XFENCEDaemon on MacOS 10.15.7 stalls Clip Studio Paint

K_P

Hi,

After changing from another Mac antivirus software to F-Secure SAFE, I have encountered an issue with Clip Sudio Paint -drawing software. Starting up the program, and opening a file, or creating a new takes significantly long time. From Activity Monitor I see that XFENCEDaemon takes very much CPU while this happens. As such I think that the situation with Clip Studio Paint is similar to Mongo DB case reported earlier on. Is there way to make XFENCEDaemon to recognize the Clip Studio Paint?

ArthurVal

Hello!

The current plan is to release SAFE with fully featured DeepGuard by the end of the year. We are currently finalizing it and making assessments on the feature readiness to reach production level.

Best regards, Arthur

SAFE Mac R&D Team

ArthurVal

Hello!

Thanks for your report! Could you please run Support Tool app shipped with SAFE and submit the resulted archive with SAFE diagnostics to our Customer Care so that we could analyze the whole picture?

We will investigate the "Clip Studio Paint" app on our side to find out the appropriate way of handling it so that SAFE does not cause any inconvenience while using it.

Best regards, Arthur

SAFE Mac R&D Team

K_P

Hi,

Any information on this topic? I have sent you the Support Tool file, but have not heard anything since then. The behaviour of Xfence has not changed either.

And for the information, also ArtRage6 makes F-Secure on Mac to behave similarly: it takes 5...10 minutes to launch the software due to XfenceDaemon. The older version ArtRage5 started practically immediately.

ArthurVal

Hi, @K_P!

Sorry for the hold up. Let's try the following to ease up the situation with this software on your Mac.

1) open the Terminal app. You can find it with SpotLight or by navigating to Applications folder. Terminal app is located in Utilities subdirectory of Applications.

2) please type in 3 commands below one by one (Terminal will prompt for your admin password). This will create override rules for XfenceDaemon and should instruct it to ignore Clip Studio Paint and ArtRage6.

echo 'allow prefix "/Users/" "any" rwcx "t" "8MATQ43PD5"' | sudo /bin/sh -c "cat >> /Users/Shared/F-Secure\ XFENCE/local.xfence.rc"

echo 'allow prefix "/Users/" "any" rwcx "t" "5WD27NQMLG"' | sudo /bin/sh -c "cat >> /Users/Shared/F-Secure\ XFENCE/local.xfence.rc"

sudo killall xfencedaemon

After that, you can close Terminal and please wait for 15-20 seconds for XfenceDaemon to restart and apply new rules.

Please let me know if that helped to resolve the issue you were observing earlier on. Thanks!

Best regards, Arthur

K_P

Hi,

Thank you for the instructions. Before trying this, I would like to know if that only excludes mentioned programs from XFENCEDaemon, or does is leave those programs (or their directories) totally without virus protection? How "strong" is this exclude?

ArthurVal

Hi

XFENCEDaemon (DeepGuard feature) and virus protection are two independent features. Excluding these applications from being monitored by XFENCEDaemon does not prevent virus protection to react in case malicious activity is detected in these directories.

In the current release, XFENCEDaemon (DeepGuard) only collects diagnostic information and does not block anything. So for now it's safe to instruct XFENCEDaemon to ignore certain locations if it causes usability issues.

Best regards, Arthur

K_P

Hi,

Thank you, problem is solved.

And thanks also for elaborating the difference on XFENCEDaemon and antivirus solution.

ArthurVal

Great! Thanks for confirming that.

We're constantly working on improving the functionality of SAFE in general and XFENCEDaemon in particular. We will analyze the root cause of high CPU consumption in case of these applications and will improve this aspect in the future releases. And also we are planning to provide more control over it so that this behavior can be corrected without going to Terminal to correct the behavior. This is just the limitation of the current release.

Best regards, Arthur

K_P

Hi,

Speaking about more control: I would appreciate if you would add similar exclusion options to Mac edition compared to windows edition (paths, files, extensions).

ArthurVal

Hi again!

Yes. Actually we have a similar functionality in testing at the moment with a simple mode where it is possible to just make an Allow/Deny decision with DeepGuard handling the rest of details on its own and a more advanced mode where it's possible to manually specify paths, file extensions, processes, file operations, duration and more.

This functionality will hopefully reach availability as part of SAFE in the near future.

Best regards, Arthur

K_P

Hi, any news on potentiol timeline for above mentioned feature to reach the production maturity?