Sophos 9.4 hanging on every scan

Hello all,

starting with 9.4.0 we enabled scanning of "xar" compressed dmg files .Xar (short for eXtensible ARchive format) is an open source file archiver and the archiver’s file format. It was created within the OpenDarwin project and is used in Mac OS X for software installation routines, as well as browser extensions in Safari. Xar replaced the use of gzipped pax files.

Scanning these dmg files can be an extensive process, since the complete dmg is extracted and inside files are scanned. Other
timely scanning operations are dmg or archives containing java classes.

For example: the JDK dmg can take up to 15 minutes to scan, depending on system resources.

The scans most likely will finish. In order to speed up on-demand scanning the user can do one of the following things:

a) disable archive scanning (not recommended)

b) add an exclusion for dmg files, like *.dmg

Frank Fenn
Sr. Software Engineer

Thank you. How do I add that exclusion and what are any potential downsides?

Thanks.

Mine is the reverse: The MacMini has a fusion but the MacBookPro (circa 2011) doesn't. Both running El Capitan. MacMini is fine; MBP stalls at same place, no file name now... but Sophos logo spinning. Ran it for 14 hrs overnight. Both have 9.4.1 as well. Same settings too. (local only, etc )

Did you find out the steps? I'm assuming On-Access>Excluded Items > add, *.dmg. Would be nice to have a confirmation though.

another week and no response/no help. anyone else have any ideas for other antivirus programs for mac?

Still works on one computer, not the other, both running El Capitan. Sigh.

Hi guys,

Again, sorry about the slow replies here. I'm curious to know if adding the exceptions for .DMG files worked for you. I know it's not a fix but it should at least prevent the application from hanging. 

Because Tuckerdog asked, I'll repost the steps to add the exclusion: How to do it wasn't super obvious to me so I made this fancy graphic. You can access this panel if you click on the Sophos shield > Open preferences... 

As for what to add, you can either add an exception for ALL DMG files (by adding *.dmg) or else just adding specific dmg files that the scanner seems to get stuck on.

Hopefully that helps, but let me know if you have any other questions.

as previously stated, adding the *.dmg exception doesn't prevent it from still slowing down and cycling through .dmg files constantly (unless I set the exception incorrectly)

I'll try this, but now neither computer can run SOPHOS scan. They hit a mark (no listed file) and it just spins in the toolbar. For days.

How do I exclude backups? I would like to test that. The only times SOPHOS has ever found anything is in my backups and its usually some lame thing like someone sending a fake .exe from UPS saying FEDEX has a USPS letter for me.

Sophos just jumped the first "hurdle" and continued past a spot it's hung before .... after setting excluded items *.dmg. ... Developing ...

To exclude your backups, you would either add an exclusion for the backups' location, or else you can go into the settings and disable archive scanning. Be careful with this though as it disables scanning *all* archives.

To exclude your backups, you would either add an exclusion for the backups' location, or else you can go into the settings and disable archive scanning. Be careful with this though as it disables scanning *all* archives.