yarascanservice using 100gb of memory..

? Are you talking to me or someone else?

Lanny wrote:

Do you think that it is possible that it scans during the installation process then self deletes?

That's a good point. It might do that.

I've already diagnosed the issue and submitted a bug report via my developer account. There's no acceptable solution at this time, and I do not want to disable SIP and disable the service entirely.

It appears you have the antivirus, VirusTotal, installed. For additional information on this read https://www.reddit.com/r/MacOS/comments/8uo0qu/is_yarascanservice_eating_up_anyo ne_elses_ramcpu/

I sugest you uninstall it.

I have exactly the same problem following upgrade to release version of 10.13.6 yesterday. Like you I have no antivirus installed. I quit the service with 80Gb of memory being consumed. Waiting to see if it restarts. I was also altered to the fact by CleanMyMac 3.

Lanny wrote:

It seems clear that it is now a part of CoreServices

Well, maybe to you it does, but I have see no evidence that this is true.

Perhaps you have installed something like "Clean My Mac," and are not considering it as an anti-virus software.

A further data point. I never installed the infamous "cleanmymac" or any antivirus on my mac (in fact I've advocated against these tens, perhaps hundreds, of times on these forums).

I DO have this yaraservice on my mac running 10.13.6.

I just booted off a clone I made before updating from 10.13.4.

It is NOT there.

Since I updated directly from 10.13.4 to 10.13.6 (using the Combo update), I cannot say if this is new in 10.13.6 or if it appeared in 10.13.5, but I can say it is new, and is part of the system (I also never disabled SIP, for that matter).

What worked for me was emptying my Downloads folder. Apparently, yarascan checks the Downloads Folder after each restart. If the Downloads folder is full, yarascan will take time and resources to scan that folder. The amount of time yarascan runs is directly related to number of files in Downloads Folder. I had a bunch of archive files, installers, audio and video files in my Downloads folder, and yarascan ran about 8-10 minutes with each new restart. On a laptop running on battery, it generally used up 10% of battery before it finished scan. I completely emptied Downloads folder, and no more yarascan on startup. Emptying Download Folder will not remove yarascan from system. If I move files back into Downloads Folder and restart, yarascan will run on next restart. For, me (verified on 2 different machines), yarascan is directly related to files in Downloads Folder.