What is "YaraScanService" and why does it hog all my RAM?

Eeeeeek 😟

I don't have the YaraScanService XPC on any of my machines or any of my VMs. Maybe this is some kind of A/B test that Apple is running.

It is reported (rather massively) (and not in the most polite terms) in Mojave beta.

Personally I haven't it on my system, either.

Yep, I think too it looks encouraging, indeed.

See you soon

.

(it is in next OS Mojave, definitely...).

(or not).

I sincerely hope not...

But you know "once bitten, twice shy" 😁

I think that is just an informational report. It doesn't actually kill the process.

I also have a MacBook Pro. And I am getting a YaraScanService memory hog. Has anyone tried to remove it?

Indeed. No need another thread.

quote: "Some people have an XPCService installed and some do not."

Yup, but YaraScanService, the main problem here, seems to be (only?) present in /System/Library/CoreServices/MRT.app' XPCServices folder. The ones who haven't a XPCServices folder at this location haven't YaraScanService wallowed in their memory (to my knowledge) (we need others to comment about that).

I assume (until somebody proves me the contrary by pictures showing it elsewhere) that YaraScanService exists only at this location. Therefore, only the systems having XPCServices/YaraScanServices.xpc in their MRT.app can see YaraScanService process eating all their memory. Which may cause problem (or not, actually, but such huge consumption is abnormal in any case).

quote from the Net: "XPC is a technology for cross-process communication. It basically defines a way 2 running processes can talk to each other."

It seems to me obvious, like you, that a process that needs to "talk" with macOS' integrated Malware Removal Tool could only be or an antivirus, or a virus...

There are some misunderstandings going on in this thread, so let me try to clarify a few points:

1) Unless the user disables SIP, no software is allowed to install inside /System, and in particular inside/System/Library

2) This yaraservice thing is part of the system and not due to some third party antivirus

3) Having it, or xpc, does NOT mean it hogs the cpu.

FWIW, I have never installed any antivirus, I have yaraservice (though, as is clear from my previous post, I never even knew what it was until this thread), and it is not hogging my cpu.

I'm not sure that being a 'advanced' user helps much. Most of the advanced users I encounter here are so resigned by decades of servitude at rowing in macOS' galleys that they accept all the new slaps of their Master without moving one of their (bruised) ears.

New slaps like this one, for instance, or much better yet, yet another memory hog that is linked, it, to Apple Photo, the 'photoanalysisd' process. That thing spends all its time at accomplishing before your appalled eyes, at the price of around 120 to 200% of your CPU charge, this so marvelous "new feature" in macOS (hold your breath...): "Searching for Faces and objects in your photos" (= among your 97384+ photos...) (and consequently eats all your RAM for breakfast...)

This OS make us all live since decades in the House of the Mad Hatter, all this is totally nutcase, and more tragic yet, this is not professional.

I have the certainty that almost everybody here has bought his/her Macintosh ONLY, precisely, for working with. Not for counting sheeps on his/her family photos and the number of flower vase in his/her kitchen. That deep, dramatic, and persistant misunderstanding of the (real) 'expected behaviour' of the vast majority of Mac users is an absolute shame.

Additionally, I still don't know how they expect to make live in parallel 'YaraScanService' and 'photoanalysisd' on our systems but it promises to be dantesque.

As for removing it / solving this problem, I really don't know. If it is REALLY included deliberately by Apple in MRT.app, in Mojave and most recent updates of High Sierra (and if it is not some nasty virus that has taken its masquerade costume) we are doomed to see it reappear at every update...