On-Demand Scan process name

Hi Slavvko 

Thank you for your post. As highlighted here, SAVService.exe is the process involved during AV scans (scheduled or on-demand) and the service responsible would be Sophos Anti-Virus. Hope this helps!

Hi Adithyan Thangaraj,

thank you for your reply.

Does it mean that SavService is running only if on-demand is in progress or it is running constantly (indicating generally that AV is on)?

If the latter is true, is there any process unique for on-demand scan, which is present only if the scan is running, and disappearing once the scan has been completed?

Thank you.

Hi Slavvko 

Thank you for your kind response. As mentioned in the above KBA, this service is responsible for any scanning that the endpoint does which means this process would remain running in the background and would start using up resources only when a scan is actually being run. By "scan", I also refer to on-access scanning that the endpoint does whenever a file or folder is accessed. Hence this Process and Service is bound to run all the time in your machine unless killed explicitly.

Hi Adithyan Thangaraj,

thank you again for your response.

With  reference to the above, I understood that there is no specific (unique) process created once on-demand scan starts, and finished once the scan has been completed.

In other words, there is no possibility to verify via Tasklist/Pslist if the on-demand scan is running.

Am I right?

Thank you.

Sławek

Hi Slavvko 

Thank you for your response. You are absolutely correct in saying that there is no separate process that highlights instance(s) of on demand scan. However, A "Scanprogress.exe" should pop up a window with the scan result post completion of on demand scan (Right-click scan).

Thank you Adithyan Thangaraj for your help.

Sławek