CPU going crazy with MRT after the update.

CPU going crazy with MRT after the update.

After the MRT update v. 1.68 my mid 2011 iMac is going insane with CPU percentages hitting %180s with MRT on Activity Monitor. Running El Capitan and tried resetting NVRAM and PRAM. Nothing worked besides formatting the hard disc and restoring from a previous back up that was done 2 weeks ago. However, MRT got updated a few hours later and I am back where I started. I also ran a few malware scans but those did not find anything suspicious. Would greatly appreciate any help, thanks!

Posted on Oct 21, 2020 3:59 AM

Reply
Question marked as Top-ranking reply

Posted on Oct 23, 2020 12:00 PM

I've been following the comments here, as this is one of the few places on the Internet where MRT 1.68 problems are being discussed. Much thanks to hoakley at https://eclecticlight.co/2020/10/19/apple-has-pushed-updates-to-xprotect-and-mrt-17/ and others who have contributed to several solutions that have worked for me. In building this guide, I've borrowed liberally from others posts. Thank you all.


My OS: El Capitan 10.11.6

My machine: MacPro5,1


Three approaches have been successful for me in stopping the rampant CPU use by MRT.app. One requires installing another utility (App Tamer), and the other two require some command line wizardry. I'll summarize each one below.


First Approach: APP TAMER


1. Download App Tamer from the St. Clair Software site:


www.stclairsoft.com/AppTamer/


2. Install and in App Tamer's interface find MRT and check the box to "Stop this app completely."


If this works for you, nothing else is needed. When Apple fixes the problem, you can simply uncheck the box and the new version of MRT can do it's job.


Second Approach: Replace MRT.app 1.68 with a previous version


1. Obtain an older version of MRT.app from Time Machine or another backup. (I used 1.67).


2. Restart while holding down Command-R to boot into macOS Recovery.


3. Start Terminal from the Utilities menu.


4. Disable SIP from the command line:


csrutil disable


5. Exit Terminal and open Disk Utility. Find your boot drive in the list and unlock and mount it if necessary.


6. Exit Disk Utility and return to the terminal.


6. Delete the old copy of MRT.app:


rm -fR /Volumes/YourBootDrive/System/Library/CoreServices/MRT.app


7. Copy old version of MRT.app to the system:


cp /path/to/old/version/MRT.app /Volumes/YourBootDrive/System/Library/CoreServices/MRT.app


8. Re-enable SIP:


csrutil enable


9. Restart


10. VERY IMPORTANT: without this step the OS will reinstall MRT with the current version within hours. Immediately after restarting to your normal desktop, if you use El Capitan open System Preferences > App Store and uncheck "Install system data files and security updates." In other Mac OS versions you may need to do this in the Software Update pane. (Put a sticky on your screen to remind you to re-enable this when Apple has resolved the problem.)


Third Approach: Disable MRT.app by removing executable permissions


1. Restart while holding down Command-R to boot into macOS Recovery.


2. Start Terminal from the Utilities menu.


3. Disable SIP from the command line:


csrutil disable


4. Exit Terminal and open Disk Utility. Find your boot drive in the list and unlock and mount it if necessary.


5. Exit Disk Utility and return to the terminal.


6. Remove executable permissions from MRT.app:


chmod -R -x /Volumes/YourBootDrive/System/Library/CoreServices/MRT.app


7. Re-enable SIP:


csrutil enable


8. Restart


9. VERY IMPORTANT: without this step the OS will reinstall MRT with the current version within hours. Immediately after restarting to your normal desktop, if you use El Capitan open System Preferences > App Store and uncheck "Install system data files and security updates." In other Mac OS versions you may need to do this in the Software Update pane. (Put a sticky on your screen to remind you to re-enable this when Apple has resolved the problem.)


===


Finally, if you are having issues with MRT.app 1.68, released in Mid October, 2020, please report the issue to Apple. Please go to https://feedbackassistant.apple.com and report the issue, if you are a developer, or https://www.apple.com/feedback/macos.html if you are not a developer.


The more reports they get about MRT using massive amounts of CPU the quicker it will get fixed.


Thank you.



Similar questions

43 replies

Oct 21, 2020 9:14 AM in response to radahn

Been having the same issues since this MRT update on Catalina, with that and xprotect and trustd all eating up CPU and constant spikes. They’re also filling the console at a high rate with messages and errors.


MRT in particular constantly throws MacOS error -67062, and trustd throwing OCSPResponse: single response has extension(s). Kernel is also periordically saying MRT has exeeded its mem lemit.


Haven’t had this issue at all until this MRT update, and haden’t installed new software before this happened. Rebooting into safe mode seems to stop it, but it returns as soon as I reboot.

Oct 21, 2020 11:57 PM in response to radahn

Since you have been trouble-shooting with little success I would presume you have back tracked and begun with "General Maintenance". Always good to start from a fresh platform and remember, back-ups save us!


First, how long have you allowed the MRT and its agent to run? Sometimes we must let things run their course so let it run for a couple of hours while you nap or have a cup of cheetos or something.


Here are some items to consider:


  • Run a disk verification followed by a repair if needed. You will most likely need to boot from an alternative boot volume or external media.
  • Reset the SMC/PMU (A lot of tech's say to do this as a last resort so tread carefully. Also, this step is more for power related hardware issues so it may not help but it could ya know).
  • Reset the PRAM (which I believe you have already done but some say it should be done After the above step).
  • Next, immediately boot into safe mode (hold the shift key during boot up).
  • Fix permissions from within Safe Mode. Open Disk Utility on the boot drive and run a permissions fix.
  • Next, run a cleaning app of your choice. Be sure to target all of the different caches. OnyX is one of many examples of cleaning apps.

Clear the dyld cache; the font, boot, and kernel caches; clear all user-related caches; Run Daily, Weekly, and Monthly scripts

  • Reboot (normal mode)

If that doesn't help then consider the following: rebuilding the launch services (file/application association), as well as removing spotlight indexes, audio and media components, and rebuilding the directory services.


Please note that these instructions have been gathered by me from multiple other sources so I can not take direct credit. Also note that I have not directly verified this will work for your exact situation.


Oct 22, 2020 2:54 AM in response to radahn

I've tried:


  • Letting the machine run for days, this is not a "letting it finish" issue.
  • Fixing permissions
  • Disk check
  • Cleaning up crap
  • Looking for actual malware


Nothing works and I don't expect it to work either as the error says that it's related to an error in the code of MRT.app relting to regex. I'd say this is a bug at this point and that there's no fix other than getting rid of the app, unless Apple releases a fix.

Oct 28, 2020 8:06 AM in response to Beth Shoshan

Had exactly the same problem on my Hgh Sierra Mini (10.13.6). MRT process used more than 350% CPU and fan running @5500 rpm all the time. I solved it by booting from an extern USB disk. Then I could in the «Get info» add my admin user with Read & Wright Access to the MRT.app file in the folder /System/Library/CoreServices/. Soon after I could lock the file. Then the CPU and fan ran as normal again ☺︎

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

CPU going crazy with MRT after the update.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.