XProtect

Apple's XProtect system, which is included in OS X, is a non-intrusive and rudimentary anti-malware program that runs in the background quietly without the need for user interaction; it is light on system resources. XProtect, however, has a major difference from traditional anti-malware programs in that it is not constantly checking and monitoring the system, which usually takes up resources. It is mostly just used to scan downloads, so it is only executed when a download occurs, which also means that it is mostly supported by applications that have a download function; these applications are called "File Quarantine-aware applications." When such an application initiates a download, XProtect is invoked to check the downloaded files and then compares their contents with known virus definitions and then creates an alert to the user if any is found.

Examples of File Quarantine-aware applications:

• Safari
• Messages
• iChat
• Mail