10.2.1.5 ON MacOS Ventura ... Scan management

Have read the User Guide and Internet answers… in the user interface there is no option for scanning management… I have been running a system scan that has only covered 1000 files 184628→185720 over the last eight hours, and the files are in /.nofollow …. but only PDFs and JPEGs. I can see that the CPU use is only minor (BDLDAEMON CPU % is high, but only as a proportion of CPU uses… actual CPU activity is under 10%).

The suggestions all say Preferences (it's Settings)~> Protection~> Scan Management ~> the three dots….THIS does not feature in my interface.

All I got is "Start Scan". (If you cannot tell, I'm feeling considerably frustrated that this configurability is out of view somewhere.)

Please assist solution.

Best Answer

  • Alexandru_BD
    Alexandru_BD admin
    Answer ✓

    Hello,

    The speed of a system scan depends on many factors such as system specifications, large volumes of data, the computer resources in use by another software, if it’s the first scan since installing Bitdefender, and most importantly, the number of archives and over-compressed files/backups. With every system scan, Bitdefender will index the files that have already been scanned, and the scan time will greatly decrease. The scan is not liniar and you should wait until the end of the process. This performs a comprehensive check for malware of the entire system. All connected mounts will be scanned too. For improved performance, it is recommended not to run this task while performing other resource-intensive tasks (such as video editing, streaming, etc).

    However, if the scanning time exceeds 12 hours, I think there could actually be a problem there. I assume this is the only security program installed and that the minimum system requirements are met? If that's the case, maybe it would be a good idea to get in touch with the Support teams and ask them to have a look at what's going on there.

    If the scan takes an unusually long time, considering all the above, you can use this link to contact the Bitdefender Support teams:

    https://www.bitdefender.com/consumer/support/help/

    State your contact reason / choose request category, then choose from the available contact channels, chat, phone and email/ticket. Chat would be the fastest way to reach them.

    Let me know how it goes.

    Regards,

    Alex

    Premium Security & Bitdefender Endpoint Security Tools user

Answers

  • 68 .pngs and .PDFs in 60 minutes…. I could check these faster manually.

  • Help!

  • I started a BitDefender System Scan on MacOS Sequoia 15.2 yesterday, and was also surprised by the long scan duration (18+ hours for only a partial scan, whereas it normally goes much faster).


    I noticed that BitDefender was taking a lot of time scanning the contents of the directory /.nofollow, located below the root directory (/, or Macintosh HD) which I do not recognize, and became concerned about the origins of this directory.


    ∅ / ❯ ls -al /
    total 17
    drwxr-xr-x 22 root wheel 704 Dec 7 09:11 .
    drwxr-xr-x 22 root wheel 704 Dec 7 09:11 ..
    lrwxr-xr-x 1 root admin 36 Dec 7 09:11 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
    ---------- 1 root admin 0 Dec 7 09:11 .file
    drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .nofollow
    drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .resolve

    drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .vol
    drwxrwxr-x 276 root admin 8832 Jan 15 13:06 Applications
    drwxr-xr-x 83 root wheel 2656 Dec 12 11:08 Library
    drwxr-xr-x@ 10 root wheel 320 Dec 7 09:11 System
    drwxr-xr-x 7 root admin 224 Dec 12 11:06 Users
    drwxr-xr-x 8 root wheel 256 Jan 15 16:15 Volumes
    drwxr-xr-x@ 39 root wheel 1248 Dec 7 09:11 bin
    drwxr-xr-x 2 root wheel 64 May 9 2022 cores
    dr-xr-xr-x 4 root wheel 8307 Jan 15 13:07 dev
    lrwxr-xr-x@ 1 root wheel 11 Dec 7 09:11 etc -> private/etc
    lrwxr-xr-x 1 root wheel 25 Jan 15 13:07 home -> /System/Volumes/Data/home
    drwxr-xr-x 4 root wheel 128 Jul 24 2022 opt
    drwxr-xr-x 6 root wheel 192 Jan 15 13:07 private
    drwxr-xr-x@ 77 root wheel 2464 Dec 7 09:11 sbin
    lrwxr-xr-x@ 1 root wheel 11 Dec 7 09:11 tmp -> private/tmp
    drwxr-xr-x@ 11 root wheel 352 Dec 7 09:11 usr
    lrwxr-xr-x@ 1 root wheel 11 Dec 7 09:11 var -> private/var

    According to ChatGPT 4o, these items are non-standard and undocumented in MacOS:

    .file
    .nofollow
    .resolve

    "These files are unusual because they are:
    Non-standard entries in the root directory of macOS.
    Empty and hidden, serving no clear purpose."

    Further, I see the exact same items on 4 of my different Macs, also running Sequoia 15.2.
    The same modification date is the same for these items on all my 4 Macs: Dec 7 09:11.
    There are also other files in the root directory that display the same timestamp (e.g. /System, see above).
    I do not believe I updated MacOS or performed any particular system-affecting actions on this date, on any of the 4 Macs.

    If I navigate into /.nofollow, there are no listed items inside the folder:


    ∅ /.nofollow ❯ ls -al /.nofollow
    total 0
    drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .
    drwxr-xr-x 22 root wheel 704 Dec 7 09:11 ..


    However, when running BitDefender scan on the folder, it leads to a wide scan of the MacOS system.
    It appears that this is some kind of virtual overlay into actual files elsewhere on MacOS.

    There will be many files scanned via /.nofollow/, and this also causes the scan duration to take many hours.

    In the screenshot it is scanning /.nofollow/Library/, but it will also scan my user Home (~) via /.nofollow/System/Volumes/Data/Users/my_user/, and other locations.

    The scan via /.nofollow/ seems to be done in addition to scanning the actual locations, i.e. /Users/my_user.

    I tried Googling for /.nofollow, and this thread is literally the only other search result on the web that mentions this folder. And coincidentally I also discovered it via a BitDefender Scan.

    It all seems a bit fishy to me? But perhaps these items are created by BitDefender, Time Machine, or a recent MacOS update?

    However, one of my Macs currently doesn't have BitDefender even installed, so I'm not sure if this at all is related to BitDefender.

    Also noting that, although perhaps not related, BitDefender seems to be scanning remote Time Machine backups on LAN (on Synology NAS), even though I've enabled the setting "Don't scan content in backups".
    Center

    Any ideas on what is going on? Do other people have, or lack, these items in their root directory (ls -al /)?

    ---------- 1 root admin 0 Dec 7 09:11 .file
    drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .nofollow
    drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .resolve

  • Hi N01, I also would like to know what these files are needed for. Googling unhelpful.

    BitDF will scan anything, even rubbish files. If I could safely delete them, I will.

    BTW, my scan speed picked up considerably after it was done with these 16-character named Pdfs under /.nofollow…. what kind of PDF takes 1 minute each to scan?

    Outlook archives (30GB!) were next (still under /.nofollow) and it mowed through them fast. Lots of PDF attachments in there too, but no ponderous slowness. So my italicised question is relevant.

  • Alexandru_BD
    Alexandru_BD admin
    edited January 16

    Hello @Eliot_Mess & @N01,

    I did a bit of research and I can confirm that something unusual is going on there. The AVforMAC development team is currently investigating the reported behavior.
    In the meantime, they tested a workaround as well, which can be applied temporarily, until the fix is deployed.

    Apparently, this can be solved by adding the path /.nofollow to the exceptions. Open the Bitdefender UI, go to Protection → Antivirus, click on the Open button in the Exceptions section, then in the window that opens click on the + plus sign below the list - to add something to the list - then type cmd + shift + C using the keyboard, and from the list choose the internal disk (Macintosh HD), then type cmd + shift + . (period) to see hidden files/folders. nofollow appears in the list of folders, click on it to select it, then click on the Open button.

    Let me know how it goes and thank you for your patience while we look into this.

    Later edit: based on our findings, this issue only manifests itself on Mac computers running Sequoia 15.2.

    Regards,

    Alex

    Premium Security & Bitdefender Endpoint Security Tools user

  • I BELIEVE that I am experiencing the same issue (i.e., excessive scan times with /.nofollow files).

    @Eliot_Mess & @N01:

    Thanks for posting about the issue.

    @Alexandru_BD:

    My comments:

    1. This issue does NOT seem to be limited to Sequoia. @Eliot_Mess is running Ventura, and APPEARS to be experiencing the issue. And I am running Ventura, and AM EXPERIENCING excessive scan times due to /.nofollow files.
    2. The workaround you posted works.When /.nofollow is added to the scan exceptions, I am back to normal scan times.
    3. BEFORE I started the workaround, there was a Bitdefender entry on the exceptions list. Should have taken a screenshot of it, but did not. AFTER adding /.nofollow to the exceptions list via your workaround, the Bitdefender entry disappeared from the exceptions list.

    My Questions:

    1. In the original post, @Eliot_Mess mentioned that his interface was missing some features (i.e., the three dots). Mine is too. For example, the ability to enable Cryptomining protection. I am GUESSING that we are running older versions of the interface. How do we upgrade to the latest version?
    2. I am NOT very computer savvy. So, please excuse my ignorance. As I understand it, the workaround basically excluded some files from the AV scan. Is it safe to ignore these files, or is possible that there is some malware among those files?
  • Thank you Alex, for looking into this.

    Did you learn if the presence of the items I mentioned (see below once more) are native to MacOS, or created by BitDefender?

    ---------- 1 root admin 0 Dec 7 09:11 .file
    drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .nofollow
    drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .resolve

    I was very concerned that they are related to malware, in case they don't natively belong in the root directory of Macintosh HD.

    Would be great to confirm exactly the origin of these items, and that they aren't harmful or even likely to cause future inconveniences for the system overall. Is it something we can or should remove?

  • Thanks, Probie and N01. You really hit the key questions.

    I too am concerned as to the potential malware associations. My Macbook Pro is well specced but is laggy on simple internet searches, despite a very stable 50Mbps connection and no VPN.

    Surely somebody knows what these /.nofollow files are for? If we could just delete them, problem solved.

    I don't feel happy just putting them outside the BitDF scan's scope.

  • I'm not a Mac specialist here, but by the looks of it, the highlighted entries are not standard macOS items. They are almost certainly introduced, or at least altered by third-party software, in my opinion. I think it is quite plausible they are created or modified by Antivirus for Mac, or something else.
    The Support engineers may know more about these.

    Premium Security & Bitdefender Endpoint Security Tools user

  • Thanks, Alexandru for following up.

    Are you meaning BitDF Support engineers, or Apple Support engineers?

  • Well, since the development teams confirmed this is a known issue and provided the above workaround as well, obviously there are no concerns for malware. If they specifically advised this is something that can be added to exceptions, at least temporarily, I think their instructions can be trusted.

    Should you wish to get in touch with the Bitdefender engineers, you can use the below link to open a ticket and they will add your report to the list. This way, you will also receive an update once this is solved.

    https://www.bitdefender.com/consumer/support/help/

    State your contact reason / choose request category, then choose from the available contact channels, chat, phone and email/ticket. Chat would be the fastest way to reach them.

    Regards

    Premium Security & Bitdefender Endpoint Security Tools user

  • Alex,

    Thanks for the response. I appreciate it.

    I have already implemented the workaround that you posted earlier. Just do not like skipping files during a system scan, and want to get back to "normal" as soon as possible.

    Thanks for suggesting a support ticket. I have already opened a ticket, so that I am notified when the issue is resolved.

    Regards, Probie

  • You're most welcome @Probie, glad I could help somehow. If you hear anything, let the community know as well, if possible. I'll do the same. Much appreciated. 🙏

    Regards

    Premium Security & Bitdefender Endpoint Security Tools user

  • Alex,

    Just received a response from Bitdefender support. Tudor T. says to uninstall, and then reinstall Bitdefender.

    I am more than happy to do this. However, I am concerned that this recommendation is just the standard response to any issue, and will not really solve this particular issue.

    What does your contact at Bitdefender say? Specifically, have they resolved this known issue, and will a reinstall end the scanning issue with the /.nofollow files?

    Regards, Probie

  • "Just received a response from Bitdefender support. Tudor T. says to uninstall, and then reinstall Bitdefender. "

    I don't like this. It sounds like standard tech advice, a way to get rid of support tickets quickly.

    Like: "Have you tried restarting your computer."

    BitDF is supposed to be Mac-specialised… and malware aware…. They should find out, and tell us, the nature of these seemingly purposeless /.nofollow files.

  • @Eliot_Mess,

    Thanks, again, for starting this thread. While the underlying issue is not resolved yet, it has been helpful.

    I was concerned about the response from Bitdefender support, as well. Which is why I requested that @Alexandru_BD to confirm it with his contacts.

    FWIW, when this /.nofollow issue is resolved, I plan to do a complete reinstall of Bitdefender anyway. Like you, my interface does not seem to be the latest version (e.g., no three dots). I am am hoping that a reinstall will result in the latest version. 🙂

    Regards, Probie

  • N01
    N01
    edited January 22

    I just tried uninstalling and reinstalling BitDefender, indeed it did not remove the potentially problematic items from the root directory.

    We need to contact BitDefender support in order for them to explain the issue how to restore standard function.

    Please check if you also have these items in your root directory. You can look by opening the application Terminal (located at /Applications/Utilities/Terminal) and typing:

    ls -al /

    The output should show a number of items. Please let me know if you find any or all of these items and their attributes (copy & paste like I've done), which are non-standard in MacOS according to ChatGPT:

    ---------- 1 root admin 0 Dec 7 09:11 .file
    drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .nofollow
    drwxr-xr-x 2 root wheel 64 Dec 7 09:11 .resolve

  • @N01,

    Thanks for the response.

    Re: Reinstalling Bitdefender - I understand that the reinstall did not remove the POTENTIALLY problematic items from the root directory. Did it fix the scan time duration?

    Re: Contacting Bitdefender Support #1 - I have already opened a support ticket. It was specific to the LONG scan times, presumably linked to the /.nofollow files. I shared their INITIAL response (i.e., reinstall). FWIW, I e-mailed them back, and requested clarification. I will share any relevant information they provide here, if I get any.

    Re: Contacting Bitdefender Support #2 - You know more about computers than I do. And, I do NOT fully understand the non-standard file issue. As such, if you are willing, I do not believe that there is any downside to you ALSO contacting Bitdefender support about this problem. More to the point, direct contact would allow you to ask if the non-standard files originated from Bitdefender (i.e., .file, .nofollow, and .resolve).

    Re: My Root Directory - I am NOT very tech savvy. (These forum posts are a stretch.) Notwithstanding, I have been trying to access the "terminal", in order to accommodate your request for a screenshot. I cannot promise results, but I will try some more. (Honestly, just do not want to make the situation any worse by making a mistake.) Perhaps @Eliot_Mess could accommodate in the meantime.

    @N01 - I appreciate the effort your are devoting to this issue. 🙂

    Regards

  • Just an update …

    Background - I was experiencing an issue with excessive 'system scan' times. (The last one took over 20 hours.) The problem APPEARS to be linked to /.nofollow files. So, after discovering this thread, I contacted Bitdefender Support. Was told, by rep. Tudor, to reinstall Bitdefender AV. Double checked these instructions by contacting Bitdefender Support a second time. Was told, by rep. Elena, to reinstalll Bitdefender AV. So, I did.

    Results of Reinstall - Nothing changed. Specifically:

    1. there was a /.nofollow folder in the scan exceptions. (Which forum admin @Alexandru_BD already told us to add as a temporary workaround.)
    2. with the /.nofollow exception in place, the 'system scan' times return to normal.
    3. when the /.nofollow exception is removed, the 'system scan' times become excessive again.

    I am in the EXACT same situation as I was prior to contacting Bitdefender Support. Specifically, the workaround returns the 'system scan' times to normal. But, the workaround was only supposed to be a TEMPORARY 'fix', until the AVforMAC team resolved the issue.

    Not sure what to do next.

    @Eliot_Mess - the reinstall, at least the way I did it, did NOT 'change/update' my interface. In other words, I still do not have the three dots you referenced in the original post.

    @Alexandru_BD - Any updates from your contact on the AVforMAC team?

  • Yes, this will be corrected in the next update. No ETA yet.

    Premium Security & Bitdefender Endpoint Security Tools user

  • rpb
    rpb Mr
    edited January 28

    HI. I've just purchased a subscription to Bitdefender, and it's been a great experience. I have an iMac 2012 running Sonoma with Open Core Patcher and BootCamp installed. Exactly the same problem as described above with the /.nofollow folder (which I think might be a link and no folder at all) being problematic. The scan eventually finished 20 hours later having scanned half a million files! Is it safe to make an exception to /.nofollow and can someone tell me how this is achieved? On my MacBook 2018 with BootCamp and patched with OCP the scan took perhaps 10 minutes tops as I recall.

  • Yes, the workaround would be to add an exception and it's safe to do this. Check my previous comment.

    Premium Security & Bitdefender Endpoint Security Tools user

  • So here's a thing: /.nofollow seems to be empty. So in a terminal try 'cd /.nofollow/System'. And then 'ls'. Hmm. Interesting. 'System' is almost like a magically hidden directory so something weird is happening in the filesystem. Main question is whether this a MacOS thing or BD thing. My guess is the former otherwise BD would have noticed the hanging scan.

  • rpb
    rpb Mr
    edited January 29

    I thought nofollow had something to do with a tagged link telling search engines to ignore that link. Anyhow I followed the instruction given by Alexandru and made an exception for nofollow and while the scan didn’t take 20 hours this time it still took eight hours!

  • Yes, you're right, usually .nofollow is used on your web server to discourage search engines from proceeding. But not on your Macbook root directory!

  • I am not, repeat NOT, very computer savvy. So, please excuse me if this is an ignorant question.

    Bitdefender allows users to exclude backups from scanning (i.e., 'Time Machine' files). In my case, the excessive scan times were caused by cycling through ALL of the /.nofollow/TimeMachine files. Excluding the /.nofollow files, as directed by @Alexandru_BD, restored the scan times to normal.

    Is it possible that the /.nofollow files on the root directory is the mechanism that Bitdefender uses to exclude files from scans? Specifically, the 'Time Machine' backups that customers have elected to exclude from scans.