How long should a "full scan take" on a half full 2TB hard drive on a MacBook Pro running Catalina plus... [Closed]

Thanking you for replying so quickly.  Here is the Google translation of what they sent me yesterday.  Bear in mind that it is a machine translation.  But not bad.  I did as they suggested and added all of Adobe apps to the exclude section so they weren’t triggering continue “skip” due to requiring passwords or blocks.

“The heuristic analysis function (behavior detection)

It looks like it has been detected.

Since it cannot be deleted, we will give appropriate guidance

Screenshot to confirm that it is detected by the following procedure

Acquisition of the corresponding file (sample) to be detected, and

Please reply with your answer.

1. Take screenshot

Detects or deletes files / applications from our products

Obtain a screen to confirm that the message to be notified is displayed,

Please give me.

[Reference: How to create a screenshot]

https://support.kaspersky.co.jp/492#block12

2. Get detected files

Compress the detected file (sample / sample) with ZIP with password

Please provide to us in the state where you went.

* Specify the password as infected.

<< Compression method >>

(1) Click on the file to select it.

(2) After clicking [File] from the menu bar at the top of the screen

を Select [Compress "●●"].

* ●● is the name of the selected file.

<< How to set a password for the compressed file >>

(1) Click [Launchpad] from Doc and open in the following order.

[Others] → [Terminal]

(2) Enter “zipcloak ●●” on the terminal screen and press the [return] key.

   Press.

* A half-width space behind "zipcloak" is required.

* ●● is the name of the selected compressed file.

Drag and drop a ZIP file from the Finder to the terminal on *

コ ピ ー Copy with [Command] + [C] key in Finder, then in terminal

Paste is also possible with [Command] + [V] keys.

る と Please note that if there is a space behind * ●●, it will not work properly.

(3) If you are prompted to enter "Password:"

When prompted, enter the password [infected].

* When entering the password, enter characters or symbols such as “*”.

仕 様 Specifications not displayed.

1. Please let us know the specific timing of the detection in chronological order.

[Example]

(1) Download the application “〇〇〇”

(2) Double-click the downloaded file to execute

(3) The file starts after the installation is completed

(4) After starting the file, click “〇〇〇” from the application screen

(5) A message indicating that the threat was detected by Kaspersky is displayed,

Files are forcibly deleted.

A.

(1)

(2)

(3)

 (Four)

 (Five)

2. Inform the current date and version of the definition database release

   Please give me.

Date and time of release:

   version:

[Reference: How to check the Mac version number]

https://home.kaspersky.co.jp/store/kasperjp/ja_JP/html/pbPage.v18_faq_confirm_version/ThemeID.37143000#intab-6

<Confirmation procedure of definition database release date>

(1) Click the Kaspersky icon in the notification area to open the main screen.

   start up.

(2) Click [Update] from the main screen.

[B] Proceed without skipping protected files during full scan

Regarding the above, "We detected a password protected compressed file"

Is it a situation where a message is displayed?

If so, our product will

Since scanning cannot be performed, a message to that effect is issued to inform you.

However, this "compressed file" does not

We do not have detailed information because it may be made.

Therefore, as a workaround, perform a custom scan of "Adobe Creative Cloud" first,

After confirming that there is no problem, refer to the following URL and set an exclusion

Thank you for your cooperation.

[Reference: Kaspersky Internet Security 18 for Mac Exclusion]

方法 How to add file / folder / website address to list】

https://support.kaspersky.co.jp/13800

Above, sorry to trouble, but thank you.

Please reply to technical support without changing the email subject.

■ Notes

This request number expires in 7 days.

Please note that if there is no reply within the time limit, it will expire.

The expiration date of your request number will be extended each time you reply.

If the expiration date has expired, you can contact us again by listing INC000011355542 on the inquiry page.

****************************************************** ***********

Kaspersky Technical Support Center

URL: https://support.kaspersky.co.jp/”

1. No it hasn’t.  Stupid question!  How do I do that?
2. KIS 20.0.0.829a.b
3. Just over a year from memory.
4. Only once.  It is still at 1% after about 5 hours now. I run simple scans every morning but I know that doesn’t mean much.

I truly thank you.  

1. Complete
2. no “com.apple.Safari/Caches.db” exists

1. Yes, I’m still running the full scan but it is still on 1%.  And that is now after some 6 hours.
2. Not just because of that error msg but just to make sure that my macbook pro isn’t causing the problem. I believe that the “not-a-virus:Heur.AdWare.Script.Agent.gen”  is residing in a Carbon Copy Cloner backup which is on an external drive.  I have thought about trying to run KIS on that drive to see whether it can get to the actual file causing the problem which the Japanese support wants.  However, that is on a 6TB HDD. It just seems to be going round and around each day.  Reporting the same problem.

Sorry that it took so long to get back to you.  Bedtime.  After reading your email just now I checked to see how the current scan was going and found the following (screenshots attached)  Do you still want me to proceed as you have suggested above?  The Time Machine disk which it is currently scanning is some 5TB (full 6TB HDD) on an external HDD drive so that is probably why it is taking so long.  Or do you want me to just let it run its course seeing as it is “infected!”? The Carbon Copy Cloner where the Safari infection seems to also reside is some 2TB.  I will await your reply before proceeding.  Thank you for your patience.

Ok, I understand that.  I was wondering whether a reformat of both the Time Machine HDD and Carbon Copy Cloner HDDs, then going back again to reset Safari would clear up this matter once and for all.  I would rather get rid of these “nasties” so am prepared to do the reformats and start afresh with the backups.  It would seem that these “not-a-virus:HEUR:AdWare(x)” alerts are now deep seated in prior backups.  Time Machine has backups going back to early 2018

Would running say the likes of Malwarebytes as well as Kaspersky help?

No it is still on 1% at 12,810,974 odd scanned items and still going.  It’s still scanning the Time Machine.  For the two items in the orange triangle I have 1. delete or 2. ignore.  All the others items in a long list have been placed in “isolation”

 BTW I have selected to have Safari disable all “extension” in “develop”.  Not sure whether that might stop this in future.  Not that I use Safari these days.  I prefer to use Brave mostly

1. I deleted both of the files showing the orange triangles plus all the other items showing up as “not-a-virus:HEUR:AdWare(x)”
2. “isolation” is the Japanese translation, not sure what it is in English, but it did give me the choice to delete all which I did. 隔離されました。in image 3 means “this item has been isolated”.
3. The “develop” option is found under preferences in Safari and if checked is shown in the taskbar from where you can select various options.  Screenshots attached.
4. Oops I had better go back to either Chrome or Firefox then?

1. Still at 1% with well over 13,000,000 files scanned but still in Time Machine.
2. Yes, I did already empty the caches.
3. Which is better to use: Chrome or Firefox?

ok, here goes.

Hello @Sister Sabina, 

That was so quick !! 
I’m still wrting up all the steps, please have a  break, do not do anything until I post please?

Thank you

Flood

Hello @Sister Sabina, 

You’re most welcome

While you’re waiting (for me), and enjoying a , please run a KIS Full Scan, nothing else, let me know 1. If there are any detections 2. If the Scan hangs on any %?

Thank you

Flood