What is XProtect Remediator on Mac?

Where it lives

Inside /Library/Apple/System/Library/CoreServices/XProtect.app, alongside the XProtect definitions macOS checks every app against. Each remediator is its own program, named after the family it looks for:

ls /Library/Apple/System/Library/CoreServices/XProtect.app/Contents/MacOS/
defaults read /Library/Apple/System/Library/CoreServices/XProtect.app/Contents/Info.plist CFBundleShortVersionString

On the Mac this page was written on (macOS 26.5.2, 3 November 2026), the second line gave version 170 and the folder held 24 remediators, among them XProtectRemediatorAdload, XProtectRemediatorPirrit, XProtectRemediatorBundlore and XProtectRemediatorGenieo. Most of the names are adware families.

When it runs

Apple says XProtect checks for infections periodically and removes malware when it receives updated information, without restarting the Mac. It does not publish a schedule. The runs are started by a system job, com.apple.XProtect.daemon.scan, so you will see a remediator in Activity Monitor now and then, sometimes using a lot of CPU for a short while, and then it is gone. On the Mac above, the system log shows XProtectRemediatorPirrit running at 01:20 on 1 November, with nobody at the keyboard.

Its updates come from Apple automatically, separately from macOS updates, as long as Install Security Responses and system files is on in System Settings → General → Software Update → Automatic Updates.

Is it safe? Should I stop it?

• It is safe. It is signed by Apple and sits in a folder macOS protects; nothing you install can put files there.
• Do not quit or delete it. It is one of the ways a Mac gets rid of adware without anybody buying a scanner. A run finishes on its own.
• Errors in Console are not a warning. The remediators run without a window, and their log lines often include errors about reaching parts of the interface. That is not a sign of infection.

If macOS has found something, you hear about it differently: a message that an app will damage your computer, with a Move to Trash button. See what to do about TypicalProcessfld for one example.

Where the app comes in

RefreshYourMac is not a malware scanner and does not pretend to be one. Its Maintenance screen reads your Mac's own protection instead: the XProtect definition version and when it was installed, the XProtect Remediator version, and whether Gatekeeper is on. See what it reports, and whether a Mac needs an antivirus at all.