What Is XProtect on Mac and Why Is It Using CPU
XProtect is the antivirus built into macOS. Apple describes it as signature-based detection and removal of malware, and it runs on every recent Mac with no icon or window of its own. Seeing XProtect, xprotectd or a process with XProtectRemediator in its name in Activity Monitor is normal, and a short burst of CPU usually means it is checking an app or running a scheduled scan. Leave it running.
What it does and when
Apple's malware protection guide describes three parts:
| Part | What it does |
|---|---|
| Signature detection | Checks apps against YARA signatures that Apple updates |
| Remediation engine | Removes infections it knows about, using updates from Apple, and keeps checking periodically |
| Behavior engine | Detects unknown malware from what it does, and that data improves the signatures |
Apple says XProtect checks for known malicious content when an app first launches, when an app changes in the file system, and when its signatures update. By default, macOS checks for those updates daily, separately from system updates. So you can expect activity after you install or update an app, after a signature update, and from time to time with no app involved.
When it finds malware, Apple says XProtect blocks it, moves it to the Trash and alerts you in Finder. It has no window where you start a scan, because it was not designed that way.
Where it lives
Apple's guide gives no paths. On the Mac this page was checked on, the parts are here:
/Library/Apple/System/Library/CoreServices/XProtect.app
/usr/libexec/xprotectd
/var/protected/xprotect/XProtect.bundle
XProtect.app holds one XProtectRemediator… program per family of malware it removes, with names like XProtectRemediatorAdload, which is why Activity Monitor can show a name you have never seen. /Library/Apple carries the restricted flag, so System Integrity Protection keeps it from being changed, even with sudo.
To check your installed version and update history:
xprotect version
system_profiler SPInstallHistoryDataType | grep -A 4 XProtect
If the xprotect command is not found on your macOS, use the second line, which has been there far longer.
When it is using CPU
A burst after installing or opening a new app is the expected case. Give it several minutes on power.
If it stays high:
- Open Activity Monitor, choose View › All Processes, and sort by % CPU. Note the exact name and whether it is steady or spiky.
- Check that the file is really Apple's. Select the process and click the i button, then Open Files and Ports. The program should sit under one of the paths above.
- Finish what you were doing, restart, and watch again for ten minutes. A restart ends a stuck scan, and macOS schedules the next one on its own.
- Install pending macOS updates, in System Settings › General › Software Update.
- If it keeps running for hours on most days, send feedback to Apple with what you saw. Note which app you installed around when it began, since an app whose files keep changing gives XProtect more to check.
Slowness that remains after XProtect is quiet has another cause, so see high CPU usage on Mac for how to read the list.
Is it enough on its own
It is real protection against known malware, and it sits alongside Gatekeeper and notarization. Keep Install Security Responses and system files on, under System Settings › General › Software Update › Automatic Updates, since that is how signature updates arrive. What it is not is a full security product: there is no scan history to read, no web filtering and no on-demand scan button. Whether you want a third-party product on top depends on what you do and what your employer requires. If you are removing one, how to uninstall antivirus on a Mac lists what each leaves behind.
What not to do
- Do not try to delete or disable it. The folders are protected, and the guides that get around this ask you to turn off System Integrity Protection, which costs far more than a CPU spike.
- Do not force quit it again and again. It runs when macOS needs it, so the work is only postponed.
- Do not trust a pop-up saying XProtect found a virus and offering a phone number or a download. XProtect alerts in Finder and asks for nothing.
- Do not keep a blocked app by moving it back from the Trash because you recognize its name. Download it again from its developer instead.
Where Mole fits
Mole is not an antivirus: it does not scan for malware and has no row for XProtect in Clean. Status shows these processes when they rank among its busiest rows, with anything running from one app bundle folded into one row, and Why is this running? on a row shows its executable, so you can check the path without a Terminal. If you are chasing an unfamiliar background process that is not XProtect, the Startup segment of Apps lists third-party launch items, which is where persistent adware tends to install.
FAQ
Is XProtect a virus?
No. It is Apple's antivirus, part of macOS. Its programs live in protected system locations, so a process with that name running from anywhere else, such as your Downloads folder, deserves suspicion.
Can I turn off XProtect?
Not in System Settings. Leave it on: the only ways around it weaken System Integrity Protection, which protects much more than XProtect.
Why is XProtectRemediator running?
It is the part that looks for and removes specific known malware on a schedule. Seeing one of those processes does not mean your Mac is infected, because they run routinely and most finish quickly.
How do I check my XProtect version?
Run xprotect version in Terminal, or system_profiler SPInstallHistoryDataType | grep -A 4 XProtect for the update history.
Does XProtect mean I don't need antivirus?
For many people it covers known malware well, along with Gatekeeper and notarization. It does not offer scan reports or on-demand scans, so a workplace rule or a need for those is a reason to add another product.