Note: I have already read MRT Process using large unbounded amount of memory (but here the context is different: "I'd rather not remove it") and a few similar questions/articles like MRT is peaking my cpu, but a good complete solution was not easily findable.

On my Macbook Pro with High Sierra, the CPU fan was making a loud noise, and after doing top in Terminal, I noticed that a process called MRT was using ~100% CPU.

So how do I remove MRT (Malware Removal Tool)?


Removing Apple's Malware Removal Tool is not a good idea, so it's better to figure out why it's running high.

Also, 100% is a per-core figure, so on quad-core i7, you can use up to 800% CPU. Various OS processes, like Spotlight, will use similar levels of CPU for short periods.

MRT may use significant CPU for a short time while it does its job: downloading malware lists from Apple, and then checking/removing anything on that list.

If you have got a 'runaway' MRT process, then that might indicate that it is trying (but not succeeding) to remove some malware. You could try using MalwareBytes to check and remove anything on your disk, as suggested on the other thread.

At worst, I would just recommend restarting, rather than disabling SIP and killing MRT, both of which severely reduce the security of your Mac -- particularly if malware is already on board.

| improve this answer | |

(As I struggled to solve the problem, I share it with the Q&A feature).

This is not recommended, but if you know what you are doing, and really want to remove MRT, here is how:

  • First reboot in Recovery mode (CMD+R pressed while reboot), open a Terminal, then do: csrutil disable

  • Then reboot in normal mode, open a terminal and do:

    sudo launchctl stop com.apple.mrt
    sudo launchctl remove com.apple.mrt
    chmod -R -x+X /System/Library/CoreServices/MRT.app
    sudo pkill MRT
| improve this answer | |
  • 1
    This is rather the equivalent of disabling an antivirus because it keeps finding viruses, or reducing Covid-19 testing to keep the numbers down. It doesn't fix the issue, it merely circumvents the reporting of it. – Tetsujin Jun 30 at 9:15
  • To take your example, in some cases, it's fine to not have an antivirus if you know what you are doing, and don't run arbitrary executables found on Internet. This choice is personal, depending on how people want to use their computer/how experienced they are. – Basj Jun 30 at 9:26
  • I'm sure the 9 million people hijacked by Necurs all thought the same thing - blogs.microsoft.com/on-the-issues/2020/03/10/… – Tetsujin Jun 30 at 9:31
  • The overlap between "knowing what you are doing" and "removing MRT" is very small indeed. – benwiggy Jun 30 at 9:37
  • @benwiggy No, there are many use cases : 1) you don't want to use a program that makes a huge CPU fan noise during 30 minnutes without being informed of what's going on (it would not be difficult to put a dialog box "We have noticed a malware and we are removing it", or "We are downloading the new malware database") 2) you prefer to install a third-party anti-malware program 3) you want to develop a malware yourself and not be stopped by this (joking) – Basj Jun 30 at 9:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .