2

Recently on MacOS 10.13.6 I have noticed high CPU usage and identified the process YaraScanService as consuming close to 90% CPU.

The Activity Monitor lists it under:

/System/Library/CoreServices/MRT.app/Contents/XPCServices/YaraScanService.xpc/Contents/MacOS/YaraScanService

as part of the MRT.app.

According to this thread and another one it appears to be some kind of Apple's built-in antivirus that is doing its scanning yet there doesn't seem to be a way to disable or remove it apart from killing it from the Activity Monitor or with pkill.

Any pointers on how to control it or stop/disable it?

I would assume that if you have dozens of gigabytes of zip, tar, bzip, rar, jar archives then yarascan will unpack them all to memory or disc in order to scan them, and there is absolutely no way to whitelist or exclude them.

The MRT.app is timestamped on 10-Aug-2018 along with a bunch of other folders (apparently the date when I accepted an Apple update). Most files inside the folder are timestamped 4-Jul-2018 and 8-Jul-2018, supposedly when the app was released by Apple.

Improve this question

4 Answers 4

Reset to default
5

As mentioned in this article YaraScanService is part of the MRT.app (Malware Removal Tool). If you are sure your system is not infected with malware and you don't want Apple to do automatic malware protection for you without asking your consent, then you can disable and/or remove the MRT service using these commands:

sudo launchctl stop com.apple.mrt
sudo launchctl remove com.apple.mrt

The corresponding .plist files are apparently located at:

/System/Library/LaunchDaemons/com.apple.MRTd.plist
/System/Library/LaunchAgents/com.apple.MRTa.plist

If the above method does not work for you (apparently the daemon can re-enable itself), then a more radical approach would be to disable SIP with csrutil disable from recovery mode, and remove executable permissions on the MRT and YaraScanService files with:

chmod -R -x+X /System/Library/CoreServices/MRT.app

Once you have changed the permissions it is recommended to re-enable SIP again with csrutil enable (from recovery mode).

Improve this answer
2
  • For me it started to eat CPU so much I can't use my Mac for three days already. What I should do? stop and remove functions does nothing to it...
    – Gediminas
    Oct 23, 2018 at 7:50
  • 2
    I guess that if all other approaches fail then a brute force approach would be to disable SIP (support.accountek.com/support/solutions/articles/…), and remove executable permissions on the MRT and YaraScanService files i.e. chmod -R -x+X /System/Library/CoreServices/MRT.app. After that it's better to enable SIP again.
    – ccpizza
    Nov 3, 2018 at 10:36
3

Answer originally posted by user1901982 in Super User - What is “YaraScanService” that shows up in macOS Mojave Beta (10.14) and macOS High Sierra (10.13.6)?
Copied here for convenience, as community wiki.

MRT/YaraScan is a MacOS prodvided antivirus-copyright tool. The reason for it's obscene memory usage is basically why OSX doesn't have a formal 'antivirus'.

More simply, YaraScan is one part of the 'volatility suite' here; https://www.volatilityfoundation.org/about

Do realise that a virus and illegally pirated material both are only detected by a 'signature' set of code paths and both often reliant on bugs, exploits and weak patching, so it's only to be expected that the strongest modern antivirus was grown from a copyright infringement detection tool.

YaraScan runs once after Mojave update, and then deletes itself. The reason it uses so much memory is because unless otherwise programmed (as in it's an opt-out), a process that has to scan an incredible amount of file's contents for an unknown sized file that might be encrypted into said searched files will use a large amount of inactive memory to store all scanned files for a limited amount of time incase they are needed again. Why? Because empty RAM is wasted RAM, I mean you still have to give it watts so why delete the stuff on it when something else doesn't want to be there? It takes 100x longer to get it back.

More importantly, if you Filevault or APFS, some of that data is encrypted and must be decrypted to be read. Many apps actually need launching and then scanning when they are loaded as many files can come together to form a threat in memory space as a single 'concurrent file'. Standard antivirus could not detect this until the application was already running, and at that stage it could have already damaged your system.

The amount of time is actively decided by Grand Central Dispatch in your mac and as soon as you attempt to use a program that needs that RAM it will clear it.

Improve this answer
5
  • As always Apple gives users no other choice than take it or leave it. As a user I have no power of decision of what is running on my machine and why. I used to think that Apple's MacOS is not a walled garden as it is the case with iOS.
    – ccpizza
    Sep 18, 2018 at 10:54
  • You could always run Windows instead, with its weekly compulsory updates, or one of the heinz 57 varieties of nix, with the 'see if it works in this combination' approach. These days, the vast majority of users have not the faintest clue how their computer works, so long as they can haz their interwebz & farcebork... so the OS makers have to take steps to protect them from their own inability to keep their machines safe. You can opt out of that if you wish, but not without changing to a less newbie-friendly OS.
    – Tetsujin
    Sep 18, 2018 at 11:04
  • 1
    Of all the positive things you have said about YaraScanService, none of them are true in my case. It boots itself after an hour of startup; as reported by ActivityMonitor, it is consuming ~80GB of RAM; I have waited for it to finish but doesn't delete itself after the scan. Now, I can't work without the intervention of this crappy ware every time I use Mac. If the computer starts to lag, I know YaraScanService is doing some crap in the background and time for it to force kill. I really wish it was that easy to delete it.
    – mr5
    Jan 22, 2019 at 3:13
  • The part of this answer that deals with the reasons for "obscene memory usage" is basically false. There's nothing about macOS that means that antivirus programs must use more memory than on other systems. It's also not the case that a program absolute has to load files into inactive memory in order to scan "an incredible amount", nor is there anything special at all regarding memory usage when handling encrypted files. The idea that this amount of inactive memory talked about here actually is included in MRT.app's memory usage in Activity Monitor is also false. Finally, [...]
    – jksoegaard
    Apr 23, 2021 at 11:37
  • [...] the amount of time used is not actively decided by Grand Central Dispatch.
    – jksoegaard
    Apr 23, 2021 at 11:37
0

Recently, I upgraded an iMac from 10.12.6 to 10.13.6 and was experiencing many freeze ups, usually 6 or 7 minutes after start up. YaraScanServices was the culprit. But instead of disabling or trying to remove MRT, I found a solution from the internet to remove all files from my download directory and restart normally. This did the trick for me. Since I backed up all files prior to the upgrade on a remote disk, I was able to copy all the files back to the Download directory after the initial scan was able to complete. There is a risk that the unscanned files contain viruses, but that doesn't seem to be the case.

Improve this answer
0

"Having lived with 10.13.6 (as far as I could take my hw) and the nightmare of yarascanservice (using Automator to script a 'forced quit' of the service shortly after every start up), I also ran in to major issues being unable to install Security Updates (corrupting the OS - widely experienced, thanks Apple). I therefore had to avoid any aspect of auto-updating taking place, and may have over-tinkered with System Preferences. System Preferences / App Store - among the various options that I had defeated, a badly worded option is: 'Install system data files and security updates' I came across an article on tidbits explaining what function this option served, recommending to enable it (https://tidbits.com/2016/03/30/make-sure-youre-getting-os-x-security-data/). It appears that this enables updates to MRT (which drives yarascanservice). Despite the clumsy naming used, this does not cause major security updates to the main OS to occur - simply low level updates (similar to updating definitions in a virus application). I had this option disabled. Enabling it, and forcing the system to run these updates, I confirmed that new data had been downloaded (see link above for directions). Ever since (4 days ago), I haven't seen yarascanservice running. This may be coincidence, but I'm curious to determine if this has resolved a similar issue for others?"

--- Followed this. Worked for me. Enabled the "Automatically Check for updates" and "Install system data files and security updates" options under 'App Store' in 'System Preferences'. I don't see Yarascanservice after 2-3 days.

Improve this answer
1
  • Where is this from. Do you have the l right to copy it all without attribution m?
    – mmmmmm
    Apr 23, 2021 at 10:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .