Enabling multithreaded scans

Article:TECH101387  |  Created: 2005-01-28  |  Updated: 2014-07-10  |  Article URL http://www.symantec.com/docs/TECH101387
Article Type
Technical Solution




This document describes how to use multithreaded scanning in Symantec AntiVirus 10.x and Symantec Endpoint Protection 11.x to increase scanning performance.

NOTE: Symantec Endpoint Protection 12.x only allows single treaded scanning.



Symantec AntiVirus 10.x and Symantec Endpoint Protection 11.x use a new scan engine that supports multiple threads. This feature is primarily recommended for use on servers, and is only available on Windows platforms. Performance gains from this feature depend on the computer system setup and multithreaded settings. Generally, the computers that gain the most performance from this feature are those that have multiple processors and high-performance disk storage.

Several registry entries control the multithreaded scanning features. To enable the features, adjust the following registry values accordingly:

Base Threads

  • SAV 10.x: HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\ScanThreadsBaseCount
  • SEP 11.x: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\ScanThreadsBaseCount

    This DWORD value specifies the base number of threads to use to perform the scan. The actual number of threads that are used may vary based on the ScanThreadsOptions value and other factors.

CPU Options

  • SAV 10.x: HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\ScanThreadsOptions
  • SEP 11.x: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\ScanThreadsOptions

    This DWORD value controls scan thread behavior. The following options are available:
    • 0: Use ScanThreadsBaseCount as is.
    • 1: Multiply ScanThreadsBaseCount by number of physical CPUs.
    • 2: Multiply ScanThreadsBaseCount by number of logical CPUs (includes Hyper-Threaded CPUs).

    The following table shows the maximum number of threads that are used during a scan for different CPU configurations:
    CPU configuration ScanThreadsOptions
    Maximum number
    of threads
    Dual-CPU 1 8 16
    Hyper-Threaded single-CPU 2 8 16

Batch Size

  • SAV 10.x: HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\ScanThreadsBatchSize
  • SEP 11.x: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\ScanThreadsBatchSize

    For multithreaded scans, this DWORD value specifies how many files to enumerate before handing them off to the next available scan thread. This value is optional, and it defaults to 100 if it is not specified. Symantec recommends the use of the default setting; you should adjust this setting only when you tune scans for increased performance.

Scan in the order on the disk

  • SAV 10.x: HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\DiskOrderedScans
  • SEP 11.x: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\DiskOrderedScans

    This optional DWORD entry allows the user to turn on or turn off DiskOrderedScans. The DiskOrderedScans feature causes the groups of files to be scanned based on the order that they physically occur on the disk. Disk head movement is minimized, and scan performance is increased.

    This value can be set to 0 (disabled), 1 (enabled), or it may not be present. If this setting is not present, then the default behavior is to use DiskOrderedScans when you scan with a single thread and to turn it off when multiple scan threads are used. Symantec recommends the use of the default setting; that is, do not create the value. The enabling of DiskOrderedScans can cause single-threaded scans to be performed between 1 and 20 percent faster. However, tests have shown that the benefits decrease as the number of scan threads increases.

Resumable scans vs. internal multithreaded scans
You can run a resumable scan on a multiprocessor computer with multiple drives and suspend and resume the scans. However, if resumable scans are enabled, then you cannot scan a volume by using multiple threads. Resumable scans can use no more than one scan thread per volume.

For more information about resumable scans, read Enabling resumable scans.

64 BIT Support
Is not recommended to use these settings under the 64 BIT platform since it will not necessarily increase the performance of the scan engine. Mainly because of the disk I/O bottle-neck effect in the scanning processes. By enabling multithreaded scans it increases the amount of I/O, thus offsetting any gains made by having multiple threads enabled. It is generally not recommended on 64 BIT platforms due to the instability  it introduces.

Legacy ID


Article URL http://www.symantec.com/docs/TECH101387

Terms of use for this information are found in Legal Notices