13

Today my machine ran out of memory. I went to Activity Monitor and it showed a process called MRT using lots of memory. I restarted my machine hoping it would help, but even after a restart I see the memory on MRT climbing by about 0.01 GB every few seconds.

I'm on macOS Sierra 10.12.6 on MacBook Pro (Retina, 15-inch, Mid 2015), 16 GB RAM.

enter image description here

Seems like there are reports of MRT using high CPU and how to remove it here. But I'd rather not remove it because it scans for malware.

UPDATE: I even tried the steps documented in the link above under "Manually remove MRT" but it didn't seems to work, the MRT process is still running and growing in memory usage.

  • 1
    I'll answer in some detail - but the chorus of "me too" indicates that either there is a memory leak (although since you are in green for memory pressure - that leak looks to be exceptionally harmless) or that Apple is cracking down on some widespread malware and everyone is seeing the "immune system" kick into high gear. It's like everyone has a fever to fight off the same flu that's going around at the moment. – bmike Aug 26 '17 at 12:09
  • I had this same issue on my Macbook pro. I think this is because some malware remover is working for your protection. we can manually remove the website data easily. Just go to Safari -> Preferences -> Privacy -> Manage website data. Remove All website data. – Vinu David Jose Aug 28 '17 at 6:19
4

Three systems that work together to protect your Mac from malware are:

So, these are Apple processes and if they are busy, the likely cause is you are infected or compromised. It could be a false positive, but you might consider enabling gatekeeper and sip if you disabled them and see if you can clean your system. If not, you might need a clean install that’s patched and then carefully get data back but not any programs or malware.

As a developer, I would use the gear icon in the window you show and while MRT is selected, run System Diagnostics... and file a bug report / radar / escalate a support case to Apple Engineering so they can investigate if MRT has a memory leak - that's also very likely scenario if you are sure you're not needing malware removal every moment your Mac is running.


Assuming you just want to see if you need cleaning (or for others that aren't developers and have similar issues), continue below

A great place to start if you don’t typically remove malware is MBAM - https://www.malwarebytes.com/mac/

As always, be a little skeptical / aware of free tools since scam / snake oil software “protection or cleanup” tools are in fact compromising and malicious and untruthful about what they do. If you download something from free aggregators, you could even be tricked by something that isn’t the name it says on the file or description.

I would not disable MRT if you have it running hot unless you’re sure you’re not compromised.

  • I was about to try that Malwarebytes link this morning to resolve the issue but I went to Activity Monitor today and didn't see MRT running, so I guess it finally finished. It was pretty bad when it was running though, memory usage went up to 40 GB for that process :( – Liron Yahdav Aug 28 '17 at 18:01
2

I had this same issue on my Mac mini & MacBook Pro. Mac mini was virtually unusable due to only 4GB RAM. It is indeed malware.

I used the 30 day free trial of Malwarebytes and the malware was removed directly.

Hope this post helps people as I spent a few hours trying to find out the root cause of this MRT high memory use issue.

1

You might be able to "Fix" this by disabling many of the macOS malware protections as follows:

  1. disable SIP
  2. move the /system/library/coreservices/MRT to recycle (delete should be ok).
  3. quit MRT process if running.

Note that if you have malware, this will open the flood gates and remove any protections you might have had from Apple so be sure you are OK with those risks.

  • I couldn't move the file to trash, I get error: “MRT” can’t be modified or deleted because it’s required by macOS." If I try to use rm -rf on it from Terminal I get error "Operation not permitted". And the path to it is /System/Library/CoreServices/MRT.app. – Liron Yahdav Aug 25 '17 at 20:31
  • In your case, firstly, you need to disable System Integrity Protection. 1. Boot to Recovery OS by restarting your machine and holding down the Command and R keys at startup. 2. Launch Terminal from the Utilities menu. 3. Enter the following command: $ csrutil disable Then, quit MRT process, delete MRT file as mentioned above Finally, boot to recovery OS, in terminal, $csrutil enable, restart MacBook – Chunlei Zheng Aug 26 '17 at 1:35
  • 3
    I've edited the post to explain the risks - no judgement for people that want to experiment and modify - but we should warn people what they're doing in case they don't know what you are recommending. – bmike Aug 26 '17 at 12:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .