Sophos 9.4 hanging on every scan

Thank you. How do I add that exclusion and what are any potential downsides?

Thanks.

This doesn't explain why Sophos is scanning the same DMG files over and over again. The scan will run through a dmg file, then five minutes later say its scanning the same file. So its more than a question of it just taking a while; it's literally (from what Sophos is telling me, running through the same files over and over again)

I confirm
"This doesn't explain why Sophos is scanning the same DMG files over and over again"
I let my imac all the night and the day with always the same hanging scanning file.....
it's strange that's take a such long time to scan

Hey Ben,

You can read all about adding exclusions here (page 8). I actually just learned you could add the wildcard exceptions (like the ones frank suggested) so I guess I can check off my "learned something new" box today.

How to do it wasn't super obvious to me so I made this fancy graphic. You can access this panel if you click on the Sophos shield > Open preferences... 

As for what to add, you can either add an exception for ALL DMG files (by adding *.dmg) or else just adding specific dmg files that the scanner seems to get stuck on.

As for the potential downsides - well, it means that .dmg files aren't going to be scanned as part of your regular scans. But that doesn't mean you have to avoid scanning them altogether - for example, when you download a file from the Internet, it will still be scanned for malicious content when you're downloading it, thanks to Web protection. 

Hopefully that helps, but let me know if you have any other questions.

Serra:

i added a *.dmg exclusion to the scan, but it didn't take. The scan I'm running now is still looking through .dmg files, specifically the .dmg file for apache open office.

actually it's looking through all of them, and doing it on the same loop as before.

oddly enough, if you have sophos scan *only* .dmg files, it goes through them without issue; this is only happening when its part of a whole mac scan

Hi Neil,

Hmm... that's odd.

This is an ugly workaround, but maybe you could ry stuffing all your DMG files into a single directory, and then adding an exclusion just for that directory? Obviously a real fix is preferable but I'm curious if that would work.

Also, can you post a screenshot of your exclusions list? I'm sure you added the correct thing but I'd just like to double check. 

Thanks,

Serra

I too ran into this tonight. It appears that when Sophos makes the file list it can get itself in a loop and the same files are added to the list over and over. This is very noticeable when scanning archive files as they take longer and you can watch the files names cycle. This is harder when disabling scanning in archive files but I saw it there as well. When I turned off scanning in archive files, the scans completed albeit with limited value given that all the archive files were skipped:)

For some form of reference, I just scanned my son's directory (/Users/Son) and it took close to an hour before I stopped the scan (when it was scanning within archives). I personally watched the same file be scanned multiple times. I then went and checked his directory to see if he had multiple copies of the file and there was only one file. In total his account only consumes 84GB which shouldn't take that long to scan (and would not have if the scanner wasn't repeatedly scanning the same file).

Some files that were in the loop of files being scanned:
eclipse-java-luna-SR1a-macosx-cocoa.tar
ksp-osx-1-0-4.zip

Hope that helps.

Thanks,
George

Yeah I can try to get a screenshot of it, though obviously I would expect Sophos to be able to do a full scan of the entire computer without building elaborate exclusions and directories full of files it inexplicably cannot scan. This is especially true for .dmg files which would be part and parcel of applications I download from the internet.