Constant high CPU after Security Update today

I also did not have MRTAgent (which should be installed in /System/Library/CoreServices/), and was trying to work out what the discrepancy was. I applied the update through Software Update. I just now installed the manual download from support article DL1387, and now I have MRTAgent.app installed. So there appears to be a discrepancy between the Software Update version and the manual download.

I downloaded the updater too, and didn't get MRTAgent, but that was yesterday. Maybe it has changed since.

FWIW, I also used Software Update & don't have MRTAgent in /System/Library/CoreServices/ (or anywhere else I can find).

However there are references to MRT in private/var/log/install log shown in Console. One is to "Begin script: loadMRT" & it shows to errors, "Error unloading: com.apple.mrt.uiagent," & "Error unloading: com.apple.mrt." That is followed by "End script: loadMRT."

Note that errors like the above don't necessarily mean anything is wrong; logs often report as errors events that are expected in some cases & used to alter program flow, for instance by exiting a routine that isn't needed. Only the programmer really can tell if such errors indicate problems, so that isn't much help.

The only other reference I can find is to "PackageKit: Registered bundle" for the file /System/Library/CoreServices/MRTAgent.app/. I assume this is for permissions repairs, & is added to the database whether or not the app is installed.

So, what does one do? I did two MBP's via Softare update and followed that path and do not have the MRT app. I wonder if this means Apple will be releasing a version 1.1 of this update?

Or, should we download an run the installer manually?

PS Thomas, I find your website very helpful.

Thomas A Reed wrote:

So there appears to be a discrepancy between the Software Update version and the manual download.

That isn't all that unusual, since Software Update may select a 'smaller installer' package that isn't available from the manual download site. However, I have no idea if that is relevant to the issue here.

One thing that seems like it might be is if only MacBook Pro owners are affected, & if so only if they choose the manual download method. It may also be that only certain MBP models are involved, so it might be useful for those affected to post that info.

I wonder if this means Apple will be releasing a version 1.1 of this update?

I'm pretty sure there is a problem with the updater. But unless you have a screaming need for the MRT, I wouldn't worry too much. The next maintenance update will include it.

mine is a imac 21" 3.06 GHz Intel Core 2 Duo, not a MBP.

laverne's mom

But have you noticed any problems with high CPU activity after the update? If not, you aren't among the affected.

Thank you. No I haven't. Just have gotten a little more on the cautious side this month. Should get back to my normal levels of caution soon I hope.

laverne's mom

🙂

On two differnt MBP's (a 2008 and a 2010), installed Security Update 2011-003 via SU and do not see the MRT in the path provided.

My question is "should" it have been regardless, or is this something that only should have been installed if the installer determined that the trojan was present on the machine during this installation process, then installed the MRT app to deal with it. If the installer did not find the trojan, it did not install. Is this maybe why some are seeing it and some not? Or maybe something prevented it from clearing itself after the initial run.

If it should have been installed regardless, and the standalone version differed from the software update version (but should have been the same), then we will most likely see a version 1.1 of Security Update 2011-003.

R C-R wrote:

there are references to MRT in private/var/log/install log shown in Console. One is to "Begin script: loadMRT" & it shows to errors, "Error unloading: com.apple.mrt.uiagent," & "Error unloading: com.apple.mrt." That is followed by "End script: loadMRT."

Note that errors like the above don't necessarily mean anything is wrong...

Yes, there is a postinstall action script called loadMRT that simply unloads and then loads the LaunchAgent com.apple.mrt.uiagent and does the same thing for LaunchDaemon com.apple.mrt. The unloads will always fail the first time as they were never launched. That comes in to play when you update any of these components.

Also note that there should be a unix executable "MRT" in /usr/libexec/ that is part of this system.

Okay, here's what I've learned from an associate who took a closer look. Apparently, it will always be installed and launched at the time of the installation. It will run for several minutes, and may use a fair portion of the CPU, but will then delete itself. (I can now verify that, although I had MRTAgent earlier, it's gone again.)

So, if you're having problems with it running for an extended period, and you are 100% certain that you don't have a MacDefender trojan variant installed, then you've got something wrong somewhere. You may want to try reinstalling the update manually.

Thomas A Reed wrote:

You may want to try reinstalling the update manually.

Before doing that, it might be a good idea to run Disk Utility's two checks (disk & permissions, in that order) to make sure the file system & permissions settings are OK. Permissions issues are unlikely to be the problem -- the installer usually stops with a report of a problem if they are -- but it can't hurt to run that as long as Disk Utility is already open.

Reported problems from a Verify Disk check are more serious. Even if running the Disk Repair step (which must be done from another volume like your installer DVD) fixes any discovered problems, it does not repair any damage already done to existing files. (It fixes the file system to prevent new damage from occurring, but that is all it can do.)

Depending on what is damaged, it may be necessary to reinstall the OS, or if the damage is confined to files the Combo update replaces then downloading & installing that may be enough.