com.apple.mrt

EtreCheck version: 3.4.4 (448)

Report generated 2017-08-26 18:07:06

Download EtreCheck from https://etrecheck.com

Runtime: 2:10

Performance: Excellent

Click the [Lookup] links for more information from Apple Support Communities.

Click the [Details] links for more information about that line.

Click the [Remove/Report] links to remove adware or update the whitelist of legitimate software.

Click the [Clean up] link to delete unused files.

Problem: Other problem

Description:

MRT

Hardware Information:ⓘ

MacBook Pro (15-inch, Mid 2012)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Pro - model: MacBookPro9,1

1 2,6 GHz Intel Core i7 (i7-3720QM) CPU: 4-core

16 GB RAM Upgradeable - [Instructions]

BANK 0/DIMM0

8 GB DDR3 1600 MHz ok

BANK 1/DIMM0

8 GB DDR3 1600 MHz ok

Handoff/Airdrop2: supported

Wireless: en1: 802.11 a/b/g/n

Battery: Health = Normal - Cycle count = 839

Video Information:ⓘ

Intel HD Graphics 4000 - VRAM: 1536 MB

Color LCD 1440 x 900

NVIDIA GeForce GT 650M - VRAM: 1024 MB

Disk Information:ⓘ

APPLE HDD HTS547575A9E384 disk1: (750,16 GB) (Rotational)

[Show SMART report]

EFI (disk1s1 - MS-DOS FAT32) <not mounted> [EFI]: 210 MB

Macintosh HD (disk1s2 - Journaled HFS+) /Volumes/Macintosh HD : 749.30 GB (186.95 GB free)

Recovery HD (disk1s3 - Journaled HFS+) <not mounted> [Recovery]: 650 MB

Samsung SSD 840 EVO 250GB disk0: (250,06 GB) (Solid State - TRIM: No)

[Show SMART report]

EFI (disk0s1 - MS-DOS FAT32) <not mounted> [EFI]: 210 MB

(disk0s2) <not mounted> [CoreStorage Container]: 248.42 GB

Recovery HD (disk0s3 - Journaled HFS+) <not mounted> [Recovery]: 650 MB

USB Information:ⓘ

USB20Bus

hub_device

Apple Inc. FaceTime HD Camera (Built-in)

USB20Bus

hub_device

hub_device

Apple Inc. Apple Internal Keyboard / Trackpad

Apple Computer, Inc. IR Receiver

USB30Bus

Thunderbolt Information:ⓘ

Apple Inc. thunderbolt_bus

Virtual disks:ⓘ

[redacted] (disk2 - Journaled HFS+) / [Startup]: 248.06 GB (87.77 GB free)

Physical disk: disk0s2 248.42 GB Online

System Software:ⓘ

macOS Sierra 10.12.6 (16G29) - Time since boot: less than an hour

Gatekeeper:ⓘ

Mac App Store and identified developers

Possible adware:ⓘ

Adware: /Library/LaunchDaemons/com.MyUpdater.agent.plist

One possible adware file found. [Remove/Report]

Clean up:ⓘ

/Library/LaunchDaemons/com.MyUpdater.agent.plist

/Applications/MyUpdater/MyUpdater -guid 9747941790089000 -source nwt-1647

Executable not found!

/Library/LaunchDaemons/com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist

/Library/Application Support/MacKeeper/MacKeeperATd

Executable not found!

~/Library/LaunchAgents/com.nero.HSMMonitor.plist

/Applications/HTC Sync Manager.app/Contents/Resources/HSMMonitor.app/Contents/MacOS/HSMMonitor -runMode autoLaunched

Executable not found!

~/Library/LaunchAgents/com.zeobit.MacKeeper.Helper.plist

/Applications/MacKeeper.app/Contents/Resources/MacKeeper Helper.app/Contents/MacOS/MacKeeper Helper

Executable not found!

4 orphan files found. [Clean up]

Kernel Extensions:ⓘ

/Applications/DAEMON Tools Lite.app

[not loaded] com.disc-soft.DAEMONTools.VirtualSCSIBus (1.0.1 - SDK 10.8) [Lookup]

/Library/Extensions

[loaded] com.globaldelight.driver.Boom2Device (1.2 - SDK 10.10) [Lookup]

/System/Library/Extensions

[not loaded] com.Cycling74.driver.SAVD (1.0.0d1 - SDK 10.6) [Lookup]

[loaded] com.Cycling74.driver.Soundflower (1.6.7 - SDK 10.7) [Lookup]

[not loaded] com.LivestreamProcaster.driver.ProcasterAudioRedirector (2.0.0 - SDK 10.0) [Lookup]

[loaded] com.ScreamingBee.driver.SBVirtualMic64 (1.1.0 - SDK 10.9) [Lookup]

[loaded] com.nvidia.CUDA (1.1.0) [Lookup]

[not loaded] com.seagate.driver.PowSecDriverCore (5.2.6 (26977) - SDK 10.4) [Lookup]

/System/Library/Extensions/Seagate Storage Driver.kext/Contents/PlugIns

[not loaded] com.seagate.driver.PowSecLeafDriver_10_4 (5.2.6 (26977) - SDK 10.4) [Lookup]

[not loaded] com.seagate.driver.PowSecLeafDriver_10_5 (5.2.6 (26977) - SDK 10.5) [Lookup]

[not loaded] com.seagate.driver.SeagateDriveIcons (5.2.6 (26977) - SDK 10.4) [Lookup]

~/Library/Services/ToastIt.service/Contents/MacOS

[not loaded] com.roxio.TDIXController (2.0) [Lookup]

System Launch Agents:ⓘ

[not loaded] 7 Apple tasks

[loaded] 175 Apple tasks

[running] 100 Apple tasks

System Launch Daemons:ⓘ

[running] com.seagate.TBDecorator.plist (? 595582c 70b3ceb9 - installed 2015-01-30) [Lookup]

[not loaded] 40 Apple tasks

[loaded] 175 Apple tasks

[running] 102 Apple tasks

Launch Agents:ⓘ

[not loaded] com.adobe.AAM.Updater-1.0.plist (Adobe Systems, Inc. - installed 2017-07-11) [Lookup]

[failed] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d.plist (Adobe Systems, Inc. - installed 2017-01-12) [Lookup]

[running] com.adobe.AdobeCreativeCloud.plist (Adobe Systems, Inc. - installed 2017-07-26) [Lookup]

[not loaded] com.epson.Epson_Low_Ink_Reminder.launcher.plist (EPSON - installed 2015-10-10) [Lookup]

[loaded] com.epson.esua.launcher.plist (Seiko Epson Corporation - installed 2017-06-04) [Lookup]

[running] com.epson.eventmanager.agent.plist (Seiko Epson Corporation - installed 2017-07-04) [Lookup]

[running] com.epson.scannermonitor.plist (Seiko Epson Corporation - installed 2017-07-04) [Lookup]

[loaded] com.nvidia.CUDASoftwareUpdate.plist (NVIDIA Corporation - installed 2017-06-15) [Lookup]

[loaded] com.oracle.java.Java-Updater.plist (? 742a7407 be93c7fb - installed 2017-07-22) [Lookup]

Launch Daemons:ⓘ

[failed] com.MyUpdater.agent.plist (? 7de8bed1 0 - installed 2016-11-21) Adware! [Remove/Report]

[loaded] com.adobe.ARMDC.Communicator.plist (Adobe Systems, Inc. - installed 2017-01-12) [Lookup]

[loaded] com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Systems, Inc. - installed 2017-01-12) [Lookup]

[loaded] com.adobe.SwitchBoard.plist (? 68cad67 0 - installed 2016-03-28) [Lookup]

[running] com.adobe.adobeupdatedaemon.plist (Adobe Systems, Inc. - installed 2017-07-26) [Lookup]

[running] com.adobe.agsservice.plist (Adobe Systems, Inc. - installed 2017-05-29) [Lookup]

[loaded] com.adobe.fpsaud.plist (? 2afb3af7 e92009a9 - installed 2017-07-25) [Lookup]

[loaded] com.bombich.ccc.plist (Bombich Software, Inc. - installed 2014-09-23) [Lookup]

[loaded] com.disc-soft.DAEMONTools.PrivilegedHelper.plist (? fef6c2b2 b5c569c - installed 2014-08-31) [Lookup]

[loaded] com.microsoft.autoupdate.helper.plist (Microsoft Corporation - installed 2017-04-12) [Lookup]

[loaded] com.microsoft.office.licensing.helper.plist (? 6d8cb30e afb3bef0 - installed 2010-08-25) [Lookup]

[loaded] com.microsoft.office.licensingV2.helper.plist (Microsoft Corporation - installed 2016-02-12) [Lookup]

[loaded] com.nvidia.cuda.launcher.plist (Shell Script 20f73770 - installed 2017-06-15) [Lookup]

[loaded] com.nvidia.cudad.plist (NVIDIA Corporation - installed 2017-06-15) [Lookup]

[loaded] com.oracle.java.Helper-Tool.plist (Shell Script e3fefdd2 - installed 2017-07-12) [Lookup]

[failed] com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist (? 9166218c 0 - installed 2014-09-17) [Lookup] - /Library/Application Support/MacKeeper/MacKeeperATd: Executable not found!

User Launch Agents:ⓘ

[loaded] com.adobe.AAM.Updater-1.0.plist (Adobe Systems, Inc. - installed 2017-07-11) [Lookup]

[loaded] com.dropbox.DropboxMacUpdate.agent.plist (Dropbox, Inc. - installed 2017-08-11) [Lookup]

[failed] com.nero.HSMMonitor.plist (? 625a221d 0 - installed 2015-11-19) [Lookup] - /Applications/HTC Sync Manager.app/Contents/Resources/HSMMonitor.app/Contents/MacOS/HSMMonitor: Executable not found!

[running] com.spotify.webhelper.plist (Spotify - installed 2017-08-25) [Lookup]

[loaded] com.valvesoftware.steamclean.plist (? eab0033c 9280bbdd - installed 2017-07-31) [Lookup]

[failed] com.zeobit.MacKeeper.Helper.plist (? 670429ba 0 - installed 2014-09-17) [Lookup] - /Applications/MacKeeper.app/Contents/Resources/MacKeeper Helper.app/Contents/MacOS/MacKeeper Helper: Executable not found!

User Login Items:ⓘ

iTunesHelper Application (Apple, Inc. - installed 2017-07-20)

(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

Flux Application

(/Applications/Flux.app)

SpeechSynthesisServer Application - Hidden

(/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks /SpeechSynthesis.framework/Versions/A/SpeechSynthesisServer.app)

AdobeResourceSynchronizer Application - Hidden

(/Applications/Adobe Acrobat DC/Adobe Acrobat.app/Contents/Helpers/AdobeResourceSynchronizer.app)

Dropbox Application

(/Applications/Dropbox.app)

com.adobe.SwitchBoard.monitor.plist MachInit - Hidden

(/etc/mach_init_per_user.d/com.adobe.SwitchBoard.monitor.plist)

Mach Init items are deprecated

Internet Plug-ins:ⓘ

AdobeAAMDetect: 3.0.0.0 (installed 2017-07-26) [Lookup]

FlashPlayer-10.6: 26.0.0.151 (installed 2017-08-09) [Lookup]

QuickTime Plugin: 7.7.3 (installed 2017-07-20)

AdobePDFViewerNPAPI: 17.012.20095 (installed 2017-08-17) [Lookup]

AdobePDFViewer: 17.012.20095 (installed 2017-08-17) [Lookup]

Flash Player: 26.0.0.151 (installed 2017-08-09) [Lookup]

SharePointBrowserPlugin: 14.0.0 (installed 2010-08-25) [Lookup]

PepperFlashPlayer: 26.0.0.151 (installed 2017-08-09) [Lookup]

Silverlight: 5.1.50428.0 (installed 2016-06-25) [Lookup]

JavaAppletPlugin: Java 8 Update 141 build 15 (installed 2017-07-22) Check version

User internet Plug-ins:ⓘ

BlueStacks Install Detector: Unknown

Safari Extensions:ⓘ

[enabled] Adblock Plus - Eyeo GmbH - https://adblockplus.org/ (installed 2016-12-21)

[enabled] Ghostery - GHOSTERY, Inc. - https://www.ghostery.com/ (installed 2016-10-30)

[enabled] Ka-Block! - David Graham & Josh Peek - http://kablock.com (installed 2017-05-17)

3rd Party Preference Panes:ⓘ

CUDA Preferences (installed 2017-06-15) [Lookup]

Flash Player (installed 2017-07-25) [Lookup]

Java (installed 2017-07-22) [Lookup]

Seagate Dashboard for Mac OSX (installed 2015-06-09) [Lookup]

Time Machine:ⓘ

Skip System Files: NO

Mobile backups: ON

Auto backup: YES

Volumes being backed up:

EVERARDUS: Disk size: 248.06 GB Disk used: 160.30 GB

Destinations:

DATABANK MINI [Local]

Total size: 2.00 TB

Total number of backups: 17

Oldest backup: 09/03/2017, 18:33

Last backup: 26/08/2017, 14:55

Size of backup disk: Excellent

Backup size 2.00 TB > (Disk size 248.06 GB X 3)

Top Processes by CPU:ⓘ

100% MRT

13% AddressBookSourceSync

6% WindowServer

4% kernel_task

4% mdworker

Top Processes by Memory:ⓘ

7.46 GB MRT

1008 MB kernel_task

367 MB Safari

326 MB mds_stores

164 MB Dropbox

Top Processes by Network Use:ⓘ

Input Output Process name

1 MB 3 KB helpd

247 KB 66 KB Mail

76 KB 82 KB Dropbox

49 KB 11 KB Notes

35 KB 25 KB CalendarAgent

Top Processes by Energy Use:ⓘ

98.34 MRT

6.94 WindowServer

5.32 mdworker

5.26 mdworker

Virtual Memory Information:ⓘ

3.31 GB Available RAM

743 MB Free RAM

12.69 GB Used RAM

2.59 GB Cached files

0 B Swap Used

Software installs:ⓘ

Adobe Flash Player: (installed 2017-08-09)

Adobe Pepper Flash Player: (installed 2017-08-09)

Adobe Acrobat DC (17.012.20093): (installed 2017-08-11)

Adobe Acrobat DC (17.012.20095): (installed 2017-08-17)

Memory Clean 2: 1.5 (installed 2017-08-22)

ShutterCount: 3.1 (installed 2017-08-25)

CUDA 8.0: (installed 2017-08-26)

Install information may not be complete.

Diagnostics Information:ⓘ

2017-08-26 17:45:57 AdobeGCClient.app Crash [Open]

Cause: libcoreservices: _dirhelper_userdir: 523: bootstrap_look_up returned 32

2017-08-26 15:56:16 DesktopServicesHelper Crash [Open]

2017-08-26 13:57:05 MRT.app High CPU use [Open] [Details]

2017-08-26 11:36:52 Adobe Photoshop CC 2017.app High CPU use [Open] [Details]

2017-08-18 10:17:33 Kernel Panic [Open] [Details]

3rd Party Kernel Extensions:

com.ScreamingBee.driver.SBVirtualMic64 1.1.0

com.nvidia.CUDA 1.1.0

com.Cycling74.driver.Soundflower 1.6.7

com.globaldelight.driver.Boom2Device 1.1

Dear Linc,

Thanks for opting a solution. Since today I have the same problem with MRT (I am using OS Sierra 10.12.6 on a mid 2012 macbook pro). It's clogging my activity and memory and it doesn't seem to stop. It doesn't seem to finish and terminate itself afterwards. I think MRT was updated during the security update of the 23th of August 2017. I've tried a range of different probable solutions: such as restoring permissions as well as disabling and later enabling SIP (your solution). Nevertheless, none of it seems to work. I was wondering, if it would help to remove the files responsible for MRT between the disabling and enabling of SIP?

Thanks in advance.

As far as I can tell, MRT sweeps the system looking for XProtect malware items, as well as malware, and malware families that are not included in the XProtect updates. There are monthly MRT data pushes from Apple servers that appear in the System Reports : Software : Installations log. The MRT binary has these malware names, and the third-party application data locations to check embedded within it.

If MRT is running amok, something on your machine may have triggered this behavior. On my fully updated, macOS 10.12.6 machine, MRT is not misbehaving at all.

Make certain that you are not running one or more anti-virus products (completely uninstalled), and that you are not using so-called Mac cleaner applications that are known to be overzealous in their choice of removal items. I would do two other things:

Get and run the free Malwarebytes anti-malware sweep, and etrecheck, which also will detect malware. Post the privacy-oriented etrecheck output here so others can see what is installed, and suggest remedies. In either case, Malwarebytes, and etrecheck will offer to remove any malware found.

This procedure will temporarily disable System Integrity Protection.

Please start up in Recovery mode. In the OS X Utilities screen, select Get Help Online. A copy of Safari will launch. While in Recovery, you'll have no access to your history or bookmarks, but you won't need them. Load this web page.

Triple-click anywhere in the line below to select it:

csrutil disable

Copy the selected text to the Clipboard by pressing the key combination command-C.

Quit Safari. You'll be returned to the OS X Utilities screen.

Select

Utilities ▹ Terminal

from the menu bar. A Terminal window will open. Paste into the window by pressing the key combination command-V.

Wait for a new line ending in a hash sign (#) to appear below what you entered. If it doesn't appear, press return.

Quit Terminal to return to the main screen.

Restart as usual. After a few minutes, start up in Recovery mode again and load this page in Safari. Run the following command in Terminal as before:

csrutil enable

Restart as usual again.

Do you know the reason of this behavior ?

Some kind of bug, but I don't know specifically what triggers it.

Seems odd to turn off a safety feature

To be clear, you turned it off only for a few minutes, then turned it back on. While it was off, you weren't doing anything.

Will this reoccur

I don't think so.

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

The test works on OS X 10.7 ("Lion") and later. I don't recommend running it on older versions of OS X. It will do no harm, but it won't do much good either.

Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

2. If you don't already have a current backup, please back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

In this case, however, there are ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone who understands the code can verify what it does.

You may not be able to understand the script yourself. But variations of it have been posted on this website many times over a period of years. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.

Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

4. Here's a general summary of what you need to do, if you choose to proceed:

☞ Copy a particular line of text to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

These are not specific instructions; just an overview. The details are in parts 7 and 8 of this comment. The sequence is: copy, paste, wait, paste again. You don't need to copy a second time.

5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is intermittently slow, run the test during a slowdown.

You may have started up in safe mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual before running it. If you can only test in safe mode, do that.

6. If you have more than one user, and only one user is affected by the problem,, and the affected user is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

7. Load this linked web page (on the website "Pastebin.") Press the key combination command-A to select all the text, then copy it to the Clipboard by pressing command-C.

8. Launch the built-in Terminal application in any one of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Click anywhere in the Terminal window to activate it. Paste from the Clipboard into the window by pressing command-V, then press return. The text you pasted should vanish immediately.

9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.

If the test is taking much longer than usual to run because the computer is very slow, you might be prompted for your password a second time. The authorization that you grant by entering it expires automatically after five minutes.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, a series of lines will appear in the Terminal window like this:

Test started

Part 1 of 4 done at: … sec
…
Part 4 of 4 done at: … sec

The test results are on the Clipboard.

Please close this window.

The intervals between parts won't be exactly equal, but they give a rough indication of progress.

Wait for the final message "Please close this window" to appear. If you don't see it within about 15 minutes, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it. Then go to the next step. You'll have incomplete results, but still something. If you close the Terminal window while the test is still running, the partial results won't be saved and you'll have to start over.

11. When the test is complete, or if you stopped it because it was taking too long, quit Terminal. The results will have been saved to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "close this window" message. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

12. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the software that runs this website. Please post the test results on Pastebin, then post a link here to the page you created.

If you have an account on Pastebin, please don't select Private from the Paste Exposure menu on the page, because then no one but you will be able to see it.

13. This is a public forum, and others may give you advice based on the results of the test. They speak for themselves, not for me. The test itself is harmless, but whatever else you're told to do may not be. For others who choose to run it, I don't recommend that you post the test results on this website unless I asked you to.

14. The linked UNIX shell script bears a notice of copyright. Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

I think deleting the files EtreCheck suggested me to delete has just resolved the problem! I'll double check and let you know.

It has been resolved. Thank you so much for your help.