Stop Malwarebytes from Scanning external drive?

[Morac]

I normally plug in my external drive to have macOS Sonoma do a Time Machine backup once a week.  Yesterday I happen to plug in in before MalwareBytes did it's 9:00 daily scan.  That scan normally takes a few minutes.  I happen to notice my external drive's activity light was blinking around noon, but thought Sonoma was indexing it or something.  I checked back about 13 hours later and it was still blinking so I checked and found that MalwareBytes had been scanning the external drive for 16 hours.

I attempted to stop the scan, but MalwareBytes said it was stopping it but never did.  I eventually had to shut down my MacBook Air (M1) to get the scan to stop so I could unmount the drive.

Some questions:

1. Why did MalwareBytes include the external drive in it's daily scan?

2. Why wouldn't MalwareBytes stop scanning the drive when I requested it to stop.

3. How can I keep this from happening again?  I excluded the drive folder in the /volumes folder.  Is that good enough?

[Porthos]

Malwarebytes for Mac can not and does not scan external drives.

https://support.malwarebytes.com/hc/en-us/articles/360038479334-Scan-your-device-with-Malwarebytes-for-Mac-v4

@treed

Edited November 19, 2023 by Porthos

[treed]

As Porthos mentioned, Malwarebytes for Mac does not scan external drives. Whatever was accessing that drive, it wouldn't have been Malwarebytes. It could have been Time Machine updating backups, which it will do periodically as long as the drive is connected.

As for what happened with the Malwarebytes scan, it sounds like for some reason the process responsible for running a scan crashed. I'd recommend restarting your computer, and if you see this happen again let us know.

[KlausWalterKurt]

Thats not true, i think.

 

If i start a scan Malwarebytes hangs for ever. But when i exclude during the endless running session in the correspondent menu item my external drives ( see attached file ) the scan gets at once to the end.

If i delete the two items in menu, same thing, endless running scan if started next time. If i leave the external drives disabled in menu everything is okay.

 

How could you explain this ?

[MBUser3000]

Interesting. I know Malwarebytes doesn't scan external drives but I've just started experiencing similar issues on my M2 Mac w/ Ventura 13.6.1 ("scans" that don't actually start yet go on forever and can't be stopped) and - as far as I can tell - the only way to get Malwarebytes working is to completely disconnect the external drive from the computer. Some of the (failed) troubleshooting things I've tried so far are:

• Adding the external drive to the "Allowed Items" list (this worked for ~10 minutes and then the issue re-emerged)
• Unmounting/ejecting the drives before starting a scan (via Finder & Disk Utility)
• Booting into recovery mode & scanning the drive for errors
• Swapping out drives (1 Thunderbolt, 1 USB 3)
• Reinstalling Malwarebytes

For me, this just started happening yesterday night, everything was working fine that afternoon and - AFAIK - nothing about my computer had changed since that time.

[KlausWalterKurt]

Could it be that the problems are starting with the automatic update to the guard version 4.0.622 ?

In my case this could be roundabout at that time.

[MBUser3000]

Perhaps that might be it but, unfortunately, I didn't think to check when the last definition update took place before I reinstalled Malwarebytes and I imagine those logs were deleted when I first uninstalled the program.

[mally_warry]

I just wanted to chime in and note that I'm having the same issues. I'm on macOS 13.5.2 and Scans never finish and cannot be aborted when I have external drives connected.

I tried:

- Restarting
- Booting into Safe Mode and running MB from there
- Booting into Recovery Mode and checking all drives with Disk Utility

The scan reaches a point where the number of items does not increase anymore but never ends and continues to consume cpu power.

I have not updated or installed anything lately.

[MBUser3000]

One more thing: it also seems to happen when network-attached drives are mounted though - in that case - the scan gets close to complete before coming to a stop; unmounting the network drive lets me finish the scan. FWIW, even though it's not supposed to be scanning external drives, I did hear the network-attached drive spin up right around the same time the scan stalled.

[TobyR]

Hi,

I can also confirm that the above is the case with MB running on my Mac Studio 13.6.1

MB is 100% accessing an external USB drive which is preventing a scan from being properly cancelled. I can see a green LED 'accessing' read light on my external drive, there is a separate 'write' LED as well, the green 'reading' LED is flashing constantly. If I go into Activity Monitor I can see that good old RTProtectionDaemon is running on the 'Disk' tab. RTProtectionDaemon has a frankly outrageous Virtual Memory Size of 392.53GB!! Anyway, if I 'Force Quit' RTProtectionDaemon then the LED on my external drive immediately stops flashing. There is a bug in this version for sure, that's my report.

[KlausWalterKurt]

Hi,

Malwarebytes has published a new protection updated to version 4.0.623 at 17:45:28 central European time.

With this version it seems, that everything works now ( again ) like a charm !

 

Greetings ...

 

Klaus

[treed]

1 minute ago, KlausWalterKurt said:

Malwarebytes has published a new protection updated to version 4.0.623 at 17:45:28 central European time.

With this version it seems, that everything works now ( again ) like a charm !

Yeah, we found an issue with one of the rules published in database version 622 that was causing problems in some cases. Those of you with problems that started yesterday, this should solve it.

This would not, however, explain the original issue posted on November 18.

[TobyR]

1 minute ago, treed said:

Yeah, we found an issue with one of the rules published in database version 622 that was causing problems in some cases. Those of you with problems that started yesterday, this should solve it.

This would not, however, explain the original issue posted on November 18.

Hey @treed - I can confirm that my external drive light is no longer flashing having just updated the protection manually. One question though, how can you find out exactly which version of the protection you are currently running in MB?

Thank you.

[treed]

If you click the Detection History card in the main Malwarebytes window, you'll see an Activity Log tab. That will tell you every time there's been a database update, and what the version number is.