Performance issues F-Secure SAFE MacOS

Pestarzt

Hello everyone,

I have performance issues on my Mac, especially when I start it. When I activate Deep Guard it becomes unbearable...

I attached a screenshot of my acitivity monitor. It starts a bunch of processes.

Thanks in advance for tips!

Firmy

Hello @Pestarzt

Thank you for your reply.

A quick solution is you may uninstall SAFE by using the Uninstallation tool and reinstall it back. After reinstalling, kindly check the Activity Monitor if the issue remains.

Kindly do the following to reinstall SAFE on Mac.

Re-installation:

1. Log in to My F-Secure
2. After logging in, if this is your first installation from this account, you will see an option to add device.
   • ​Note: If you are reinstalling from this account, you will see your list of devices. Select the device name that you wish to reinstall to and select Release License. A page will appear to confirm the action. Select Release License.
3. Select Mine or my child's device and click Continue.
4. The Choose device type window opens. The This computer (Mac) option has been automatically selected.
5. Click Download for Mac. Depending on your browser:
   • The installation file downloads automatically; or
   • You are asked to save the file. If prompted, click Save File.
6. When the download is done, go to your downloads folder and run the installer (f-secure-anti-virus-for-mac_xxxxxxxxxxxxx_.mpkg).
7. The Install F-Secure SAFE window opens. Click Continue.
8. Read the Privacy Policy, and click Continue.
9. Read the Software License Agreement, and click Continue > Agree to accept the terms of the software.
10. Select a destination and click Continue. Enter your administrative credentials, if asked, and click OK.
11. On the Installation Type view, click Install. Enter your administrative credentials, if asked, and click Install Software. The installation process starts and should take less than 5 minutes to complete.
12. When the F-Secure SAFE activation welcome window appears, click Continue.
13. In the Name new device window, enter a name for your computer, and click Continue. Enter your administrative credentials, if asked, and click OK.
14. The Browsing Protection browser extension installation prompts. Choose your browser from the drop-down menu, and click Install now.
15. Your selected browser opens, and the Browsing Protection extension is now installed.

If the issue remains after reinstalling, you have to generate FSDIAG on your Mac How do I create an FSDIAG file? - F-Secure Community

Looking forward to your reply.

Thank you and have a good day.

Firmy

Hi @Pestarzt

Welcome to the F-Secure Community page. Thank you for your post.

Would you provide us with more information? What is the macOS version running? Is it the latest version available for your Mac? And what is the version of SAFE running on your Mac?

When I activate Deep Guard it becomes unbearable...

May I know what is the Deepguard security level you use on your Mac? You can check it from here https://help.f-secure.com/product.html#home/safe-mac/latest/en/task_7AB67B7EEEB24A15BBD4D4D5C2FFE55C-safe-mac-latest-en

Did you run a computer scan? Because I can see multiple fsavd running on your machine, which is when you are running a scanning. Or did the situation immediately occur after you turned on your machine?

Looking forward to your reply.

Thank you and have a nice day.

Pestarzt

Dear Firmy,

thank you for the quick reply and thank you for the welcoming words.

Currently I am running MacOS 13.0.1 (latest version), I must mention though that I had the same problem with earlier versions as well.

SAFE version is 18.4 with Database 2022-12-09_07. Right now DeepGuard is not even active.

No I did not run a scan (at least I did not start anything manually). The screenshot was taken right after boot-up of my machine.

I also noticed similar behaviour while the programm was running data base updates.

Pestarzt

Dear Firmy,

seems to work thank you! I think previously, I did not deinstall SAFE properly or something.

Have a good one!

Pestarzt

Sadly I have to come back to this, the issue occured again. I made an diagnostic file, can I upload that here or is it safer to send it via email?

Firmy

Hello @Pestarzt

Thank you for your reply.

I have sent you a private message.

You can send the FSDIAG through my message and kindly provide me with a screenshot of your Activity Monitor also.

Thank you and have a good day.

Firmy

Hello @Pestarzt

Good day to you.

We can see that there is a lot of scanning going on. We would like to request a scanner log for further investigation.

I have sent you a private message, kindly follow the instructions and attach the new log file to my message.

Looking forward to your reply.

Thank you and have a good day.

Firmy

After thoroughly investigating the file, we have discovered a significant amount of product activity related to the locations where Google Drive stores files. These files are considered to be downloaded from the internet, making them the main focus of our product.

To address the issue of "fsavd consuming a lot of memory," I recommend adding the location /Users/FelixAlt/Google Drive to the scanning exclusions list. You can easily do this by following these steps:

1. Click on the product icon in the menubar
2. Select “Settings…“
3. Click the “lock“ icon and enter admin password to unlock settings
4. Click “Set scanning exclusions“ on “Viruses and Threats“ tab
5. Click “+“ icon and select /Users/FelixAlt/Google Drive location.
6. Click “Done“

By implementing this exclusion, our product will start ignoring that particular location, thereby improving the situation with fsavd.

Please note that fscesproviderd will still intercept those events. However, you can attempt to remove the quarantine attribute, although there is a possibility that it may reappear later. Nevertheless, you can proceed with removing the attribute and closely monitor its behavior.

For your convenience, you can run the following command in the Terminal app:

xattr -rc /Users/FelixAlt/Google\ Drive/

This command will effectively remove the "downloaded from the Internet" markers from your Google Drive files.

Thank you for your cooperation, and I wish you a wonderful day.