Slow Scanning

[PokyWizard]

 

I have version 4.12.9 of MalwareBytes on Big Sur 11.5.1, but I noticed that its scanning is very slow. My Mac Mini has an SSD that is only 170GB used, but after 14 minutes of scanning the progress bar says it's still halfway through the scan.

I don't remember it being so slow (I have been using MalwareBytes for a few years now, but have never noticed it slow.), even canceling the analysis takes a few minutes to cancel the analysis. Ex.: After almost two minutes of analysis, it informs that 0 files were verified. Is this normal behavior or could my Mac be infected?

I've done other slow scans before, but the scans will tell you it's OK.

I ran a test and restarted my machine, but I noticed that when booting the OS, the CPU is at 79% -82%, being used by the RTProtectionDaemon.

(The language is in pt-BR, as I couldn't find how to change the language in macOS for testing purposes).

[PokyWizard]

Edit:

I've already tried uninstalling and re-installing Malwarebytes, but when I install, all previous settings and license are already applied automatically. How do I completely uninstall it to do a clean install?

[Porthos]

17 minutes ago, PokyWizard said:

How do I completely uninstall it to do a clean install?

 

[PokyWizard]

2 minutes ago, Porthos said:

 

It was these instructions that I followed. But when installing again, my license key is loaded automatically.

[Porthos]

2 minutes ago, PokyWizard said:

It was these instructions that I followed. But when installing again, my license key is loaded automatically.

Did you also do #2?

Quote

2) Download and run the following AppleScript applet, which will uninstall the software.

https://downloads.malwarebytes.com/file/mac_uninstall_script/

 

[PokyWizard]

8 minutes ago, Porthos said:

Did you also do #2?

 

Yes, I ran both options.

[Porthos]

Ok wait for a staff member to see your post.

@treed

[PokyWizard]

As I use this Mac for development, and a few days I installed the Android SDK and Android Virtual Devices. I'm wondering if the slowness is not being caused by the analysis of the files of this Android virtual machine.

 

 

[PokyWizard]

Another thing I've done recently is to add some NPM modules to my projects, and these modules are known to be gigantic, containing a plethora of files and subdirectories. Unfortunately during the scan it doesn't tell you exactly what it is analyzing and which file is being analyzed.

[1PW]

Hello @PokyWizard:

I am running Malwarebytes for Mac Premium v4.13.2 BETA with macOS Big Sur 11.5.1 from a Samsung 500 GB SSD containing about 48 GB of apps/data.

Since the June update of Malwarebytes for Mac to v4.10.4, the new caching, while scanning, can dramatically reduce future scan times to a fraction of previous scan times.

Please try running multiple Malwarebytes scans, in succession, and by the third successive scan, the scan cache is updated and the elapsed time should be quite a bit less. Of course some new system activities can detract from cache data.

On my nearly eight-year-old MacBook Pro, with 16 GB of RAM, I used to experience up to seventeen minute scan times. Yet after repeated scans, my subsequent scheduled/demand scan durations reduced to as short as forty-nine seconds.

While doing its primary protective functions, it is normal for the RTProtectionDaemon process to have higher CPU usage during heavy app execution and data transfers. With an idle system, the same process can be in single digits.

If Malwarebytes for Mac and macOS protections do not present notifications and Malwarebytes for Mac scans show zero detections, the likelihood of infection approaches zero.

HTH

 

 

Edited August 7, 2021 by 1PW

[treed]

On 8/6/2021 at 5:12 PM, PokyWizard said:

After almost two minutes of analysis, it informs that 0 files were verified.

Can you clarify what you mean here? Are you seeing that zero files have been scanned, or that zero files have been detected? Have you allowed a scan to finish yet, or have you canceled before they could finish?

[PokyWizard]

5 minutes ago, treed said:

Can you clarify what you mean here? Are you seeing that zero files have been scanned, or that zero files have been detected? Have you allowed a scan to finish yet, or have you canceled before they could finish?

It showed after two minutes 0 files had been scanned.
I managed to complete the analysis on the computer, 3 scans in a row, and all took more than an hour (+550K files).

[treed]

That's definitely unusual. And you didn't see any change in scan time after the first scan? If that's the case, I'd ask you to run the following test:

1. Take note of your license key before following these steps. If you don't know it, you can copy it from the My Account pane of the Malwarebytes app settings
2. Uninstall Malwarebytes for Mac by choosing the Uninstall item from the Help menu within Malwarebytes
3. Download a fresh copy of the latest installer: https://downloads.malwarebytes.com/file/mb-mac
4. Reinstall using the fresh installer
5. Run a scan and take note of files scanned and time taken
6. Run a second scan, taking note of the same data

Report back here with the results.

[PokyWizard]

2 hours ago, treed said:

That's definitely unusual. And you didn't see any change in scan time after the first scan? If that's the case, I'd ask you to run the following test:

1. Take note of your license key before following these steps. If you don't know it, you can copy it from the My Account pane of the Malwarebytes app settings
2. Uninstall Malwarebytes for Mac by choosing the Uninstall item from the Help menu within Malwarebytes
3. Download a fresh copy of the latest installer: https://downloads.malwarebytes.com/file/mb-mac
4. Reinstall using the fresh installer
5. Run a scan and take note of files scanned and time taken
6. Run a second scan, taking note of the same data

Report back here with the results.

Procedure performed.

FileVault: Activated

First Scan

Start    2021-08-09 02:00 PM
End    2021-08-09 02:47 PM

Itens: 571.040

Second Scan

Start    2021-08-09 02:48 PM
End    2021-08-09 03:35 PM

Itens: 571.124

A strange behavior I noticed is that after 44 minutes (second scan) the total number of files scanned was 57.499, and in 46 minutes the total number of files was 571.124.

 

[treed]

I'd like to get more information, and this is something that would probably be best done via a support ticket. Please submit a request here, and mention this forum topic:

https://support.malwarebytes.com/hc/en-us/requests/new

In your ticket, I'd like to get debug logs. Please download the debug tools here:

https://malwarebytes.box.com/shared/static/zgx1l45rn8vhp1mqlos4n35eg0xo1oz1.zip

Unzip the file, and inside the resulting folder (named Debug_Mbam_tool), open the Debug-ON app, and confirm to the system that you do want to open it. Then click OK to allow the script to set Malwarebytes for Mac to start debug logging.

Next, run a scan, and let it run to completion. Once the scan is done, open the Debug-OFF app, confirm that you want to open it, and then click the Reset to Defaults button. When the script completes, it will create a file on your desktop named Debug-MWBLogs.zip. Please attach that file to your support ticket.

Once you've done that, respond here with your support ticket number so I can find it.

[PokyWizard]

2 hours ago, treed said:

I'd like to get more information, and this is something that would probably be best done via a support ticket. Please submit a request here, and mention this forum topic:

https://support.malwarebytes.com/hc/en-us/requests/new

In your ticket, I'd like to get debug logs. Please download the debug tools here:

https://malwarebytes.box.com/shared/static/zgx1l45rn8vhp1mqlos4n35eg0xo1oz1.zip

Unzip the file, and inside the resulting folder (named Debug_Mbam_tool), open the Debug-ON app, and confirm to the system that you do want to open it. Then click OK to allow the script to set Malwarebytes for Mac to start debug logging.

Next, run a scan, and let it run to completion. Once the scan is done, open the Debug-OFF app, confirm that you want to open it, and then click the Reset to Defaults button. When the script completes, it will create a file on your desktop named Debug-MWBLogs.zip. Please attach that file to your support ticket.

Once you've done that, respond here with your support ticket number so I can find it.

I went to generate the log and today the scan happened super fast.

2021-10-08 01:03 PM (GMT-03) - Scheduled Analysis - 571295 Objects

2020-10-08 01:44 PM (GMT-03) - Manual Analysis - 59906 Objects - 1 minute (difference of 500 thousand files less)

2020-10-08 01:4 PM (GMT-03) - Manual Analysis - 59916 Objects - Less than 30 seconds (difference of 500 thousand files less)

[treed]

Hmm, that seems to be an answer in and of itself. We updated a couple rules that were added to the database at the end of July, and I'm guessing that fixed the problem. Keep us posted, though, if the problem returns!

[PokyWizard]

1 minute ago, treed said:

Hmm, that seems to be an answer in and of itself. We updated a couple rules that were added to the database at the end of July, and I'm guessing that fixed the problem. Keep us posted, though, if the problem returns!

Thank you very much, I believe that now it won't be a problem with the analyses.