I had significant lag after upgrading from OS Yosemite to OS High Sierra this week, and as I sought the source, I noticed YaraScanService was working overtime in my Activity Monitor.
That is what led me to this post.
What I read in the original post caused me concern initially, as I'm sure it will for others, but what I failed to do at that point in time was to step back and ask myself why this was the only post regarding YaraScan in all of Apple discussions.
It seems a fair, and important, question to consider.
Also, I should have taken note that one of the recommended "fix" posts suggests using the "control" key to boot up in Safe mode, which is not how you boot up in safe mode. Apple uses the "command" key to boot up in safe mode, not "control." While this may be dismissed as a semantical matter by some, for those using keyboards that include a proper Apple "command" key, the difference is rather important. The result of holding "control-alt-R" at startup on a proper Apple keyboard accomplishes nothing but a standard startup.
Regardless of whether the YaraScanService activity was causing my computer to lag, I wanted the lag gone. So, I decided to go ahead and erase my drive and do a clean install of High Sierra in Recovery mode. Once the install was complete, I restored all my content using Time Machine (all the same applications and docs as before, nothing left out). At first, my Activity Monitor showed a lot of "mdworker" and "mds" scanning going on, but that was just Spotlight doing it's thing. If YaraScanService was busy at the same time, I didn't notice it in the Activity Monitor, and I haven't noticed it since. I left the system to do it's thing overnight, and today I still haven't noticed any YaraScanService activity.
The lag I meant to eliminate, however, returned despite the clean install.
And … I have since discovered the true source of that ridiculous lag — The Magic Mouse.
In fact, it was the two-finger swipes I was using to switch between full-screen apps that caused all that trouble after upgrading to High Sierra. Someone else will have to explain why. Perhaps this 2011 mouse isn't compatible. All I know is that every time I swiped with two fingers on the mouse, the whole computer got bogged down in a lag that lasted 20 seconds or more. The mouse would move the cursor, but that's all. Clicking accomplished nothing. After 20 seconds or more, the screen would finally swipe to the next desktop. After that, although the lag diminished, it remained, and it would worsen if I did the two-finger swipe again.
The fix was easy — I disabled the mouse's swipe setting in System Preferences (System Preferences>Mouse>More Gestures).
The result: No more lag in OS High Sierra.
As for the YaraScanServices issue, from what I've read elsewhere, I'm inclined to agree with michelbinkhorst.
It seems a bad idea to start messing around with MRT based on one post. Granted it's recent, but this is the one and only post that comes up when you search Apple discussions for "yarascan." So, it's only responsible to ask, if malicious malware is currently exploiting Apple's use of YaraScanService, why haven't more Apple users posted about it?
I don't intend to insult or dismiss or negate anyone's point of view on this. It may well be that there's something to worry about with regard to the "YaraScanService" activity I and others have noticed. But it seems only prudent to first obtain official verification from Apple about that problem before mucking around with MRT in the OS.
