Full scan appears to include Time Capsule [MOVED] [Closed]

[kelvix]

When a full scan run like the name implies it runs a scan against everything. For macOS mounted drives can be found in the /Volume directory where things such as your own SSD / HDD can be found but also USB drives and mounted drives. The other thing that can be found is your Time Capsule NAS and local snap shots.

 

As I too try to find some reasoning as to why my Full Scans seem to get stuck on arbitrary files I stumbled upon the realization that when I kick off a Full Scan my NAS drive IO spikes as Kaspersky tries to perform a full scan on all of my backups. I’ve unmounted my NAS drive and tried again but is this behavior intentional?

 

I have Kaspersky Internet Security but I figured the anti virus part of it makes more sense to be placed here.

 

My other searches are yielding no results so I’m reaching here. I have not contacted support.

 

//Mod Note: moved to the correct section.

[Flood and Flood's wife]

Hello  @kelvix,

Welcome!

• There is no KAV for MAC, only KIS, accordingly, I’ve asked the Moderators to move your topic. 

Please tell us:

1. Mac OS name? & version?
2. KIS version? and patch(x)? 

Please post back?

Thank you? 

[kelvix]

1. macOS Catalina. Version 10.15
2. 20.0.0.829a

 

The results of this morning with no NAS drives attached is the first successful full scan I’ve been able to have using this product. I have a theory that I’ll try to test out after work today.

[kelvix]

My issue turns out to have been long running AV scans and potential small disconnects. I would kick off the Full scan and believe the statement “Scan scope: All internal disks and currently running applications”. As it starts to scan my network drives any network hiccup causes Kaspersky to stop making progress on its scan the UI makes it seem like it is stuck.

desktop02:Volumes jgarcia$ ll
total 0
drwxrwxr-x  7 root     wheel  306 Oct 31 19:24 Backup Data
lrwxr-xr-x  1 root     wheel    1 Oct 29 06:48 Macintosh HD -> /
drwxr-xr-x@ 3 root     wheel   96 Oct 16 00:13 Recovery
drwxrwxr-x  7 jgarcia  staff  408 Oct 27 13:19 USB02
drwxr-xr-x  3 root     wheel   96 Oct 31 19:24 com.apple.TimeMachine.localsnapshots

In this example Backup Data is my NAS, USB02 is just a USB drive, and the final one is com.apple.TimeMachine.localsnapshots. My NAS is relatively large and that would probably never finish. USB02 gets scanned very quickly. The final one local snapshots only gets created when the Time Capsule “Back Up Automatically” is enabled this enables hourly incremental backups. The final one also appears to. be problematic Finder makes these look like external drives but I’m not too familiar with how Time Capsule treats these however having these being present also caused issues for me.

 

My takeaway for the time being is to turn off “Back Up Automatically” and unmount all network drives when I want to perform a Full Scan although not having to worry about this would also be nice.

[Flood and Flood's wife]

Hello @kelvix,

Thank you for posting back and your thorough analysis. 

What configurable actions are available in the External Disk Scan? (atm, I don’t have a Mac available to check this😥 )

Also, although it’s not a feature, “scan new & changed files” has previously escalated to the Lab.

If you have any “enhancements”, I would encourage you to log a “I have a suggestion” request with Kaspersky Technical Support.

Please let me know? 

Thank you. 

 

[kelvix]

I attached a screenshot of the options.

 

[Flood and Flood's wife]

Hello  @kelvix,

Thank you for the image!

Is KIS  “seeing” TimeCapsule as an external device? if “yes”, isn’t the “do nothing” an option? 

Also, log a support (problem) request with the Technical Team, ask their advice….🤔

Please let me know?

Thank you

[kelvix]

Mounting the network share does not appear to trigger a notification. Inserting a USB drive or an external disk drive does. Full Scan which is what triggered my investigation effort also hits my network shares. For example if I start a scan based on this screen

 

I found it attempting to scan my TimeCapsule which lives on my network share. I felt that this one should not have been trying to scan my Time Capsule.

 

I can log a support request and provide an update once they update me.

[Flood and Flood's wife]

Thank you  @kelvix,

I’m very keen to hear the outcome.

Best regards