systems. 15% CPU load for me is not that great and obviously this would be higher on an older machine. I also don’t use an SSD or HDD as my OS drive. So, the 88% usage hit on my NVME at least left me with a bit left over so the whole system didn’t lock up. If I used an SSD or HDD for my OS I would be screwed.

I think maybe your PR people should go through recent cases (when did this start, Jan-Feb?) and work out how many irate customers complaining about performance issues may have been affected by this and been fobbed off by BD support who were not even aware these forced scans were going on. It seems your own application logger doesn’t even show anything to BD support, so even if a customer did pursue this matter, they would have got nowhere with BD support.

I don’t want to have a go at you personally, you are the only person that really helped with this. But, I think someone in BD should be coming forward and saying publicly to all users that we ducked up, we are sorry and we are going to fix it. They should also be looking at whatever team or individual did this and put in place training and testing so it can’t happen again.

Of course, BD is right to put in measures to protect us, but if you are going to do something like this again in the future, I would suggest an email sent around to all customers informing them you are implementing a forced scan of systems that will run 1Hr after system startup and that in the longer term you will be looking at giving users control of this and integrating it into the client. Not just force it on everyone and don’t even tell your support staff, that have to deal with complaints, that you even did it...

Just FYI, if you unmount a drive mid-forced scan, BD seems to have a fit and ramps up to 20% CPU. This would be a totally possible scenario, seeing as this is a stealth forced scan that a user wouldnt know about unless they read this thread.

I still dont understand why the same files, that were created years ago and have not been accessed for over a year, have to be scanned over and over and over in a forced way. Often multiple times a day. Im sure the person that did this can spin some BS answer, but it seems moronic to me.

Equally, I still dont think there has been a clear explanation of why drive and folder exclusions get ignored. Is the person responsible for this stupidity still working for BD? Can you at least transfer them to a mailroom or something where they might do less damage?

If the person that thought it was a great idea not to send a memo to the support staff about this 'daily' forced scan is not the same person, they should probably be replaced also.

I dont want to get my hopes up, but this morning is the first time in over a month the forced scan didnt run 1hr after system startup. Cant see how the user controls the period of the scan, does it run at another time now? Where can we control this from? I cant see it in the task manager, where is it listed? Does it take notice of the drive exclusions now, as I had these on - maybe that is the change?

Has anyone tried this sicne the May update and how are things now? Im hestitating to reinstall this and try it out as Im getting along fine with the alterntive product Ive switched over to when BD fked this up

Im glad I didnt wait and switched to another client. I was told by a developer in a private message on April 12th the fix would ship on May 4th. They couldnt even get that right. WTH is wrong with this company? Ive said it multiple times, but I'll say again: A major screw up like this should have been fixed in a hot patch, this is not something that should have to wait for a future scheduled feature update patch. Where do people send the bill for their replacement mechanical drives and their electricity bill?

When is the new release being pushed out to customers?