Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Scan gets stuck

My Mac has been very slow the last month or so, with a lot of beach ball use.   I have fairly slow cable Internet, but it's slow other times as well (although more apparent with my browsers).

So I installed Sophos and tried to scan.    After a couple of hours I discovered it was stuck.   I shut down my computer, rebooted, and tried again, this time with "Caffeine" to stop my computer from sleeping.   I let it run over night, and it was still running.   A few hours later I was doing other stuff on my computer and it was stuck again.     I tried again and shut down after it got stuck the next day.    

This time I tried it lasted long enough to find a Troj/DocDrop-BM.    Yesterday the Quarantine Manager pulled it up and says "Cleanup in progress", with the little in-progress icon to the right of it.    A few times I clicked on the "lock to make changes" icon and gave my password.   But the next time I checked that was locked again.    Last night that was the status, with the scanning moving.    This morning that was the status, but the "Items remaining" is not moving.    It gets stuck with different numbers each time.

Looking up this trojan, I see that it is a Windows trojan, so it must not be why my Mac is so slow.    My OSX is 10.9.2, my processor is 2.8 GHz Intel Core 2 Duo with 4 GB 667 MHz DDR2 SDRAM.   My disk has 55.84 GB free out of 499.25.

:1016319


This thread was automatically locked due to age.
  • It may seem like the scan is stuck but it's more likely it is scanning files but doing slowly.  Obviously if the scan takes all day and night it can be judged to have basically become 'stuck' rather than arguing it's just really really (really) slow. :smileywink:

    There are a few ways of handling this and they all focus on reducing the amount of files SAV has to get through for a particular scan.

    • Have a clear out of old files: In Finder click through folders (like Downloads, etc.) and delete things (esp. large files) that you don't need anymore.  Having a general tidy up can help with the Mac's performance overall - for example less stuff for Spotlight to have to index.  You mentioned you have 55GB free out of a 500GB hard drive.  Maybe all that space is taken up by important files, and I'm not suggesting you delete those.  However with 445GB of files to scan maybe there are somethings you can clear out now (even empty the Trash).  If you have loads of personal files you cannot remove, and this is just a general file management suggestion...maybe move all those files to a USB drive and keep them on there rather than the main hard drive.  I know this idea may not appeal so moving on...

    • If running a 'Scan This Mac' scan exclude volumes like Time Machine etc. and compressed files.  See the scanning your Mac video for how to exclude volumes and prevent compressed files from being scanned. https://www.youtube.com/watch?v=j3SUJFozC2Q.  Time Machine scanning isn't generally required because the files are wrapped up inside a backup and can't harm the computer.

    • If you have tried the point above and/or are running custom scan: Try limiting the folders for the scan - break down the whole 445GB drive into small parts.  For example set up a custom scan to scan just your Home folder.  Run that, see how it goes and expand the items to be scanned list.  Chances are at some point you will hit on a folder with a ton of large files (or compressed files if still scanning those) and the scanner will get stuck again.  Once it's clear where the problematic folder/files are a resolution can be worked out.

    • Finally you can run a sweep scan and output what is being scan as the scan goes.  If or when a sweep scan (of the whole hard drive) slows down, you can record the files causing the problem and from there a solution can be worked out.  See: http://openforum.sophos.com/t5/Mac-tools-help/See-what-files-are-being-scanned-with-the-sweep-tool-in-Sophos/td-p/16329
    :1016331
  • Breaking my scan out into parts would be nice - but I don't know enough to verify that all of the parts equal the whole.

    Sophos has shown "Items remaining: 5,465,421" since I got up 5 hours ago.    And the Quarantine manager has shown "Cleanup in progress" since yesterday.

    But you're right.   My system is slow, maybe it's just not updateing the progress.   I'll wait a few hours before rebooting and starting over.

    Can I turn on the screen saver and turn off the other computer shut down to let the scan run a few days?

    :1016335
  • You can let the screensaver run, but the computer has to remain on and awake with the Hard Drive powered up.  The screen can go blank but the computer shouldn't be allowed to sleep.

    To show roughly what you need to do: add a folder (like your own Home folder, or all user folders) and run a scan.  If there is no problem add in a second item, scan again.  Keep going until you're pretty much scanning the whole drive.  Example (if it helps explain it):

    :1016339
  • I tried creating a scan of the users directory.   My problems are different, the scan doesn't just get stuck.   Instead, 4 times I've tried and after a couple of hours I get the window "Scan cannot be completed   An error occurred running the scan."

    And it is not at all obvious to me how I scan the root directory.

    :1016347
  • What does the scan log scan?  Anything else?  Can you get a screenshot of the error as that would be very useful.  Thanks.

    Advice on the logs...

    http://openforum.sophos.com/t5/Mac-tools-help/Where-are-the-logs-for-SAV-for-Mac/td-p/16091

    :1016361
  • Interesting.   I see that the users backup finished OK the 4th time.

    I then backed up Applications and it had two threats.   I cleaned up one, and the other seems to be stuck.   This other is one I tried to fix when the full scan found it.   Its cleanup was in progress until I decided the scan was stuck and killed the process.    I just noticed this was locked again, I unlocked it.   The other day I unlocked it several times without seeing anything different.

    My screen shots were .tif files, and this web page won't take them.

    :1016369
  • I think .zip files are allowed, so you can try zipping them up. Or you can open the tiff files with Preview and select file | export and save as .png etc.

    :1016371
  • The screenshot of the quarantine manager doesn't show the lower panel and the part of the screenshot showing the Console scan log shows the 'users' scan log.  The second screenshot of the custom scans shows the 'applications' scan found the/an item.

    So can you pull out of the 'applications' scan log the location of the item detected or, to at least get a truncated path select the item in the QM, expand the lower panel an screenshot that?  Example:

    2013-11-16_21-57-05.png

    Note:  You mention 'I then backed up Applications and it had two threats' - do you mean scanned the applications folder with SAV or is there an actual backup running? Just want to be clear what's being run. :smileywink:

    BTW:  If you computer is running slowly a scan for any threats is a good idea, but if they are Windows threats then they won't be causing the computer to run slowly.  Just wanted to mention that as you may find, even with all the threats gone, the computer doesn't speed up to what you expect.

    :1016375
  • One threat got fixed quickly.   I didn't note what that threat was.   This threat shouldn't bother me, but unless I scan the whole disk (how do I scan root?), I can't be sure there aren't more.

    :1016379