XProtect: the Mac's built-in antivirus, and how to check your Mac for malware

What XProtect does

XProtect is part of macOS and can't be installed, opened or turned off from System Settings. It has two parts:

• XProtect checks an app against Apple's list of known malware when you first open it, when the app changes, and when the list is updated. If it matches, macOS says the app will damage your computer and offers to move it to the Trash.
• XProtect Remediator runs in the background several times a day, looks for known malware families that are already on the Mac, and removes them. It tells you nothing unless it needs you.

Together with Gatekeeper, which blocks apps that aren't signed and notarized, it stops most well-known Mac malware. What it doesn't do: scan a file or folder on request, recognise malware Apple hasn't seen yet, or block phishing sites outside Safari. See do Macs need antivirus? for who needs more.

How to make sure XProtect is up to date

Apple updates XProtect's list of malware separately from macOS, often several times a month. Those updates only arrive if this setting is on:

1. Open System Settings › General › Software Update.
2. Click the info button (ⓘ) next to Automatic Updates.
3. Turn on Install Security Responses and system files and click Done.

To see when XProtect was last updated, run system_profiler SPInstallHistoryDataType | grep -A 4 XProtect in Terminal. Each entry shows a version and an install date; the newest should be from the last few weeks.

How to check a Mac for malware yourself

Malware has to start somewhere and keep itself running, so it leaves traces in a few places. Go through them in this order:

1. Applications: open the Applications folder, sort by Date Added, and look for apps you don't remember installing, especially around the time the problems started.
2. Login items: open System Settings › General › Login Items & Extensions and look at both the apps that open at login and the background items.
3. Launch agents: in the Finder, choose Go › Go to Folder and open ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons in turn. Each file is named after the developer of an app you use, such as com.google.keystone.agent.plist; one with a random name, or one pointing to a hidden folder, deserves a closer look.
4. Profiles: open System Settings › General › Device Management. On a Mac that no workplace or school manages, it should be empty.
5. Privacy permissions: in System Settings › Privacy & Security, check Accessibility, Full Disk Access and Screen & System Audio Recording for apps that have no reason to be there.
6. Browsers: remove extensions you didn't add, and check the search engine and home page. See how to remove a browser hijacker.
7. Activity Monitor: sort by % CPU and look for a process you don't recognise that stays busy while the Mac is idle. See how to read Activity Monitor.

If you find something, follow how to remove malware from a Mac. If you are worried someone has access to your Mac rather than malware, see has my Mac been hacked?

How to run a virus scan on a Mac

macOS has no scan you can start, so a virus scan needs an app:

• A free on-demand scanner, such as the free version of Malwarebytes, scans the Mac when you ask and removes what it finds. It doesn't protect you between scans.
• A full antivirus also scans new downloads as they arrive, which is when most infections can still be stopped.
• To check a single file, you can upload it to VirusTotal, which runs it past dozens of antivirus engines. Uploaded files are shared with security companies, so never upload private documents.

Download any scanner only from its developer's own site or the App Store. Fake “virus scan” pages and apps that always find dozens of threats are a common scam in their own right.

Revisa tu Mac con Tidy My Mac

• Antivirus runs a Quick, Normal or Deep scan whenever you want one, and scans new files in Downloads and on the Desktop as they arrive. What it finds goes to a quarantine you can review.
• Security Settings checks that XProtect, Gatekeeper, System Integrity Protection and automatic security updates are on, and scores your Mac out of 100.
• Startup Items lists every login item, launch agent and daemon with the app it belongs to, so the places malware hides are on one screen.