XProtect Remediator version 163, released on 18 September, has changed its behaviour, and can’t be run manually any more. If you’ve been trying to get it to run using XProCheck or by double-clicking the XProtect app in /Library/Apple/System/Library/CoreServices, you’ll have noticed it appears to open, then quits immediately without reporting any error.

When it was introduced during the summer of 2022, one of the neat features of XProtect Remediator was that you could run it manually, by double-clicking what is presented as a regular app. When I developed XProCheck it was an obvious feature to include. All XProCheck does when you click its button to Run XProtect is launch the executable XProtect inside the app bundle. It then waits for the app to finish, and returns any error reported. In previous versions of XProtect Remediator, that performs a complete set of scan modules as user, and the XProCheck app can then be used to inspect their reports in the log.

What appears to happen now, whether you use the button in XProCheck or double-click XProtect.app, is that the code runs, completes without running any scan modules, and quits.

I don’t know whether this is merely a bug in this release, or it’s Apple’s intention that manual scans are no longer possible. For those whose Macs seldom if ever run automatic scans, loss of manual scans means that those Macs may go many weeks without a set of XProtect Remediator scans being run, depriving them of those checks for malware.

Automatic scans should normally be run in three series:

• A fast scan may be run every 6 hours, whether or not the Mac is running on mains power. These appear to have been used during a period of high risk in late summer 2022, and haven’t been seen since.
• A regular scan should be run every 24 hours, when the Mac is running on mains power. Originally this consisted of two sets of scans, one run as user, the other as root. These are now run against a timer, so are normally stopped short, and may omit one of the sets of scans altogether.
• A slow scan is run every 7 days without any time limit, but still only when the Mac is running on mains power.

MacBook Pro and Air models that are used much of the time running from battery power alone are unlikely to perform regular or slow scans for long periods of many weeks. Although running the XProtect app manually is unable to perform a set of scans as root, it’s better than them not running at all. If you consider that your Mac does merit routine scans to check for malware, then I’m afraid you’ll have to start using a third-party utility to do that.