What is "YaraScanService" and why does it hog all my RAM?

Thanks for confirming that this is part of the apparently optional Apple installation of the 10.13.6 update. I can't complain about the scans on my computer. From what I can see it ran for a while, reached the preset limit of 90 seconds CPU and then stopped. I don't know how much RAM it used, but I was not doing much on the computer at the time.

Thank you so much for your comment about the downloads folder. I had contacted apple support. They tried to disable the app but couldn't. I took your comment and created a new folder with a different name and moved all files from the download folder to it. Restarted and no more YaraScanService. My downloads folder had downloads from years and many GB. Apparently the update started scanning all files instead of just new files. It would only affect users with large accumulations of files.

What worked for me was emptying my Downloads folder. Apparently, yarascan checks Downloads Folder after every restart. If the Downloads folder is full, yarascan will take time and resources to scan that folder. The amount of time yarascan runs is directly related to number of files in Downloads Folder. I had a bunch of archive files, installers, audio and video files in my Downloads folder, and yarascan ran about 8-10 minutes with each new restart. On a laptop running on battery, it generally used up 10% of battery before it finished scan. I completely emptied Downloads folder, and no more yarascan on startup. Emptying Download Folder will not remove yarascan from system. If I move files back into Downloads Folder and restart, yarascan will run on next restart. For, me (verified on 2 different machines), yarascan is directly related to files in Downloads Folder.

Yara scan service is in my XPC Services folder

It runs at startup on my MacBook pro even after emptying download folder.

It only runs for a few seconds

It does not cause any problems with CPU or RAM

It was installed automatically when I recently updated Mavericks to 10.13.6

I do not have any antivirus software installed.

Hope this helps

I did not mean to imply that yarascan does not run at all if Downloads folder is empty. Yarascan will run momentarily at startup, but if Downloads folder is empty, shuts right down again, having no significant impact on RAM or processor usage.

You don't remove it. Just move files out of your Downloads folder.

This yaraservice will scan your Downloads folder every time; if you, like many people, keep thousands of files in there, basically anything and everything you ever downloaded, it will take ages. File them away somewhere else, and the problem disappears.

Sweejak wrote:

If you go to /System/Library/CoreServices/MRT.app/ and click Show packages it is under XPCServices.

Same here, no XPCServices.

MacBook Pro (Retina, 13-inch, Mid 2014) macOS 10.13.6 (17G65)

MRT.app version 1.35 , created 14 June 2018 at 02:02, modified 20 June 2018 at 19:03

Yep, I think too it looks encouraging, indeed.

See you soon

See this post I put on another thread:

Link to this post

See this post I put on another thread:

Link to this post

Nothing different there. Some people have an XPCService installed and some do not.

Hi,

Yara is an open source component of a lot of antivirus software. What is your antivirus?

Regards.

I just read somewhere that it was going to be included as a standard component in macOS Mojave ... that sounds promising .... 😁

Avira?