TimeMachine has stopped backing up due to "Anti-virus software may be preventing Time Machine from writing to the backup"

After 6 Sep 2022, TimeMachine has stopped backing up my MacBook Air, with the error message "An error occurred while starting the backup. Anti-virus software may be preventing Time Machine from writing to the backup". The message appears to show up after the "preparing backup" step has completed and TimeMachine wants to start writing to the backup volume.


I am running Monterey (12.5.1)


My TimeMachine backup lives on a QNAP NAS device.


Other machines on this network are backing up to this NAS using TimeMachine Just Fine (my wife's Air is on Big Sur - 11.6.8).


I do not have any 3rd party anti-virus software installed on my machine, to my knowledge.


I have dismounted and remounted my TimeMachine volume within System Preferences: same error message. I have rebooted the Mac (several times): same error message.


Help!

MacBook Air 13″, macOS 12.5

Posted on Sep 13, 2022 9:58 AM

Reply
Question marked as Top-ranking reply

Posted on Sep 22, 2022 10:27 AM

TL;DR - Problem Solved!


Details (probably more than you bargained for!):

  • To recap, I'm running QNAP NAS devices as backup servers at both of our locations. TimeMachine backups to the one here stopped working on my Mac (Monterey), while still working on my wife's Mac (Big Sur). I would receive an error message implicating "anti-virus software", which was (and still is) confusing.
  • Running TimeMachine to a local USB disk on my Mac worked fine, which pointed me back to the NAS.
  • This portion is pretty QNAP specific, but does have some TimeMachine-relevant nuance:
    • Examining the files on the QNAP, I noted that my wife's TimeMachine "sparsebundle" folder was visible both in File Manager and in Hybrid Backup Sync (HBS) (a QNAP-specific backup-server-management app). However, my "backupbundle" folder was visible only in File Manager, not in HBS. Strange.
    • I did not go down the "sparsebundle" v "backupbundle" rabbit hole.
    • Given that this NAS backup was not critical for me, I went ahead and deleted the "backupbundle" folder, dismounted and re-mounted the TimeMachine volume ("Connect to Server..."), re-connected to the NAS TimeMachine volume within TimeMachine, and allowed TimeMachine to create a new backup.
    • This is working as expected! TimeMachine is now creating the initial backup.


So, problem solved. It's still a bit of a mystery to me exactly what happened, whether it was simple file corruption, some issue with QNAP's handling of "sparsebundles" v "backupbundles", or some issue with Apple's handling of legacy backups, or .... 

Similar questions

14 replies
Question marked as Top-ranking reply

Sep 22, 2022 10:27 AM in response to drengfer

TL;DR - Problem Solved!


Details (probably more than you bargained for!):

  • To recap, I'm running QNAP NAS devices as backup servers at both of our locations. TimeMachine backups to the one here stopped working on my Mac (Monterey), while still working on my wife's Mac (Big Sur). I would receive an error message implicating "anti-virus software", which was (and still is) confusing.
  • Running TimeMachine to a local USB disk on my Mac worked fine, which pointed me back to the NAS.
  • This portion is pretty QNAP specific, but does have some TimeMachine-relevant nuance:
    • Examining the files on the QNAP, I noted that my wife's TimeMachine "sparsebundle" folder was visible both in File Manager and in Hybrid Backup Sync (HBS) (a QNAP-specific backup-server-management app). However, my "backupbundle" folder was visible only in File Manager, not in HBS. Strange.
    • I did not go down the "sparsebundle" v "backupbundle" rabbit hole.
    • Given that this NAS backup was not critical for me, I went ahead and deleted the "backupbundle" folder, dismounted and re-mounted the TimeMachine volume ("Connect to Server..."), re-connected to the NAS TimeMachine volume within TimeMachine, and allowed TimeMachine to create a new backup.
    • This is working as expected! TimeMachine is now creating the initial backup.


So, problem solved. It's still a bit of a mystery to me exactly what happened, whether it was simple file corruption, some issue with QNAP's handling of "sparsebundles" v "backupbundles", or some issue with Apple's handling of legacy backups, or .... 

Sep 17, 2022 9:41 PM in response to drengfer

At this point, as a diagnostic step, I suggest that you perform a Time Machine backup to an external USB drive that is directly connected to your Mac. By the way, the latest MacOS is 12.6, but Time Machine should work for you under 12.5.


If the Time Machine backup to a directly connected disk succeeds, that will alert you to something in your NAS configuration being the culprit.

Sep 17, 2022 1:27 PM in response to steve626

@steve626 - thank you for that! As I nose around on the machine, I don't see Avira having been installed (though that .kext file is definitely listed in the EtreCheck output; I note that it's tagged as "[not loaded]". There is no Avira application or folder in the Applications or Utilities folders, so I suspect never installed? (The files date from 2015; must have come across during migration to the new Apple Silicon machine.) Avira's uninstall instructions (https://support.avira.com/hc/en-us/articles/360000759429-How-do-I-uninstall-Avira-Security-for-Mac-) presume that there is an app installed. I did see this article in the discussions forum (How do I completely remove Avira? - Apple Community), which I may have to resort to (though I'm concerned that some of the manual operations may be above my pay grade).


As a first attempt, I have downloaded the Avira installer, installed the app, and uninstalled it. Rebooting and re-ran EtreCheck to see if that has cleaned up the zombie .kext file. It is no longer listed under “Kernel Extensions”, so I trust that it’s gone. There were a few other breadcrumbs (per the discussions post above about completely removing Avira) - deleted them. Allowed TimeMachine to attempt a backup - same error as above. Dang!


Here is latest EtreCheck output, post Avira install/uninstall routine

(attached).



Sep 17, 2022 9:54 PM in response to drengfer

drengfer wrote:

@steve626 - thank you for that! As I nose around on the machine, I don't see Avira having been installed (though that .kext file is definitely listed in the EtreCheck output; I note that it's tagged as "[not loaded]".

That merely means at the time you ran Etrecheck, Avira’s kernel extension wasn’t running. It doesn’t mean it is not installed.

The fact that you don’t know Avira was installed is concerning. You installed something you don’t know you installed.

Yes, you installed Avira. There is no doubt about that. However you were tricked into installing Avira is irrelevant. You must remove the malware you installed.

Sep 17, 2022 3:07 PM in response to drengfer

To verify all supporting files of an app have been removed download and runn the shareware app Find Any File to search for any files with the application's or the developer's name in the file name.  For the Avira software you'd do the following search(es): 


1 - Name contains avira


Any files that are found can be dragged from the search results window to the Desktop or Trash bin in the Dock for deletion.


FAF can search areas that Spotlight can't like invisible folders, system folders and packages.  


Sep 21, 2022 8:52 AM in response to drengfer

Chapeau to @Steve626 - TimeMachine working Just Fine to my shiny new USB disk drive (directly connected to my Mac). Failure mode persists on the NAS-based archive, despite (again) re-booting NAS and dis-mounting / re-mounting the TM volume's access from the Mac. NAS TM backups continue to work fine from my wife's Mac (she is on Big Sur, not Monterey).


Now working with QNAP community and support to figure out whether and, if so, how the NAS is failing to interact properly with TimeMachine. Stay tuned!

Sep 17, 2022 4:53 PM in response to Old Toad

@OldToad - thanks for that, and for the pointer to Find Any File. What a lovely little utility! (Unfortunate acronym, though.)


Ran that and it did, indeed, find many more breadcrumbs, including a hidden "Avira" folder in Applications. Deleted all of that; emptied trash. Re-ran FAF - no further instances of "Avira" on the machine.


Re-booted: same problem.

Re-booted in Safe Mode: same problem.


I am stumped.


Sep 18, 2022 1:47 PM in response to drengfer

Okay, today's update:


  • Updated firmware on the QNAP NAS. No change in behavior on my machine. Recall, though, that my wife's machine (running Big Sur) backs up to that same NAS using TimeMachine with no difficulties. Also, my machine was backing up to that NAS just fine until 6 September. Checking the logs on the NAS I don't see any salient events on/about 5 or 6 September (just me logging in as Admin).
  • Updated Mac to 12.6 (from 12.15.1). No change in behavior on my machine.


@Steve626 has suggested running a backup to a hard-wired disk. I neither own nor have access to one, but at this point (2 weeks without a reliable backup), it's feeling prudent to get one if only for use until I/we figure this out. So, I'll pick up a disk (will take a day or two), try that, and report back.


[Side note: I note that a couple of other folks appear to have run into this TimeMachine error (based on posts to the Discussions fora) - I don't see any of those marked as "solved", so maybe this is some weird corner case?]


[Side note: Lastly, and in the realm of pure speculation, I suspect that the Avira stuff showed up on the scene as a "gift" from DropBox. I note (based on Wikipedia), that Avira and DropBox announced a partnership at about the same time that Avira appeared on my machine (2015/2016). No doubt I allowed this gift, but don't recall it specifically. Not germane to the troubleshooting, but thought I'd share it.]

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

TimeMachine has stopped backing up due to "Anti-virus software may be preventing Time Machine from writing to the backup"

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.