LockDown Browser + Antivirus on Mac (Malwarebytes, Bitdefender, Sophos)

Last updated 2026-05-02 · LDBypass Editorial

Real-time antivirus products on Mac scan every file write LDB does during the exam. Monitor's video buffer (~5-10 MB per minute) is written to ~/Library/Group Containers/group.com.respondus.lockdownbrowser/, and AV scans every write. Result: ~30-50% higher CPU during exam + intermittent "saving recording" delays. Whitelist Respondus directories.

The symptom

CPU during exam is meaningfully higher than the baseline measured in our benchmark. "Saving recording" or "Recording paused" messages appear briefly during the exam. Battery drain higher than expected.

Why it conflicts with LDB

Antivirus products (Malwarebytes, Bitdefender, Sophos, Norton) implement real-time file scanning by hooking into the macOS file system events. Every write to disk triggers a scan. Monitor's video encoder writes ~5-10 MB per minute to a buffer file; AV scans every chunk, adding 100-300ms write latency that Monitor's encoder occasionally interprets as a hardware problem.

The fix - pre-exam procedure

Malwarebytes: Settings → General → Exclusions → Add Path → add each of:
- ~/Library/Application Support/LockDown Browser
- ~/Library/Caches/com.respondus.lockdownbrowser
- ~/Library/Group Containers/group.com.respondus.lockdownbrowser
Bitdefender: Protection → Antivirus → Settings → Manage Exceptions → Add → File/Folder. Add the same three paths.
Sophos: Settings → Configure Sophos Anti-Virus → Exclude items from scanning. Add same paths.
Norton: Settings → Antivirus → Scans & Risks → Items to Exclude from Scans.
Restart your Mac after adding exclusions so the AV reloads its rule set.

Alternative configurations

Alternative - pause AV protection for the duration of the exam:

Most AV products have a "pause for 1 hour" toggle in the menu-bar app.
For 90-minute exams, pause for 2 hours to be safe.
Re-enable immediately after submit + LDB exits.

What NOT to do

Don't try to bypass the conflict mid-exam - LDB's blacklist scan happens before exam launch and re-runs at intervals.
Don't restart the conflicting app DURING the exam - LDB will detect the new process and may flag.
Don't leave the conflicting app paused/disabled long-term outside exam windows; that's overkill for non-LDB use.

Frequently asked questions

Is my Mac at risk during the AV pause?

Briefly, yes - but during a proctored exam you're running only LDB and your LMS. The exposure window is small. Re-enable AV immediately after.

Will whitelisting Respondus directories make my Mac vulnerable to malware that hides there?

Marginal risk. Respondus is signed Developer ID + notarised; legitimate malware would be unlikely to land in those specific paths. AV will still scan everything outside those directories.

Built-in macOS XProtect / Gatekeeper - does that conflict too?

No. Apple's XProtect is more conservative about file scanning and runs at install time, not during normal write events. macOS's built-in protections don't add the LDB exam-time overhead.