How to optimize memory usage when dealing with XProtectRemediatorSheepSwap on Mac

CleanMyMac is a problem. It should be removed by the uninstaller provided by MacPaw. These types of apps will conflict with the normal operation of your OS:

• Cleaners
• Optimizers
• Anti-Virus
• VPN

Any third party process that runs at startup on your system has the potential to conflict with the scans that XProtect does for Malware detection. A more useful tool to determine what is being launched on startup and Kernel Extensions that could be causing a conflict is EtreCheck. You can post the free report here using the Additional Text option when posting. This should be done after removing any of the apps in the above list.

Using EtreCheck - Apple Community

Not sure if people are still experiencing this issue but I finally did another clean install. As of last week the XProtectRemediatorSheepSwap whilst running was killing my computer and was running all day to a point if my computer went to sleep it could not wake up without shutting down and getting the message 'Your computer shut down because of a problem' constantly. I did a clean install for the second time and for the last 3 days I have had no issues at all. The first time I did but this time I didn't. I am slowly but surely adding all my files back along with apps. In fact I don't even get the dreaded XProtectRemediatorSheepSwap coming up at all and I have been monitoring this with Activity Monitor open. I haven't completely put everything back on my computer but slowly but surely I am building everything back up. Is it annoying to do this yes because of the time it is taking but compared to what I was putting up with, it is definitely the better option.

So for those that are still having this issue I want to confirm everything I tried before I did the clean install to no avail.

macOS Ventura 13.6.4

Closed all apps so no apps were running - no difference

Booted in Safe Mode - No difference.

Logged in under another user - No difference.

Did a re-install - No difference

All apps were up to date - No difference.

Removed AVG anti-virus - No difference.

Toggled 'Install Security Responses and system files' off - No difference

Did PRAM/NVRAM/SCM - No difference

Tried going back to another Time Machine date - No difference

Tried to do a hardware diagnostics test - Couldn'tt do it which turned into another headache so left that one alone quick smart.

Did a clean install which didn't seem to work the first time but was desperate enough to try it a second time. As Luis Seequeira1 pointed out, doing a restore from backup brings issues back so decided to give it another crack. Voila, computer is running smoothly for the 5th day in a row.

So on that note, good luck with anybody trying all the methods I tried above before doing a clean install. For me everything simply was not working. Glad I tried the clean install again knowing the pain I was going to endure but it was worth it in the end 😉. If it starts to go pear shaped again I will be sure to post it here. Good luck everybody. 👍🏻

Doing a Clean Install is ideal to resolve the problem once and for all. When installing the apps, verify the operation to isolate any particular app that may be causing the problem. Some apps noted in the EtreCheck report that are launching files on launch may be suspect:

• AdBlockVPNMacOSProvider
• ExpressVPN
• 1Password 7 - This version is not longer supported by AgileBits. Not sure if you have updated, but version 7 is showing as launching on startup. It was also noted in that it crashed at the end of the EtreCheck.

If you are able to identify an app that causes the problem, please reply with your findings as this is an issue that has affected other users as well.

tobwise wrote:

Already did that but unfortunately the same problem reared its ugly head within a couple of hours.

When you say you did that, did you by any chance migrate everything after the clean install? Lots of people do that, not realizing that once you migrate everything, you get back to where you started.

The report that you posted certainly does not look anything like a clean install.

To actually do a clean install, you should ONLY migrate the user accounts, nothing else; then see how things go while gradually installing only the applications that you do need and use.

I'd start by uninstalling AVG. There is absolutely no need to use any third party "antivirus", and in fact they hinder performance and conflict with system security - which is quite possibly what is happening here...

tobwise wrote:

I reinstalled the operating system with no change and then did a complete clean reinstall the other day and made no difference.

After the clean install, did you verify the XProtect process was still consuming resources, or did you check it after restoring from a backup?

You can also run the free EtreCheck report and compare to the report provided by the OP to see if there are any common files that could be causing the problem.

Using EtreCheck - Apple Community

cuervo7 wrote:

Just found out someone posted a workaround here XProtect Remediator taking 120% RAM freez… - Apple Community

I think that confirms it's a bug in XProtect.

It's possible.

This of course is a very serious problem, but it affects only a small minority of users, so there must be some conjugation of factors at play. FWIW, I have version 126, as do most users. Just imagine the outcry if everybody (or, say, even 10% of users) were having this very nasty problem.

So, if reverting to a previous version helps, good, but it is only a temporary fix (and may leave you open to possile vulnerabilities fixed in the subsequent versions).

Mac Jim ID wrote:

In any case, I hope the issue gets resolved for you. I am also on version 126 without a problem, so there is something else going on there causing a conflict for a small number of users or a combination of the version and OS since I am on Sonoma. It appears the tobwise was finally able to resolve the problem with a clean install and I'm sure an update on the progress of installing apps will be provided. Not sure why you experienced the same issue after clean install.

Not sure if people are still experiencing this issue (hope not) but if so I thought I would give an update after my second clean install attempt. My computer is still running fine after 4 weeks with no sign at all of the XProtectMediaSheepSwap at all popping up in activity monitor, nor is my computer suffering from severe drop in RAM usage. I have installed all but a few minor apps with no issues at all however one thing of interest was one app in particular was a purchased video conversion app called Prism. I could use this no problem previously however when I introduced this app and tried to open it, I did receive a message stipulating that the version I had could not be run with the version of Ventura I had, which was the same version of macOS I had before. Naturally it asked me to purchase the latest version since it wouldn't open up at all. I have it on my older MacBook which still runs fine and I don't use it a **** of a lot so have not reinstalled or purchased the latest version. I have had this issue in the past where one old outdated app was bogging my computer down years ago even if it wasn't open or being used. So upon saying that, not sure if that was the issue but who knows. Anyways, that's my update for anybody still having issues. There have been a couple of macOS updates since so with any luck the issue has been addressed and you shouldn't have to worry about high memory usage.

You may want to try doing a clean install.

There are a number of system modifications, some of them apparently rather old.

At some point there could be issues when old system modifications are not fully compatible with a newer OS.

Hey cuervo7, not sure if you got around to doing your clean install but if you haven't, check to see if you are still getting the issue. I backed everything up before I went to bed last night ready to do the clean install today. I left my computer on all night whilst it backed up and was fully expecting for my computer to have a complete melt down when I woke it up, but to my surprise it opened up immediately but wasn't holding my breath. Usually my computer shuts down and restarts because the memory runs out completely and it can't handle the wake up. So basically I thought I would do some work until the first signs of any slow down. That was going to be my green light to start the install. My computer had a wobble for about 5 minutes this morning but only once instead of 10x plus. So far it has been functioning the way it used to all day so I was reluctant to do the clean install until I it happened again. So far so good with no issues which is weird considering the issues I have been having. I checked the 'Installations' section in System Report and noticed there was an update for XProtectRemediatorSheepSwap on Feb 13th (yesterday for me as it is the 14th here) so not sure if that could be an update that was needed. As of writing this post I still have not had any issues. I just hope I haven't jinxed it now. 😄

Jason Clark wrote:

I'd never had this problem or even heard of it until this morning. I had left Activity Monitor open last night, and when my MPB (M1, 32GB) woke this morning my memory was pegged. I'd never heard of "XProtectRemediatorSheepSwap" and assumed the worst. Fortunately I grabbed a few screen shots, because within 30-40 seconds, the process stopped and my memory usage dropped to half. SheepSwap was "only" using 18GB, but still. I don't know if I just got lucky, or if the new version is designed to do work when the computer is idle and back off when in use, but I'm not excited about the prospect of dealing with all the issues in this thread. At any rate, hope this is a useful datapoint to someone.

Unfortunately I think everybody experiencing the issue has been caught out by it. On the occasion I would get Time Machine backing up on my computer rather than the external drives I have as my back up drives and whenever I experienced severe issues, it would be that due to no storage space left on my computers drive (1TB). I would then have to delete the snapshots for it to normalise. I was thinking it was that but when I checked my storage I still had 400GB left so wasn't that. When I checked Activity Monitor to see what it could be, the XProtect issue stuck out like a sore thumb. I had never heard of it and it looked suss so when I looked into it I found out it was Apples anti-virus/malware app. My computer was red lining out of control and I hate to say it, it was running during the day whilst I was trying to work. If you get it whilst you are not working that is a bonus but I don't want to give you false hope that it will continue like that. When it stops it normalises but sometimes it would fire up about 10 minutes later. So annoying. My computer is still running fine after a second clean install so all good on that front, but we shouldn't have to be doing that for something Apple has clearly created and not finding a fix in a hurry. I had it for 2 weeks every day and couldn't stand it anymore which lead to the second try at the clean install. Hopefully it won't come to that for you but I suppose be prepared for it if Apple doesn't find a fix soon. Good luck.

First, there is no reason to ever install or run any 3rd party "cleaning", "optimizing", "speed-up", anti-virus, VPN or security apps on your Mac.  This documents describe what you need to know and do in order to protect your Mac: Effective defenses against malware and other threats - Apple Community and Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support.  

There are no known viruses, i.e. self propagating, for Macs.  There are, however, adware and malware which require the user to install although unwittingly most of the time thru sneaky links, etc.   

Anti Virus developers try to group all types as viruses into their ad campaigns of fear.  They do a poor job of the detecting and isolating the adware and malware.  Since there are no viruses these apps use up a lot of system resources searching for what is non-existent and adversely affect system and app performance.

There is one app, Malwarebytes, which was developed by a long time contributor to these forums and a highly respected member of the computer security community, that is designed solely to seek out adware and known malware and remove it.  The free version is more than adequate for most users.  

Unless you're using a true VPN tunnel, such as between you and your employer's, school's or bank's servers, they provide false security from a privacy standpoint.  Read these two articles: Public VPN's are anything but private, Former Malware Distributor Kape Technologies Now Owns a Number of Public VPNs and a Collection of VPN “Review” Websites and Security Risks: The Dangers of Using Free VPNs (eccu.edu)

You can check to see if you've removed all of the supporting files by downloading and running the shareware app Find Any File to search for any files with the application's or the developer's name in the file name.  For the Gemini and ExpressVPN software you'd do the following search(es): 

1 - Name contains gemini

2 - Name contains expressvpn

Any files that are found can be dragged from the search results window to the Desktop or Trash bin in the Dock for deletion.

FAF can search areas that Spotlight can't like invisible folders, system folders and packages.  

If you get warnings that the file can't be deleted because it is in use or used by another app boot into Safe Mode according to How to use safe mode on your Mac and delete from there.

Note:  if you have a wireless keyboard with rechargeable batteries connect it with its charging cable before booting into Safe Mode.  This makes it act as a wired keyboard as will assure a successful boot into Safe Mode.

You also have some Samsung Portable SSD Software installed although you don't show a Samsung drive connected. If you're using the Samsung as a normal external HD the software that a came with it is not needed and can often interfere with the system's drive management. I would recommend you uninstall it according to the developer's instructions.

I too have been having this problem except mine peaks out to above 105GB, yes you read that correctly. I have 32GB of RAM and it drops to under 1GB. I even closed every app so no apps were open at all and my memory usage was still red lining to a point my computer was unusable. It then magically goes back to normal levels for about an hour or 2 but goes straight back to bogging down my machine for about an hour. I do not have CleanMyMac or any other app that cleans anything. I did a deep malware/virus scan which came up empty. All apps are up to date. I have introduced reopening apps one at a time and made no difference. Rebooted in Safe Mode but the problem still persisted. I restricted Login Items which again made no difference. I reinstalled the operating system with no change and then did a complete clean reinstall the other day and made no difference. I would also like to point out that this started instantly as of last week. I am trying to work out if this is an Apple thing or my computer is time to be replaced even though it is only 5 years old. It did coincide with a Software Update for macOS. I have searched all over the internet and the only peoples advice I am reading is either saying 'that this is normal' or do a clean install. Trust me, there is nothing normal about this and it ain't any old apps.