10.2.1.5 ON MacOS Ventura ... Scan management

Eliot_Mess

Have read the User Guide and Internet answers… in the user interface there is no option for scanning management… I have been running a system scan that has only covered 1000 files 184628→185720 over the last eight hours, and the files are in /.nofollow …. but only PDFs and JPEGs. I can see that the CPU use is only minor (BDLDAEMON CPU % is high, but only as a proportion of CPU uses… actual CPU activity is under 10%).

The suggestions all say Preferences (it's Settings)~> Protection~> Scan Management ~> the three dots….THIS does not feature in my interface.

All I got is "Start Scan". (If you cannot tell, I'm feeling considerably frustrated that this configurability is out of view somewhere.)

Please assist solution.

Alexandru_BD

Hello,

The speed of a system scan depends on many factors such as system specifications, large volumes of data, the computer resources in use by another software, if it’s the first scan since installing Bitdefender, and most importantly, the number of archives and over-compressed files/backups. With every system scan, Bitdefender will index the files that have already been scanned, and the scan time will greatly decrease. The scan is not liniar and you should wait until the end of the process. This performs a comprehensive check for malware of the entire system. All connected mounts will be scanned too. For improved performance, it is recommended not to run this task while performing other resource-intensive tasks (such as video editing, streaming, etc).

However, if the scanning time exceeds 12 hours, I think there could actually be a problem there. I assume this is the only security program installed and that the minimum system requirements are met? If that's the case, maybe it would be a good idea to get in touch with the Support teams and ask them to have a look at what's going on there.

If the scan takes an unusually long time, considering all the above, you can use this link to contact the Bitdefender Support teams:

https://www.bitdefender.com/consumer/support/help/

State your contact reason / choose request category, then choose from the available contact channels, chat, phone and email/ticket. Chat would be the fastest way to reach them.

Let me know how it goes.

Regards,

Alex

Eliot_Mess

68 .pngs and .PDFs in 60 minutes…. I could check these faster manually.

Eliot_Mess

Help!

N01

I started a BitDefender System Scan on MacOS Sequoia 15.2 yesterday, and was also surprised by the long scan duration (18+ hours for only a partial scan, whereas it normally goes much faster).

I noticed that BitDefender was taking a lot of time scanning the contents of the directory /.nofollow, located below the root directory (/, or Macintosh HD) which I do not recognize, and became concerned about the origins of this directory.

∅ / ❯ ls -al /
total 17
drwxr-xr-x 22 root wheel 704 Dec 7 09:11 .
drwxr-xr-x 22 root wheel 704 Dec 7 09:11 ..
lrwxr-xr-x 1 root admin 36 Dec 7 09:11 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin 0 Dec 7 09:11 .file
drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .nofollow
drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .resolve
drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .vol
drwxrwxr-x 276 root admin 8832 Jan 15 13:06 Applications
drwxr-xr-x 83 root wheel 2656 Dec 12 11:08 Library
drwxr-xr-x@ 10 root wheel 320 Dec 7 09:11 System
drwxr-xr-x 7 root admin 224 Dec 12 11:06 Users
drwxr-xr-x 8 root wheel 256 Jan 15 16:15 Volumes
drwxr-xr-x@ 39 root wheel 1248 Dec 7 09:11 bin
drwxr-xr-x 2 root wheel 64 May 9 2022 cores
dr-xr-xr-x 4 root wheel 8307 Jan 15 13:07 dev
lrwxr-xr-x@ 1 root wheel 11 Dec 7 09:11 etc -> private/etc
lrwxr-xr-x 1 root wheel 25 Jan 15 13:07 home -> /System/Volumes/Data/home
drwxr-xr-x 4 root wheel 128 Jul 24 2022 opt
drwxr-xr-x 6 root wheel 192 Jan 15 13:07 private
drwxr-xr-x@ 77 root wheel 2464 Dec 7 09:11 sbin
lrwxr-xr-x@ 1 root wheel 11 Dec 7 09:11 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel 352 Dec 7 09:11 usr
lrwxr-xr-x@ 1 root wheel 11 Dec 7 09:11 var -> private/var

According to ChatGPT 4o, these items are non-standard and undocumented in MacOS:

.file
.nofollow
.resolve

"These files are unusual because they are:
Non-standard entries in the root directory of macOS.
Empty and hidden, serving no clear purpose."

Further, I see the exact same items on 4 of my different Macs, also running Sequoia 15.2.
The same modification date is the same for these items on all my 4 Macs: Dec 7 09:11.
There are also other files in the root directory that display the same timestamp (e.g. /System, see above).
I do not believe I updated MacOS or performed any particular system-affecting actions on this date, on any of the 4 Macs.

If I navigate into /.nofollow, there are no listed items inside the folder:

∅ /.nofollow ❯ ls -al /.nofollow
total 0
drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .
drwxr-xr-x 22 root wheel 704 Dec 7 09:11 ..

However, when running BitDefender scan on the folder, it leads to a wide scan of the MacOS system.
It appears that this is some kind of virtual overlay into actual files elsewhere on MacOS.

There will be many files scanned via /.nofollow/, and this also causes the scan duration to take many hours.

In the screenshot it is scanning /.nofollow/Library/, but it will also scan my user Home (~) via /.nofollow/System/Volumes/Data/Users/my_user/, and other locations.

The scan via /.nofollow/ seems to be done in addition to scanning the actual locations, i.e. /Users/my_user.

I tried Googling for /.nofollow, and this thread is literally the only other search result on the web that mentions this folder. And coincidentally I also discovered it via a BitDefender Scan.

It all seems a bit fishy to me? But perhaps these items are created by BitDefender, Time Machine, or a recent MacOS update?

However, one of my Macs currently doesn't have BitDefender even installed, so I'm not sure if this at all is related to BitDefender.

Also noting that, although perhaps not related, BitDefender seems to be scanning remote Time Machine backups on LAN (on Synology NAS), even though I've enabled the setting "Don't scan content in backups".
Center

Any ideas on what is going on? Do other people have, or lack, these items in their root directory (ls -al /)?

---------- 1 root admin 0 Dec 7 09:11 .file
drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .nofollow
drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .resolve

Eliot_Mess

Hi N01, I also would like to know what these files are needed for. Googling unhelpful.

BitDF will scan anything, even rubbish files. If I could safely delete them, I will.

BTW, my scan speed picked up considerably after it was done with these 16-character named Pdfs under /.nofollow…. what kind of PDF takes 1 minute each to scan?

Outlook archives (30GB!) were next (still under /.nofollow) and it mowed through them fast. Lots of PDF attachments in there too, but no ponderous slowness. So my italicised question is relevant.

Alexandru_BD

Hello @Eliot_Mess & @N01,

I did a bit of research and I can confirm that something unusual is going on there. The AVforMAC development team is currently investigating the reported behavior.
In the meantime, they tested a workaround as well, which can be applied temporarily, until the fix is deployed.

Apparently, this can be solved by adding the path /.nofollow to the exceptions. Open the Bitdefender UI, go to Protection → Antivirus, click on the Open button in the Exceptions section, then in the window that opens click on the + plus sign below the list - to add something to the list - then type cmd + shift + C using the keyboard, and from the list choose the internal disk (Macintosh HD), then type cmd + shift + . (period) to see hidden files/folders. nofollow appears in the list of folders, click on it to select it, then click on the Open button.

Let me know how it goes and thank you for your patience while we look into this.

Later edit: based on our findings, this issue only manifests itself on Mac computers running Sequoia 15.2.

Regards,

Alex

Probie

I BELIEVE that I am experiencing the same issue (i.e., excessive scan times with /.nofollow files).

@Eliot_Mess & @N01:

Thanks for posting about the issue.

@Alexandru_BD:

My comments:

1. This issue does NOT seem to be limited to Sequoia. @Eliot_Mess is running Ventura, and APPEARS to be experiencing the issue. And I am running Ventura, and AM EXPERIENCING excessive scan times due to /.nofollow files.
2. The workaround you posted works.When /.nofollow is added to the scan exceptions, I am back to normal scan times.
3. BEFORE I started the workaround, there was a Bitdefender entry on the exceptions list. Should have taken a screenshot of it, but did not. AFTER adding /.nofollow to the exceptions list via your workaround, the Bitdefender entry disappeared from the exceptions list.

My Questions:

1. In the original post, @Eliot_Mess mentioned that his interface was missing some features (i.e., the three dots). Mine is too. For example, the ability to enable Cryptomining protection. I am GUESSING that we are running older versions of the interface. How do we upgrade to the latest version?
2. I am NOT very computer savvy. So, please excuse my ignorance. As I understand it, the workaround basically excluded some files from the AV scan. Is it safe to ignore these files, or is possible that there is some malware among those files?

N01

https://community.bitdefender.com/en/discussion/comment/348970#Comment_348970

Thank you Alex, for looking into this.

Did you learn if the presence of the items I mentioned (see below once more) are native to MacOS, or created by BitDefender?

---------- 1 root admin 0 Dec 7 09:11 .file
drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .nofollow
drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .resolve

I was very concerned that they are related to malware, in case they don't natively belong in the root directory of Macintosh HD.

Would be great to confirm exactly the origin of these items, and that they aren't harmful or even likely to cause future inconveniences for the system overall. Is it something we can or should remove?

Eliot_Mess

Thanks, Probie and N01. You really hit the key questions.

I too am concerned as to the potential malware associations. My Macbook Pro is well specced but is laggy on simple internet searches, despite a very stable 50Mbps connection and no VPN.

Surely somebody knows what these /.nofollow files are for? If we could just delete them, problem solved.

I don't feel happy just putting them outside the BitDF scan's scope.

Alexandru_BD

I'm not a Mac specialist here, but by the looks of it, the highlighted entries are not standard macOS items. They are almost certainly introduced, or at least altered by third-party software, in my opinion. I think it is quite plausible they are created or modified by Antivirus for Mac, or something else.
The Support engineers may know more about these.

Eliot_Mess

Thanks, Alexandru for following up.

Are you meaning BitDF Support engineers, or Apple Support engineers?

Alexandru_BD

Well, since the development teams confirmed this is a known issue and provided the above workaround as well, obviously there are no concerns for malware. If they specifically advised this is something that can be added to exceptions, at least temporarily, I think their instructions can be trusted.

Should you wish to get in touch with the Bitdefender engineers, you can use the below link to open a ticket and they will add your report to the list. This way, you will also receive an update once this is solved.

https://www.bitdefender.com/consumer/support/help/

State your contact reason / choose request category, then choose from the available contact channels, chat, phone and email/ticket. Chat would be the fastest way to reach them.

Regards

Probie

https://community.bitdefender.com/en/discussion/comment/349186#Comment_349186

Alex,

Thanks for the response. I appreciate it.

I have already implemented the workaround that you posted earlier. Just do not like skipping files during a system scan, and want to get back to "normal" as soon as possible.

Thanks for suggesting a support ticket. I have already opened a ticket, so that I am notified when the issue is resolved.

Regards, Probie

Alexandru_BD

You're most welcome @Probie, glad I could help somehow. If you hear anything, let the community know as well, if possible. I'll do the same. Much appreciated. 🙏

Regards

Probie

https://community.bitdefender.com/en/discussion/comment/349193#Comment_349193

Alex,

Just received a response from Bitdefender support. Tudor T. says to uninstall, and then reinstall Bitdefender.

I am more than happy to do this. However, I am concerned that this recommendation is just the standard response to any issue, and will not really solve this particular issue.

What does your contact at Bitdefender say? Specifically, have they resolved this known issue, and will a reinstall end the scanning issue with the /.nofollow files?

Regards, Probie

Eliot_Mess

"Just received a response from Bitdefender support. Tudor T. says to uninstall, and then reinstall Bitdefender. "

I don't like this. It sounds like standard tech advice, a way to get rid of support tickets quickly.

Like: "Have you tried restarting your computer."

BitDF is supposed to be Mac-specialised… and malware aware…. They should find out, and tell us, the nature of these seemingly purposeless /.nofollow files.

Probie

https://community.bitdefender.com/en/discussion/comment/349196#Comment_349196

@Eliot_Mess,

Thanks, again, for starting this thread. While the underlying issue is not resolved yet, it has been helpful.

I was concerned about the response from Bitdefender support, as well. Which is why I requested that @Alexandru_BD to confirm it with his contacts.

FWIW, when this /.nofollow issue is resolved, I plan to do a complete reinstall of Bitdefender anyway. Like you, my interface does not seem to be the latest version (e.g., no three dots). I am am hoping that a reinstall will result in the latest version. 🙂

Regards, Probie

N01

https://community.bitdefender.com/en/discussion/comment/349195#Comment_349195

I just tried uninstalling and reinstalling BitDefender, indeed it did not remove the potentially problematic items from the root directory.

We need to contact BitDefender support in order for them to explain the issue how to restore standard function.

Please check if you also have these items in your root directory. You can look by opening the application Terminal (located at /Applications/Utilities/Terminal) and typing:

ls -al /

The output should show a number of items. Please let me know if you find any or all of these items and their attributes (copy & paste like I've done), which are non-standard in MacOS according to ChatGPT:

---------- 1 root admin 0 Dec 7 09:11 .file
drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .nofollow
drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .resolve

Probie

https://community.bitdefender.com/en/discussion/comment/349199#Comment_349199

@N01,

Thanks for the response.

Re: Reinstalling Bitdefender - I understand that the reinstall did not remove the POTENTIALLY problematic items from the root directory. Did it fix the scan time duration?

Re: Contacting Bitdefender Support #1 - I have already opened a support ticket. It was specific to the LONG scan times, presumably linked to the /.nofollow files. I shared their INITIAL response (i.e., reinstall). FWIW, I e-mailed them back, and requested clarification. I will share any relevant information they provide here, if I get any.

Re: Contacting Bitdefender Support #2 - You know more about computers than I do. And, I do NOT fully understand the non-standard file issue. As such, if you are willing, I do not believe that there is any downside to you ALSO contacting Bitdefender support about this problem. More to the point, direct contact would allow you to ask if the non-standard files originated from Bitdefender (i.e., .file, .nofollow, and .resolve).

Re: My Root Directory - I am NOT very tech savvy. (These forum posts are a stretch.) Notwithstanding, I have been trying to access the "terminal", in order to accommodate your request for a screenshot. I cannot promise results, but I will try some more. (Honestly, just do not want to make the situation any worse by making a mistake.) Perhaps @Eliot_Mess could accommodate in the meantime.

@N01 - I appreciate the effort your are devoting to this issue. 🙂

Regards

Probie

Just an update …

Background - I was experiencing an issue with excessive 'system scan' times. (The last one took over 20 hours.) The problem APPEARS to be linked to /.nofollow files. So, after discovering this thread, I contacted Bitdefender Support. Was told, by rep. Tudor, to reinstall Bitdefender AV. Double checked these instructions by contacting Bitdefender Support a second time. Was told, by rep. Elena, to reinstalll Bitdefender AV. So, I did.

Results of Reinstall - Nothing changed. Specifically:

1. there was a /.nofollow folder in the scan exceptions. (Which forum admin @Alexandru_BD already told us to add as a temporary workaround.)
2. with the /.nofollow exception in place, the 'system scan' times return to normal.
3. when the /.nofollow exception is removed, the 'system scan' times become excessive again.

I am in the EXACT same situation as I was prior to contacting Bitdefender Support. Specifically, the workaround returns the 'system scan' times to normal. But, the workaround was only supposed to be a TEMPORARY 'fix', until the AVforMAC team resolved the issue.

Not sure what to do next.

@Eliot_Mess - the reinstall, at least the way I did it, did NOT 'change/update' my interface. In other words, I still do not have the three dots you referenced in the original post.

@Alexandru_BD - Any updates from your contact on the AVforMAC team?

Alexandru_BD

Yes, this will be corrected in the next update. No ETA yet.

Probie

https://community.bitdefender.com/en/discussion/comment/349347#Comment_349347

Thanks for the information. 🙂

rpb

HI. I've just purchased a subscription to Bitdefender, and it's been a great experience. I have an iMac 2012 running Sonoma with Open Core Patcher and BootCamp installed. Exactly the same problem as described above with the /.nofollow folder (which I think might be a link and no folder at all) being problematic. The scan eventually finished 20 hours later having scanned half a million files! Is it safe to make an exception to /.nofollow and can someone tell me how this is achieved? On my MacBook 2018 with BootCamp and patched with OCP the scan took perhaps 10 minutes tops as I recall.

Alexandru_BD

Yes, the workaround would be to add an exception and it's safe to do this. Check my previous comment.

https://community.bitdefender.com/en/discussion/comment/348970#Comment_348970

rpb

https://community.bitdefender.com/en/discussion/comment/349379#Comment_349379

Thanks!

realcodfish

So here's a thing: /.nofollow seems to be empty. So in a terminal try 'cd /.nofollow/System'. And then 'ls'. Hmm. Interesting. 'System' is almost like a magically hidden directory so something weird is happening in the filesystem. Main question is whether this a MacOS thing or BD thing. My guess is the former otherwise BD would have noticed the hanging scan.

rpb

I thought nofollow had something to do with a tagged link telling search engines to ignore that link. Anyhow I followed the instruction given by Alexandru and made an exception for nofollow and while the scan didn’t take 20 hours this time it still took eight hours!

realcodfish

Yes, you're right, usually .nofollow is used on your web server to discourage search engines from proceeding. But not on your Macbook root directory!

Probie

https://community.bitdefender.com/en/discussion/comment/349449#Comment_349449

https://community.bitdefender.com/en/discussion/comment/349570#Comment_349570

I am not, repeat NOT, very computer savvy. So, please excuse me if this is an ignorant question.

Bitdefender allows users to exclude backups from scanning (i.e., 'Time Machine' files). In my case, the excessive scan times were caused by cycling through ALL of the /.nofollow/TimeMachine files. Excluding the /.nofollow files, as directed by @Alexandru_BD, restored the scan times to normal.

Is it possible that the /.nofollow files on the root directory is the mechanism that Bitdefender uses to exclude files from scans? Specifically, the 'Time Machine' backups that customers have elected to exclude from scans.

NeedInfo

Hello,

same issue here with Ventura 13.7.4.

Found the "/.nofollow" folder on root level (also others folders ".file" and ".resolve") . And the ".nofollow" containing all the files (system, library etc..) ….. leading to an endless scan of BD .

All these folders seem to be created on the same date/hour .

Did someone find if these ".nofollow", ".resolve" folders are related to MacOS-update or related to Bitdefender ? Or is it a Malware ?

Thank you so much if you have the awnser.

Regards,

Eliot_Mess

20FEB2025 - NeedInfo wrote:

All these folders seem to be created on the same date/hour. Did someone find if these ".nofollow", ".resolve" folders are related to MacOS-update or related to Bitdefender ? Or is it a Malware ?

Hi NeedInfo,

Myself and one other user have been asking if this is malware… or NOT.

We haven't received a definite answer that Folder of .nofollow is part of macOS because the BD team does not know the insides of macOS that well. (This surprised me given that this is said to be the top-rated antivirus suite for Mac.)

BUT… they are aware of it, and have not confirmed that it is malware. In fact, annoyingly laid-back about it.

My readings have disclosed that the way to show hidden System files on a Macintosh HD is to open the Macintosh HD in FINDER and key: Shift+Command+. (See that dot? That's what unveils the hiding.)

But you already found them anyway.

So… what creates a whole lot of hidden files ona particular day? Is it like the Temp folder? Or did Time Machine put them there? Was it from an OS Update? Can I delete them?

Probie

@Alexandru_BD,

It has been approximately a month since you graciously provided a workaround for this issue.

Given the timing, please consider contacting the AVforMAC development team at Bitdefender, and requesting:

1. a status update on this issue that you can share here. As of their last communication, Bitdefender was working on it. Notwithstanding, we would all like to get back to normal as soon as possible.
2. a definitive answer about the source of the non-standard, root level folders (i.e., "/.nofollow", ".file", and ".resolve"). Specifically, are they created by Bitdefender, Apple, or something else?

Thanks, again, for your assistance. 🙂

Alexandru_BD

Hi,

All I know is that the fix is ready, it just needs a few minor adjustments before going live in about two weeks' time.

As for the source of "/.nofollow", ".file", and ".resolve", it's still unclear to me what these are. But like I said earlier, the Support engineers may know more about this, as they are more up to date with the ongoing investigation that was carried out by the AVforMac development teams.

Regards

Probie

https://community.bitdefender.com/en/discussion/comment/350408#Comment_350408

@Alexandru_BD,

Thanks for the update. 🙂

Mac Guy

This is actually a worse problem than it might appear.

The specific issue I have is that BitDefender in scanning my Time Machine backup disk found a malicious file in a really old Time Machine backup (a DMG file that was never installed), and suggested I remove the file. I did, and this completely screwed up the Time Machine backup disk, so that the disk is no longer usable by MacOS. So two years of backups are gone forever — only way to "recover" was to reinitialize the disk and start over again.

(Note that I shouldn't have worried about deleting the file, since being on a backup disk any attempt to restore it and/or open the DMG would have been blocked.)

WayneMiller

I am performing the initial Bitdefender scan. So far, 5890064 files were scanned after 23 hours and it is still scanning! The scans are going very slowlu through the  /.nofollow directory. If I cancel, re-install Bitdefender, and  /.nofollow is added to the scan exceptions will it rescan the files scanned so far? — Or should I be patient and hope the current scan will finish in a few hours?

Probie

As shared earlier, I opened a support ticket about excessive scan times. I did this, in part, so that I would be notified when the 'fix' was implemented.

Earlier today, I received an e-mail from 'tech support'. It indicated that the issue was resolved via the latest update. So, I:

~ confirmed that I was running the latest version of Bitdefender AV for MAC (i.e., 10.2.2.2);

~ deleted the 'exception/workaround' provided by @Alexandru_BD back on 1/16/25;

~ and, ran a "system scan".

My scan time is back to normal.

I hope that everyone else that was impacted by this issue has similar results.

@Alexandru_BD - Thanks for your assistance. 🙂

Alexandru_BD

Cheers @Probie,

Yes indeed, a hotfix was deployed in the latest Antivirus for Mac update and I've shared the release notes on the fourm as well:

https://community.bitdefender.com/en/discussion/comment/351168#Comment_351168

I know many of you were expecting this one, so here it is. 😁

I'm glad to hear the issue was eventually resolved, and thank you very much for following up with the community! 🤝👍️

julesAI

Grateful to find this thread about the nofollow folder issue. Wanted to let you know I've run across the issue using the free version downloaded from the Mac App store.

My spouse's Mac (Sequoia 15.4.1 / Apple M4 chip) spend over 10 hours stuck in the /.nofollow folder, using the latest free Bitdefender Virus Scanner downloaded from the App store. After reading this thread, I put the folder into the exceptions setting and the scan worked fine.

FYI: Oddly, I also ran the latest app store Bitdefender on my own Mac (Sequoia 15.4.1 / Apple M4 chip) and the scan didn't get hung up on the /.nofollow directory.

(BTW: Has anyone found out what this directory is for?)

Is the fix only for the paid version? :)

Kind regards to all.