Intego VirusBarrier Scanner strange behavior

[MacInWin]

As the subject says, IVBScanner is behaving strangly. I have a 2023f 16" M3 Pro MBP with 18 GB of memory and 1TB of storage, of which less than half is used at the moment. I'm running IVBScanner version 1.2 (916) with Malware Definitions from 3/14/2024, showing both to be up-to-date. In the past, I could scan my home folder in 30-40 minutes, max. But the scanner is significantly slower now, for no reason I can find. I'm asking if anybody else is having the same slow running?

By slow, I mean that yesterday I tried to run it in the middle of the day and noted that it was only progressing very slowly through the scan. I also noted that Activity Monitor reported it was using ovr 400% of CPU, and looking at the cores, it was using all four Performance cores at full blast! And yet it was only incrementing the count of files scanned at about one every three or four seconds.

So, I cancelled the scan and waited until just before bedtime. At that time I detached all external and network drives and killed all running processes to give IVBScanner the full machine, started the scan and went to bed. This morning, after running about 10 hours, it had completed only 535 files! At that rate, it will take a week to finish.

This is all new behavior, in the past Scanner has been fairly fast. I don't know if Intego has done something to make the scanner slower or not, or if it was deliberate or not. Anybody else seeing the slowdown?

I did run First Aid on the internal drive and it found no errors. Also the BlackMagic Disk Speed Test shows the drive is functioniing at full speed. Other than the Intego being slow, there are no other symptoms to make me think the machine is having any performance issues.

So, anybody else see the slowdown? At this speed, the Scanner is effectively non-usable.

EDIT: I got on a chat with Intego, with someone named Jessica. She indicated that the engine in the Scanner has not been written for the Apple Silicon, but that they are working on a version that she said would be out "soon." I've run the Scanner using Rosetta2 before, and it was fast, but I guess I was just lucky. For now, no scanning for me.

 

[IWT]

I got on a chat with Intego, with someone named Jessica. She indicated that the engine in the Scanner has not been written for the Apple Silicon, but that they are working on a version that she said would be out "soon." I've run the Scanner using Rosetta2 before, and it was fast, but I guess I was just lucky. For now, no scanning for me.

That's useful info, however sad, for Silicon-based Macs.

Although I can't find it right now, there has been at least one, if not two, Posts here questioning the length of time for Intego Virus Scanner to do its job. Randy replied to one of them, I recall.

Ian

 

[RadDave]

As the subject says, IVBScanner is behaving strangly. I have a 2023f 16" M3 Pro MBP with 18 GB of memory and 1TB of storage, of which less than half is used at the moment. I'm running IVBScanner version 1.2 (916) with Malware Definitions from 3/14/2024, showing both to be up-to-date. In the past, I could scan my home folder in 30-40 minutes, max. But the scanner is significantly slower now, for no reason I can find. I'm asking if anybody else is having the same slow running?

By slow, I mean that yesterday I tried to run it in the middle of the day and noted that it was only progressing very slowly through the scan. I also noted that Activity Monitor reported it was using ovr 400% of CPU, and looking at the cores, it was using all four Performance cores at full blast! And yet it was only incrementing the count of files scanned at about one every three or four seconds...........

Jake - well, that's almost exactly what I reported using this app in another thread in which I posted excessive temps in all of my CPU cores (going from 90º F to 160º F) on my new M2 Air - also, I tried two runs and after 15-20 mins, only under 1000 files had been scanned. My previous experience on Intel machines was still running HOT but much faster scanning usually done in a half hour w/ hundreds of thousands of files scanned - don't plan to use the scanner unless an update is offered. Dave

 

[MacInWin]

Jake - well, that's almost exactly what I reported using this app in another thread in which I posted excessive temps in all of my CPU cores (going from 90º F to 160º F) on my new M2 Air - also, I tried two runs and after 15-20 mins, only under 1000 files had been scanned. My previous experience on Intel machines was still running HOT but much faster scanning usually done in a half hour w/ hundreds of thousands of files scanned - don't plan to use the scanner unless an update is offered. Dave

I didn't watch the temps. The case didn't get warm, and the fans didn't take off, but the P-cores all shot to 100% and the E-cores hovered around 25-50%, with nothing else running and I only got to about 400 files scanned. And as I said, I have run it before on Mx Macs without that terrible performance, so they definitely have a problem. Hope they can fix it, as I do like the product overall.

 

[tewatson]

Haven't really paid attention to the scan times as I had it set to run automatically each day. However, recently had two hard OS crashes a few days apart and upon restart the Intego window was open with no scan done. Disabled auto-scan and all has been well.

Seeing the app isn't really ready for the current hardware kind of explains it.

Tom

 

[Randy B. Singer]

EDIT: I got on a chat with Intego, with someone named Jessica. She indicated that the engine in the Scanner has not been written for the Apple Silicon, but that they are working on a version that she said would be out "soon." I've run the Scanner using Rosetta2 before, and it was fast, but I guess I was just lucky. For now, no scanning for me.

I've never known VirusBarrier to be fast, even on Intel-based Macs. If I were to run it, and it was "fast", I'd worry that I had it set only to do a rudimentary scan.

Until Intego comes up with an Apple Silicon-native version, I recommend sticking with:

DetectX Swift
https://sqwarq.com/detectx/

Which should scan for all known malware, however it won't find malware that has been changed to hide from AV scanners.

Of course, if you have an Apple Silicon-based Mac, which by definition means that you are running a very recent version of the Mac OS, really, there is no need whatsoever for third party AV software. The Mac OS now has the equivalent of commercial AV software built-in (not to mention a bunch of other security features). See::

"XProtect Remediator This was introduced in macOS 12.3 on 14 March 2022..."
https://eclecticlight.co/2022/08/07/last-week-on-my-mac-is-your-mac-still-secure-from-malware/

A “Rapid Security Response” feature was added for macOS 13 (Ventura) and later:
https://tidbits.com/2023/05/02/what-are-rapid-security-responses-and-why-are-they-important/
This feature addresses security concerns that, when they arise, are considered so severe that they need to be addressed immediately.

See:
https://support.apple.com/guide/security/app-security-overview-sec35dd877d0/1/web/1

 

[MacInWin]

I guess, Randy, the definition of "fast" is kind of loose. Scanner used to run 30-40 minutes to scan my 500GB of data. Not "fast" in the sense of "instant" but much faster than now, when it only did 400 files in 8 hours. At the rate it was going, it was headed for running a week! DetectXSwift, on the other hand, finishes in less than 30 seconds. That kind of speed makes me a bit nervous, as it is certainly not as thorough in checking as Intego.

I know about XProtect Remediator, and have read that it is really good at what it does. I use XProCheck (from Eclectic LIght), once or twice a week just to make sure the scans are being done. And it's good to use Howard's SilentKnight to get the updates and verify you are current with the definitions from Apple.

I was running IVBScanner just once a month, so not a huge loss to wait. I only brought it up in case I was the only one seeing it. Good to know I'm not.

 

[Randy B. Singer]

I guess, Randy, the definition of "fast" is kind of loose. Scanner used to run 30-40 minutes to scan my 500GB of data.

That seems faster than usual for VB.

...now, when it only did 400 files in 8 hours.

And that indeed seems very disturbingly slow.

...DetectXSwift, on the other hand, finishes in less than 30 seconds. That kind of speed makes me a bit nervous,

Believe it or not, that's entirely normal for DetectX Swift. DXS completes a scan on my Intel-based Mac in about 17 seconds. And yes, that has always made me nervous too.

It's speed is almost identical to MalwareBytes. The two products are extremely similar.

it is certainly not as thorough in checking as Intego.

The MalwareBytes folks have always claimed that their product does a thorough scan for malware, but logically one has to reason that it would be impossible for software to scan every file on a modern hard drive in just a handful of seconds. Eventually someone from their company admitted that their product only looks in known places for files with known names. That's one of several reasons that I've stopped recommending MalwareBytes...I've found them to be dishonest on more than one occasion, and I don't trust them. I DO trust the DetectX Swift folks. They don't pretend that their software is something that it's not. Though it may be all that one needs, I'm not sure.

It does bring up the question of how common it is for Mac malware to be adapted to evade AV software. Apparently, with a product like MalwareBytes or DetectX Swift, all that the bad guys have to do is change the name and/or place of files that the malware drops and they wouldn't be found. I have no idea how often, if ever, this happens. I don't even know if adapting malware in this way would be effective, as I don't know how many folks use MB and DXS verses traditional AV software. I suspect that the built-in Apple AV software would find such malware anyway. So adapting it to evade MB and DXS would be a waste of time and money for the bad guys.

 

[Rod]

Okay, Jake I have the same IVBS version and virus definitions as you. I do not scan my Home Folder instead I opt for the Macintosh HD.
When I tried my Home Folder today it did seem VERY slow; about 70 files scanned in 5 min.
I swapped back to the Macintosh HD; 700,000 files scanned in the same amount of time. To me this is about normal. Like you all 10 CPU cores pretty close to maxed out.

 

[pine man]

Macintosh HD; 700,000 files scanned in the same amount of time. To me this is about normal. Like you all 10 CPU cores pretty close to maxed out.

Just checked my Mackintosh HD and, including downloading new virus definitions, a total time of 7 minutes to scan all files.

 

[MacInWin]

@Rod and @pine man that is very interesting. I just did a quick trial and selecting Macintosh HD did, in fact, show the counter moving very much faster. About 50,000 in less than three minutes, which is about what I expected. But then I selected just "Users" and it went back to very, very slow, only doing 3 files in two minutes. Like you, the P-cores were 100% on both trials.

The silly thing is that the other three folders on Macintosh HD are System, Applications and Library, all of which are locked down by Apple pretty tightly. System is actually a snapshot of the sealed and encrypted System volume and is read only. I think Applications and Library can be written to, but they are checked again on boot against the sealed/encrypted version, so malware should not be able to get in there. The Users folder is on a separate Volume, and is read/write. So, basically, Scanner scans much faster when asked to scan what it doesn't need to scan, but goes very slowly when asked to scan a subset.

That's just strange.