Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

My research so far has found XProtect appears at first glance to be a basic AV engine that scans DMG & apps through Safari, Chrome and Firefox. I'm looking to understand what does it actually do and what does it exactly monitor outside of DMG and apps? I've read it doesn't provide protection from BitTorrent and removable USB thumb drives. What else?

share|improve this question

1 Answer 1

The Xprotect "system" is not really an AV engine as such. It looks for a very limited number of text strings, or "signatures," in specific types of files. For this reason, it is far less useful than a real AV program (up to you if you think one is necessary). In addition, it only checks files downloaded with certain apps: Safari, Mail, Messages, and third-party apps that have activated a setting to use Xprotect to check their files as well. Also, it only sets a flag on files, and depends on user interaction for protection. So an un-savvy user may see the dialog warning that a file is dangerous, but still click the necessary button to open it.

As you say, it doesn't protect against BitTorrent downloads (though specific BitTorrent clients could use the feature), and doesn't protect from files copied from any kind of removable media or files copied over a network.

share|improve this answer
I work in the security industry and couldn't find technical specifics. You have more or less answered my question - thanks again! –  user1512591 Feb 5 '13 at 15:11
Apple used to have a page giving some of the above information, but I can't find it right now. –  Kirk McElhearn Feb 6 '13 at 6:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.