Constant high CPU after Security Update today

It will run for several minutes, and may use a fair portion of the CPU, but will then delete itself.

I thought of that, but dismissed it as absurd. What's the point of installing files into several standard locations, only to delete them a few minutes later? Bizarre.

MadMacs0 wrote:

Also note that there should be a unix executable "MRT" in /usr/libexec/ that is part of this system.

I don't have any file of that name in /usr/libexec/.

I guess the idea is that, once it has run, it's known your machine doesn't already have a MacDefender variant on it, and after it runs the other things should keep it away. It's apparently a tool just for removing the infection and is unneeded once that task is complete.

R C-R wrote:

MadMacs0 wrote:

Also note that there should be a unix executable "MRT" in /usr/libexec/ that is part of this system.

I don't have any file of that name in /usr/libexec/.

Others have confirmed that this is also deleted upon completion of the task, along with the LaunchAgent and LaunchDaemon entries that were installed in support of the "removal" process.

Linc Davis wrote:

What's the point of installing files into several standard locations, only to delete them a few minutes later? Bizarre.

It isn't bizarre; it is one of the ways clean up is done after restarts.

it sounds, then, that as long as we are not seeing high CPU usage and those files are NOT present on our machine (the MRT app), then all went like it was suppose to.

I am wondering if those with issues restarted right after the update and interupted the process that was to take place. Normally, after a security update, a restart would be usual.

This time, I waited for some time after the update to restart my machine (noticing that Software Update didn't call for it as usual). I figured there had to be a reason why it didn't need one.

In looking at my logs, I left 30 minutes between install and restart...

This stopped CPU hogging for me:

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.mrt.plist

since the MRT process is suppose to happen, then delete itself, doesn't that mean you system didn't finish with the process of searching, if found remove, and then delete itself?

No MRT anywhere on my system, except the MRT.pdf

R C-R wrote:

Linc Davis wrote:

What's the point of installing files into several standard locations, only to delete them a few minutes later? Bizarre.

It isn't bizarre; it is one of the ways clean up is done after restarts.

Read what he says, "what's the point in installing files in several locations..."

Surely to remove something you don't need to install files all over, just remove the offending files using the code in RAM and then quit.

You install stuff on the drive because you want to use it again later. So to install on the drive and then remove it is exactly what he said: "Bizarre"

EFi changes needs code installed on the drive as it's used upon reboot, yet this Security Update doesn't require a reboot.

ds store wrote:

Surely to remove something you don't need to install files all over, just remove the offending files using the code in RAM and then quit.

What code in RAM are you talking about? When you restart a Mac RAM is in an indeterminate state. During the boot process, it is used as a staging ground for initialization, loading & linking files, & so on. The only thing that you can be sure will persist are files you have written to the drive in the normal areas (IOW, not to temp files that are purged as a normal part of the shutdown or startup process).

EFi changes needs code installed on the drive as it's used upon reboot, yet this Security Update doesn't require a reboot.

The latest Security Update does require a restart, as do all OS updates that are designed to be installed after all normal (non system) user accounts are logged out & their processes terminated. Since the advent of Leopard Apple has increasingly done that, since it prevents users or the processes they run from interfering with the update process.

The EFI partition is not used for anything in OS X except as a staging area for certain firmware updates, & that is only when invoked by following the instructions in the updater application to complete the update process.

You seem a bit mixed up on the facts here.

Reporting my experience, this particular security update, unlike every other one I have ever installed in Mac OS X, did not require a restart. It didn't have the usual message after it installed saying to restart, it just simply checked for available updates again and said everything was up to date.

I admit it is odd, but having installed on 2 of my own Mac's and checked with 4 other people with a similar setup, a restart was not needed immediately after installing, however, I did restart it manually about 30 minutes later.

Even when I checked for updates via Software Update (to download and install SU 2011-003), the little message icon noting a restart required was not present.

Odd. On every Mac I have installed it, I did get the little icon indicating a restart was required, & that is what happened.

I've installed it through Software Update and through the manual download, and neither required a restart.

Hmmm. Searching through my install logs, it looks like I installed the font update at the same time as the security one on this iMac. I think that would explain the restart I saw, if not the icon in Software Update. But that could just have been a "senior moment" for me -- my eyesight is not its best in the mornings, nor is the old wetware, & that's when I did the updates.