How to optimize memory usage when dealing with XProtectRemediatorSheepSwap on Mac

First, there is no reason to ever install or run any 3rd party "cleaning", "optimizing", "speed-up", anti-virus, VPN or security apps on your Mac.  This documents describe what you need to know and do in order to protect your Mac: Effective defenses against malware and other threats - Apple Community and Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support.  

There are no known viruses, i.e. self propagating, for Macs.  There are, however, adware and malware which require the user to install although unwittingly most of the time thru sneaky links, etc.   

Anti Virus developers try to group all types as viruses into their ad campaigns of fear.  They do a poor job of the detecting and isolating the adware and malware.  Since there are no viruses these apps use up a lot of system resources searching for what is non-existent and adversely affect system and app performance.

There is one app, Malwarebytes, which was developed by a long time contributor to these forums and a highly respected member of the computer security community, that is designed solely to seek out adware and known malware and remove it.  The free version is more than adequate for most users.  

Unless you're using a true VPN tunnel, such as between you and your employer's, school's or bank's servers, they provide false security from a privacy standpoint.  Read these two articles: Public VPN's are anything but private, Former Malware Distributor Kape Technologies Now Owns a Number of Public VPNs and a Collection of VPN “Review” Websites and Security Risks: The Dangers of Using Free VPNs (eccu.edu)

You can check to see if you've removed all of the supporting files by downloading and running the shareware app Find Any File to search for any files with the application's or the developer's name in the file name.  For the Gemini and ExpressVPN software you'd do the following search(es): 

1 - Name contains gemini

2 - Name contains expressvpn

Any files that are found can be dragged from the search results window to the Desktop or Trash bin in the Dock for deletion.

FAF can search areas that Spotlight can't like invisible folders, system folders and packages.  

If you get warnings that the file can't be deleted because it is in use or used by another app boot into Safe Mode according to How to use safe mode on your Mac and delete from there.

Note:  if you have a wireless keyboard with rechargeable batteries connect it with its charging cable before booting into Safe Mode.  This makes it act as a wired keyboard as will assure a successful boot into Safe Mode.

You also have some Samsung Portable SSD Software installed although you don't show a Samsung drive connected. If you're using the Samsung as a normal external HD the software that a came with it is not needed and can often interfere with the system's drive management. I would recommend you uninstall it according to the developer's instructions.

Computer just crashed but computer running fine at the moment. I just did a EtreCheck however my computer was running nicely so I will wait for it to drop in memory and will do another and post. Just to confirm, I only have the degraded Ram issue when XProtect Remediator is running. When it stops, my computer normalises.

Hey Luis Sequeira1, in all honesty I was toying with the idea of doing this and it has been in the back of my mind for the last couple of days so your suggestion has triggered the thought into a reality 😁. I went ahead and uninstalled it and monitored it for an hour but unfortunately no luck, same thing. Just on another idea that was suggested to me, create another user and log in under that user and see if the problem still occurs. Surprise surprise, no change, still maxing out on the high pressure memory. Thanks for the idea though as at this point I am prepared to try anything.

You may want to try doing a clean install.

There are a number of system modifications, some of them apparently rather old.

At some point there could be issues when old system modifications are not fully compatible with a newer OS.

After I did the clean install it still had the same issue, I then migrated my Time Machine backup after I realised it was still no good. I am going to have another go it again and see if it works a second time round. I am not holding my breath but hey, stranger things have happened right? Will keep you posted.

For sure 😄. I am finding myself eagerly waiting for updates now purely based on your comment on hoping it gets resolved. As for the old 200- mac, that's getting desperate however it will probably run better than what you are using now. 😜

I am just doing a bit of work now whilst my computer is behaving (which is rare). Will do the clean install again tomorrow.

Please do let me how you go. 👍🏻

Like wise, thanks for the update. Sounds like you are having some luck also which is good to hear. My computer is still running OK so that is a record considering the last 7 days. Glad to hear the old 09 mac can stay in storage. 👍🏻

I will do the same if anything pops up too.

Take it easy.

It's back. 😡😡 This time it was as soon as I turned my computer on it was red lining as soon as items started logging in. Checked Activity Monitor and sure enough it was the dreaded XProtectRemediatorSheepSwap that was the culprit. I had to wait nearly an hour for it to stop. Now it has stopped running, my computer is now functioning as normal. I have done a 'Report an issue' through the Apple website about what is happening and anyone else having the same problem should do the same in case it is definitely something that is happening their end. Naturally not expecting a response because the purpose is just to report it, not get technical support. Will see what comes of it but this is getting annoying now. Somehow I don't think a clean install is going to resolve this, not unless someone can shed light that it may be my computer that is causing it instead of Apple installations/software etc. I ca't see it being a hardware issue since everything runs like it was when the XProtect thingy is not running.

Yeah I know! At least it was only once which was first thing in the morning and it has been OK for the rest of the day which is something. I work fully expecting it to start overloading at any moment whilst trying to finish a job, so annoying. Glad to hear your computer is running nicely so hopefully it stays that way. I wouldn't have thought it was a hardware issue either but would love for it to magically go away. 😁

Unfortunately not. Had it twice this morning for about 45 minutes each time. I might try the clean install again over the weekend, getting desperate now, either that or wait it out for an update that may never come 😉. Will have to think about that a little longer. Glad to hear yours is doing well so a win for you 👍🏻.