How to optimize memory usage when dealing with XProtectRemediatorSheepSwap on Mac

Today the process XProtectRemediatorSheepSwap started using high amounts of memory. It will start at around 2GB and then will keep climbing until it reaches 20 or 30GB at which point the mac will become completely unusable.

A malware scan found nothing. I ran XProCheck but the log says NoThreatDetected for Sheep Swap. I tried rebooting but after a couple of minutes the process returns again.

Any tips/ideas would be appreciated.


[Re-Titled by Moderator]

iMac (2017 – 2020)

Posted on Feb 10, 2024 9:16 PM

Reply
Question marked as Best reply

Posted on Feb 10, 2024 9:55 PM

CleanMyMac is a problem. It should be removed by the uninstaller provided by MacPaw. These types of apps will conflict with the normal operation of your OS:

  • Cleaners
  • Optimizers
  • Anti-Virus
  • VPN


Any third party process that runs at startup on your system has the potential to conflict with the scans that XProtect does for Malware detection. A more useful tool to determine what is being launched on startup and Kernel Extensions that could be causing a conflict is EtreCheck. You can post the free report here using the Additional Text option when posting. This should be done after removing any of the apps in the above list.

Using EtreCheck - Apple Community

Similar questions

50 replies

Feb 19, 2024 5:28 PM in response to cuervo7

Hey cuervo7, cheers for the notification about the installation update. I normally check daily with anticipation regardless but since you mentioned it I did look first thing this morning and saw there was an update. Hopefully this is what my computer is needing so will see how I go. But to avoid disappointment I am not holding my breath. I will keep you posted. Good luck to me 😄.

Mar 2, 2024 7:47 AM in response to cuervo7

Well, after laying low for 2 weeks the issue is back in full force since yesterday. It was only popping up once a week but now it’s multiple times a day again. ☹️ Tried everything I could think of at this point including a clean install, which made no difference (and no, I did not restore a time machine backup after the clean install. The issue also occurred on a totally vanilla install. Maybe it’s some sort of hardware issue after all? idk at this point)

Mar 4, 2024 4:04 AM in response to cuervo7

Not sure if people are still experiencing this issue but I finally did another clean install. As of last week the XProtectRemediatorSheepSwap whilst running was killing my computer and was running all day to a point if my computer went to sleep it could not wake up without shutting down and getting the message 'Your computer shut down because of a problem' constantly. I did a clean install for the second time and for the last 3 days I have had no issues at all. The first time I did but this time I didn't. I am slowly but surely adding all my files back along with apps. In fact I don't even get the dreaded XProtectRemediatorSheepSwap coming up at all and I have been monitoring this with Activity Monitor open. I haven't completely put everything back on my computer but slowly but surely I am building everything back up. Is it annoying to do this yes because of the time it is taking but compared to what I was putting up with, it is definitely the better option.


So for those that are still having this issue I want to confirm everything I tried before I did the clean install to no avail.


macOS Ventura 13.6.4

Closed all apps so no apps were running - no difference

Booted in Safe Mode - No difference.

Logged in under another user - No difference.

Did a re-install - No difference

All apps were up to date - No difference.

Removed AVG anti-virus - No difference.

Toggled 'Install Security Responses and system files' off - No difference

Did PRAM/NVRAM/SCM - No difference

Tried going back to another Time Machine date - No difference

Tried to do a hardware diagnostics test - Couldn'tt do it which turned into another headache so left that one alone quick smart.

Did a clean install which didn't seem to work the first time but was desperate enough to try it a second time. As Luis Seequeira1 pointed out, doing a restore from backup brings issues back so decided to give it another crack. Voila, computer is running smoothly for the 5th day in a row.


So on that note, good luck with anybody trying all the methods I tried above before doing a clean install. For me everything simply was not working. Glad I tried the clean install again knowing the pain I was going to endure but it was worth it in the end 😉. If it starts to go pear shaped again I will be sure to post it here. Good luck everybody. 👍🏻

Mar 4, 2024 8:51 AM in response to Luis Sequeira1

So, if reverting to a previous version helps, good, but it is only a temporary fix (and may leave you open to possible vulnerabilities fixed in the subsequent versions).


True. This is a problem Apple should fix asap and rolling back to an old version of XProtect is far from ideal. It's just that I'm basically at my wits' end right now. Like tobwise, I've tried a clean install (no backups restored or any 3rd party apps installed) and even then the problem persisted.

Mar 4, 2024 9:08 AM in response to cuervo7


True. This is a problem Apple should fix asap and rolling back to an old version of XProtect is far from ideal. It's just that I'm basically at my wits' end right now. Like tobwise, I've tried a clean install (no backups restored or any 3rd party apps installed) and even then the problem persisted.

In any case, I hope the issue gets resolved for you. I am also on version 126 without a problem, so there is something else going on there causing a conflict for a small number of users or a combination of the version and OS since I am on Sonoma. It appears the tobwise was finally able to resolve the problem with a clean install and I'm sure an update on the progress of installing apps will be provided. Not sure why you experienced the same issue after clean install.

Mar 4, 2024 12:28 PM in response to Mac Jim ID

I hope so too. It's weird such a small number of user seem to be affected. The issue has been reported by Sonoma users as well so it's not exclusive to Ventura.

When tobwise first did a clean install it also did not solve the problem. It's nice to hear they don't have the issue now but then again, I also rarely had a hiccup for nearly two weeks until 2 days ago, without a clean install. I've tried to discern a pattern, but alas, no luck. If anything, it's the randomness that's driving me up the wall. 😅



Mar 4, 2024 5:33 PM in response to Mac Jim ID

Mac Jim ID wrote:



In any case, I hope the issue gets resolved for you. I am also on version 126 without a problem, so there is something else going on there causing a conflict for a small number of users or a combination of the version and OS since I am on Sonoma. It appears the tobwise was finally able to resolve the problem with a clean install and I'm sure an update on the progress of installing apps will be provided. Not sure why you experienced the same issue after clean install.

In the end it was happening as soon as my computer was starting up so it was instant, that's when I knew I had to try everything. Will definitely keep monitoring and report. Still no sign of the culprit which is good but I will give it another week at least just in case I spoke to soon.


Thanks cuervo7 for posting the other thread, interesting read because they were all the symptoms I had. The sad part was I was going to take my computer in to have it looked at. Imagine that! I would have paid money to possibly have no fix thinking my only option was to get a new computer!! I suppose all we can do is report it to Apple and hopefully it will eventually be resolved. The problem is.....but when?

Mar 6, 2024 6:32 AM in response to cuervo7

cuervo7 wrote:

Well, there's another update to XProtect. Let's see if that does anything. 😅


I'd never had this problem or even heard of it until this morning. I had left Activity Monitor open last night, and when my MPB (M1, 32GB) woke this morning my memory was pegged. I'd never heard of "XProtectRemediatorSheepSwap" and assumed the worst. Fortunately I grabbed a few screen shots, because within 30-40 seconds, the process stopped and my memory usage dropped to half. SheepSwap was "only" using 18GB, but still. I don't know if I just got lucky, or if the new version is designed to do work when the computer is idle and back off when in use, but I'm not excited about the prospect of dealing with all the issues in this thread. At any rate, hope this is a useful datapoint to someone.

Mar 6, 2024 7:48 AM in response to Jason Clark

Jason Clark wrote:

I'd never had this problem or even heard of it until this morning. I had left Activity Monitor open last night, and when my MPB (M1, 32GB) woke this morning my memory was pegged. I'd never heard of "XProtectRemediatorSheepSwap" and assumed the worst. Fortunately I grabbed a few screen shots, because within 30-40 seconds, the process stopped and my memory usage dropped to half. SheepSwap was "only" using 18GB, but still. I don't know if I just got lucky, or if the new version is designed to do work when the computer is idle and back off when in use, but I'm not excited about the prospect of dealing with all the issues in this thread. At any rate, hope this is a useful datapoint to someone.

Unfortunately I think everybody experiencing the issue has been caught out by it. On the occasion I would get Time Machine backing up on my computer rather than the external drives I have as my back up drives and whenever I experienced severe issues, it would be that due to no storage space left on my computers drive (1TB). I would then have to delete the snapshots for it to normalise. I was thinking it was that but when I checked my storage I still had 400GB left so wasn't that. When I checked Activity Monitor to see what it could be, the XProtect issue stuck out like a sore thumb. I had never heard of it and it looked suss so when I looked into it I found out it was Apples anti-virus/malware app. My computer was red lining out of control and I hate to say it, it was running during the day whilst I was trying to work. If you get it whilst you are not working that is a bonus but I don't want to give you false hope that it will continue like that. When it stops it normalises but sometimes it would fire up about 10 minutes later. So annoying. My computer is still running fine after a second clean install so all good on that front, but we shouldn't have to be doing that for something Apple has clearly created and not finding a fix in a hurry. I had it for 2 weeks every day and couldn't stand it anymore which lead to the second try at the clean install. Hopefully it won't come to that for you but I suppose be prepared for it if Apple doesn't find a fix soon. Good luck.

Mar 6, 2024 1:27 PM in response to Jason Clark

Jason Clark wrote:

because within 30-40 seconds, the process stopped and my memory usage dropped to half. SheepSwap was "only" using 18GB, but still. I don't know if I just got lucky, or if the new version is designed to do work when the computer is idle and back off when in use

There was another XProtect update yesterday and since then I have seen the same behaviour. Just a few seconds of high memory usage by the SweepSwap process. Let's hope it stays that way.

Xprotect is supposed to mostly scan during periods of low user activity but even then it should not use multiple gigs of memory. When it is working as it should, you shouldn't even notice it.

Mar 29, 2024 6:15 PM in response to Mac Jim ID

Mac Jim ID wrote:

In any case, I hope the issue gets resolved for you. I am also on version 126 without a problem, so there is something else going on there causing a conflict for a small number of users or a combination of the version and OS since I am on Sonoma. It appears the tobwise was finally able to resolve the problem with a clean install and I'm sure an update on the progress of installing apps will be provided. Not sure why you experienced the same issue after clean install.

Not sure if people are still experiencing this issue (hope not) but if so I thought I would give an update after my second clean install attempt. My computer is still running fine after 4 weeks with no sign at all of the XProtectMediaSheepSwap at all popping up in activity monitor, nor is my computer suffering from severe drop in RAM usage. I have installed all but a few minor apps with no issues at all however one thing of interest was one app in particular was a purchased video conversion app called Prism. I could use this no problem previously however when I introduced this app and tried to open it, I did receive a message stipulating that the version I had could not be run with the version of Ventura I had, which was the same version of macOS I had before. Naturally it asked me to purchase the latest version since it wouldn't open up at all. I have it on my older MacBook which still runs fine and I don't use it a **** of a lot so have not reinstalled or purchased the latest version. I have had this issue in the past where one old outdated app was bogging my computer down years ago even if it wasn't open or being used. So upon saying that, not sure if that was the issue but who knows. Anyways, that's my update for anybody still having issues. There have been a couple of macOS updates since so with any luck the issue has been addressed and you shouldn't have to worry about high memory usage.

How to optimize memory usage when dealing with XProtectRemediatorSheepSwap on Mac

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.