CPU going crazy with MRT after the update.

I got same issue. MRT just keep up and down and my CPU like crazy.

Since I got no Time Machine backup to downgrade MRT 1.68 to 1.67, I tried rename MRT.app to MRT.app.bak

And it works! My CPU now is calm.

path:

/Library/Apple/System/Library/CoreServices/MRT.app

You may need to disable SIP so you can rename MRT.app.

This is not a final solution. Hope Apple could fix it ASAP.

It seems more systems than El Capitan have this issue. Perhaps Apple is ignoring it since El Capitan is end of life.

But macOS Catalina has the same problem since MRTconfigdata 1.68.

Please go to https://feedbackassistant.apple.com and report the issue, if you are a developer.

Or https://www.apple.com/feedback/macos.html if you are not a developer.

The more reports they get about MRT using 100% cpu the quicker it will get fixed.

I've been following the comments here, as this is one of the few places on the Internet where MRT 1.68 problems are being discussed. Much thanks to hoakley at https://eclecticlight.co/2020/10/19/apple-has-pushed-updates-to-xprotect-and-mrt-17/ and others who have contributed to several solutions that have worked for me. In building this guide, I've borrowed liberally from others posts. Thank you all.

My OS: El Capitan 10.11.6

My machine: MacPro5,1

Three approaches have been successful for me in stopping the rampant CPU use by MRT.app. One requires installing another utility (App Tamer), and the other two require some command line wizardry. I'll summarize each one below.

First Approach: APP TAMER

1. Download App Tamer from the St. Clair Software site:

www.stclairsoft.com/AppTamer/

2. Install and in App Tamer's interface find MRT and check the box to "Stop this app completely."

If this works for you, nothing else is needed. When Apple fixes the problem, you can simply uncheck the box and the new version of MRT can do it's job.

Second Approach: Replace MRT.app 1.68 with a previous version

1. Obtain an older version of MRT.app from Time Machine or another backup. (I used 1.67).

2. Restart while holding down Command-R to boot into macOS Recovery.

3. Start Terminal from the Utilities menu.

4. Disable SIP from the command line:

csrutil disable

5. Exit Terminal and open Disk Utility. Find your boot drive in the list and unlock and mount it if necessary.

6. Exit Disk Utility and return to the terminal.

6. Delete the old copy of MRT.app:

rm -fR /Volumes/YourBootDrive/System/Library/CoreServices/MRT.app

7. Copy old version of MRT.app to the system:

cp /path/to/old/version/MRT.app /Volumes/YourBootDrive/System/Library/CoreServices/MRT.app

8. Re-enable SIP:

csrutil enable

9. Restart

10. VERY IMPORTANT: without this step the OS will reinstall MRT with the current version within hours. Immediately after restarting to your normal desktop, if you use El Capitan open System Preferences > App Store and uncheck "Install system data files and security updates." In other Mac OS versions you may need to do this in the Software Update pane. (Put a sticky on your screen to remind you to re-enable this when Apple has resolved the problem.)

Third Approach: Disable MRT.app by removing executable permissions

1. Restart while holding down Command-R to boot into macOS Recovery.

2. Start Terminal from the Utilities menu.

3. Disable SIP from the command line:

csrutil disable

4. Exit Terminal and open Disk Utility. Find your boot drive in the list and unlock and mount it if necessary.

5. Exit Disk Utility and return to the terminal.

6. Remove executable permissions from MRT.app:

chmod -R -x /Volumes/YourBootDrive/System/Library/CoreServices/MRT.app

7. Re-enable SIP:

csrutil enable

8. Restart

9. VERY IMPORTANT: without this step the OS will reinstall MRT with the current version within hours. Immediately after restarting to your normal desktop, if you use El Capitan open System Preferences > App Store and uncheck "Install system data files and security updates." In other Mac OS versions you may need to do this in the Software Update pane. (Put a sticky on your screen to remind you to re-enable this when Apple has resolved the problem.)

===

Finally, if you are having issues with MRT.app 1.68, released in Mid October, 2020, please report the issue to Apple. Please go to https://feedbackassistant.apple.com and report the issue, if you are a developer, or https://www.apple.com/feedback/macos.html if you are not a developer.

The more reports they get about MRT using massive amounts of CPU the quicker it will get fixed.

Thank you.

Since you have been trouble-shooting with little success I would presume you have back tracked and begun with "General Maintenance". Always good to start from a fresh platform and remember, back-ups save us!

First, how long have you allowed the MRT and its agent to run? Sometimes we must let things run their course so let it run for a couple of hours while you nap or have a cup of cheetos or something.

Here are some items to consider:

• Run a disk verification followed by a repair if needed. You will most likely need to boot from an alternative boot volume or external media.
• Reset the SMC/PMU (A lot of tech's say to do this as a last resort so tread carefully. Also, this step is more for power related hardware issues so it may not help but it could ya know).
• Reset the PRAM (which I believe you have already done but some say it should be done After the above step).
• Next, immediately boot into safe mode (hold the shift key during boot up).
• Fix permissions from within Safe Mode. Open Disk Utility on the boot drive and run a permissions fix.
• Next, run a cleaning app of your choice. Be sure to target all of the different caches. OnyX is one of many examples of cleaning apps.

Clear the dyld cache; the font, boot, and kernel caches; clear all user-related caches; Run Daily, Weekly, and Monthly scripts

• Reboot (normal mode)

If that doesn't help then consider the following: rebuilding the launch services (file/application association), as well as removing spotlight indexes, audio and media components, and rebuilding the directory services.

Please note that these instructions have been gathered by me from multiple other sources so I can not take direct credit. Also note that I have not directly verified this will work for your exact situation.

I've tried:

• Letting the machine run for days, this is not a "letting it finish" issue.
• Fixing permissions
• Disk check
• Cleaning up crap
• Looking for actual malware

Nothing works and I don't expect it to work either as the error says that it's related to an error in the code of MRT.app relting to regex. I'd say this is a bug at this point and that there's no fix other than getting rid of the app, unless Apple releases a fix.

I tried everything I've read everywhere and none worked. I just gave up and applied brute force:

• Reboot into recovery (cmd-r while booting)
• Open terminal (utilities menu)
• csrutil disable
• Reboot (apple menu)
• Rename MRT.app to MRT.app.bak (make sure it won't end up MRT.bak.app)
• Reboot
• Same procedure but csrutil enable
• FINISHED

Finally my computer isn't working overtime as a toaster anymore. So far MRT.app hasn't been regenerated. I'm on Mojave.

Things that didn't work, but which may have an effect on not regenerating MRT (doubt it though):

sudo launchctl stop com.apple.mrt
sudo launchctl remove com.apple.mrt

Removing: /System/Library/LaunchDaemons/com.apple.MRTd.plist
Removing: /System/Library/LaunchAgents/com.apple.MRTa.plist

Make non-executable: chmod -R -x+X /System/Library/CoreServices/MRT.app

None of this worked even with sip disabled. Only solution was to rename the darn file. Way to go, Apple.

Pretty much the same symptoms here!

Macbook pro 15inch 2015 under 10.13.6

MRT 1.68 nightmare since October 20th..

It seems to loop: High CPU usage, Crash, Restart, High CPU usage, Crash, Restart, ...

See picture attached.

Safe Boot, (holding Shift key down at startup), does the problem occur in Safe Mode?

Safe mode attempts to repair Disks & clears lots of caches & loads safe Drivers, & prevents loading of 3rd party extensions, so if Safe Mode works try again in regular boot.

If that doesn't do it, we might find the problem with an etrecheck report.

EtreCheck is a FREE simple little diagnostic tool to display the important details of your system configuration and allow you to copy that information to the Clipboard. It is meant to be used with Apple Support Communities to help people help you with your Mac. It will not display any personal info.

https://www.etrecheck.com/

Pastebin is a good place to paste the whole report if you capture the URL while there…

https://pastebin.com/

Whew, they've changed pastebin & made it harder, but after pasting in, click Create new paste button, then Embed button, then copy the URL...

<script src="https://pastebin.com/embed_js/KuvnghqA"></script>

The important part is...

https://pastebin.com/embed_js/KuvnghqA

Workable but harder for me to work with...the Note tool on the bottom of this editor's toolbar, as shown in the image, to copy and paste the output from EtreCheck. In a Reply before you click post, look for this to add longer texts...

Just found MRT.app 1.68 re-generated this morning. So I rename it again. It still works, for now, I guess.

Actually it's pretty the same to delete it.

I thought this issue should be global, but I didn't find many discussion on the other forum, even on here or Riddit.

Does that means most of MRT.app 1.68 can work normally?

Only few cases like us got issue?

The same with Catalina 10.15.7 and MRT 1.68. CPU hitting 100% and CrashReport appears frequently in top.

Also. lots of console errors:

ошибка 15:48:21.661355+0300 kernel Sandbox: MRT(5909) System Policy: deny(1) file-read-metadata /private/var/folders/_6/r5pq_2vj393dl69grtddknb00000gn/0/dmd/ConfigurationEngine/Database-shm

ошибка 15:48:21.661397+0300 kernel Sandbox: MRT(5909) System Policy: deny(1) file-read-metadata /private/var/folders/_6/r5pq_2vj393dl69grtddknb00000gn/0/dmd/Policies/Database

ошибка 15:48:21.661427+0300 kernel Sandbox: MRT(5909) System Policy: deny(1) file-read-metadata /private/var/folders/_6/r5pq_2vj393dl69grtddknb00000gn/0/dmd/Policies/Database-wal

ошибка 15:48:21.661508+0300 kernel Sandbox: MRT(5909) System Policy: deny(1) file-read-metadata /private/var/folders/_6/r5pq_2vj393dl69grtddknb00000gn/0/dmd/Policies/Database

ошибка 15:48:21.661602+0300 kernel Sandbox: MRT(5909) System Policy: deny(1) file-read-metadata /private/var/folders/_6/r5pq_2vj393dl69grtddknb00000gn/0/dmd/Policies/Database-wal

ошибка 15:48:21.665994+0300 kernel Sandbox: MRT(5909) System Policy: deny(1) file-read-metadata /private/var/folders/_6/r5pq_2vj393dl69grtddknb00000gn/0/com.apple.LaunchServices.dv/com.apple.LaunchServices.trustedsignatures-501.db

ошибка 15:48:21.667130+0300 kernel Sandbox: MRT(5909) System Policy: deny(1) file-read-metadata /private/var/folders/_6/r5pq_2vj393dl69grtddknb00000gn/0/com.apple.lockoutagent

ошибка 15:48:21.684313+0300 kernel Sandbox: MRT(5909) System Policy: deny(1) file-read-metadata /private/var/db/CoreDuet/Knowledge/knowledgeC.db

ошибка 15:48:21.684360+0300 kernel Sandbox: MRT(5909) System Policy: deny(1) file-read-metadata /private/var/db/CoreDuet/Knowledge/knowledgeC.db-wal

ошибка 15:48:37.891865+0300 MRT os_unix.c:43353: (2) open(/var/db/DetachedSignatures) - No such file or directory

ошибка 15:48:37.918745+0300 MRT cannot open file at line 43353 of [378230ae7f]

ошибка 15:48:37.919441+0300 MRT os_unix.c:43353: (2) open(/var/db/DetachedSignatures) - No such file or directory

ошибка 15:48:37.919265+0300 MRT cannot open file at line 43353 of [378230ae7f]

ошибка 15:48:37.921833+0300 MRT os_unix.c:43353: (2) open(/var/db/DetachedSignatures) - No such file or directory

ошибка 15:48:37.932357+0300 MRT cannot open file at line 43353 of [378230ae7f]

Been having the same issues since this MRT update on Catalina, with that and xprotect and trustd all eating up CPU and constant spikes. They’re also filling the console at a high rate with messages and errors.

MRT in particular constantly throws MacOS error -67062, and trustd throwing OCSPResponse: single response has extension(s). Kernel is also periordically saying MRT has exeeded its mem lemit.

Haven’t had this issue at all until this MRT update, and haden’t installed new software before this happened. Rebooting into safe mode seems to stop it, but it returns as soon as I reboot.

My other way

Use cpulimit.

Install cpulimit with Homebrew, and execute the following shell script.

#!/bin/sh

while :
do
  # Get the PID from the process name as PID changes every time MRT is restarted
  PID=$(pgrep MRT)
  # null check PID
  if [ -n "$PID" ]
  then
    # limite cpu usage to 1%
    echo yourpassward | sudo -S cpulimit -p $PID -l 1
  fi
  #10 seconds sleep in case a loop occurs
  sleep 10
done

I'm not very familiar with shell scripts, so there could be a problem with this script. In that case, please suggest an improved script.

Also, to have this shell script run automatically when the Mac starts up, create .sh file for that shell script and [any_name].command file, and write the path to the .sh file in .command file.

Then add that .command file to your Login item.

So this work around actually worked for two machines, both afflicted. One running High Sierra and the other running Big Sur.

A few hours later, however, the Big Sur machine generated a new MRT.app and started trying to run that (all whilst the renamed file also sat there).

So I deleted them both (now that SIP had been disabled, that was easy to do) and since then the machine has run happily and without a regenerated hyperactive MRT application.

That said, I fully expect the file to return when the OS notices that it is missing, so it remains a workaround until Apple fix it. What I would strongly recommend is that you don't waste time on general maintenance or shell scripts. A huge thanks to the people suggesting these ideas but this is on Apple and the least time we spend on it, surely the better?!

Absolutely crazy with the new MRT update. Please APPLE do something. I have submitted the bug report multiple times and didn't get any answer yet. This is killing my computer. The fan is running hot and my machine slowed down to crawl as result of MRT. This happened since 2 or 3 days ago. I have ESET Antivirus running and no infection reported. I uninstalled ESET and MRT is still using the CPU 100%. I installed Malwarebytes to run test on my machine and it didn't find anything. I do not have a backup to restore from because I am right now travelling and do not have access to fast internet or to my time machine. I do not want to do frankenstein method by deleting the file or renaming it, since that's not the right way of doing things. My machine is Macbook PRO 2010 with Sierra and was running perfectly fine until this MRT update. I sincerely hope Apple is going to fix it and not leave Sierra out just because it is outdated and doesn't receive updates anymore. There is a long list of people reporting the same problem e.g. here:

https://eclecticlight.co/2020/10/19/apple-has-pushed-updates-to-xprotect-and-mrt-17/comment-page-1/#comment-51972