What is the MRT Process on Mac: High CPU Usage [Updated for 2024]

MRT, or the Malicious Software Removal Tool, is considered the first line of defense against malware for macOS. While MRT aims to safely remove malware, XProtect focuses on detecting them.

This MRT eliminates malware when it acquires new data and scans for infections when you log in or restart your Mac. So, without much ado, let's delve deeper into the MRT process on a Mac and why MRT is using high CPU on Mac, among other things.

(Image: MRT App for Mac)

What is the MRT process on a Mac?

In this part, we will discuss what the MRT process is! So, the MRT.app or the Malware Removal Tool is a high-level application located in the /CoreServices folder, not in the Utilities folder or the Applications where regular user-level programs reside. Although the MRT comes in an app package form, it is not launched by the user.

On the other hand, MRT.app has command-line options to run it in daemon or agent mode. Additionally, it can throw error texts about unknown malware families. Unfortunately, the error texts do not provide any clues about the MACOS.35846e4 attributes.

Several techniques are involved in identifying MRT targets. To begin tinkering with a binary file, you should acquire a copy of it. Working with a binary copy is a best practice during a reverse-engineering assessment, even if you don't intend to modify the binary and system integrity protections guard it.

Running the ditto command saves a copy of the binary to your desktop, where you can retrieve it easily: sudo ditto MRT ~/Desktop/MRT COPY.

Advantages

- It's the front-line security measure in macOS. - It can safely remove all malware from your Mac. - While running in daemon mode, MRT performs countless signature checks against Apple's CRL. - The proxy mode operation is quieter and more efficient.

Drawbacks

• In 2019, MRT removed one app, Zoom, while leaving behind a meaningful vulnerability.
• The latest version of MRT 1.68 for mac is known for leaking internal information to third parties.

Why does MRT consume high CPU on Mac? How to fix it?

Have you ever checked the Activity Monitor and found the MRT process consuming a significant amount of CPU resources or memory? If so, your Mac might slow down or become unresponsive automatically. For instance, the MRT process in the Activity Monitor might cause high CPU usage on your Mac while it's scanning various compressed files on the system, removing malware, or installing a fresh malware database.

If you're still wondering why MRT is using high CPU on your Mac, it could be due to the automatic downloading of any apps from the App Store and memory capacity. However, this process shouldn't take long unless MRT encounters issues. If the MRT process is affecting your regular workflow, the best solutions are:

Force quit MRT

Does MRT (MacOS Malware Removal Tool) use a lot of CPU resources? If so, you can temporarily disable it and any related processes by selecting the process in Activity Monitor, clicking the “X” button, and choosing “Force Quit.”

Update on the Mass Rapid Transit (MRT)

A malfunctioning MRT might attempt to remove certain programs or files, causing it to get stuck in an infinite loop and consume significant CPU resources. The MRT does update automatically; however, there are instances when it might not. Hence, one of the best solutions is to update to the latest version of MRT, which comes with enhanced functionality.

Step 1: Open the terminal.

Step 2: Type the command sudo softwareupdate --background and press Return.

While the background check might take some time to complete, you should continue to check whether the MRT process has disappeared from Activity Monitor.

Boot in safe mode

A corrupted cache could be the real issue causing MRT to hog your Mac's CPU. However, you can resolve this by restarting your Mac in Safe Mode. If your macOS works normally in Safe Mode, then a simple restart is your best bet.

Conclusions

MRT.app is the premier and official malware scanner and removal tool for Mac OS X and macOS. It is integrated into all of Apple's anti-malware initiatives and can be accessed in the /SYSTEM/Library/CoreServices/ directory. Its purpose is to guard against any potential malware attacks.

If you're not aware, MRT also helps remove numerous unwanted or malicious Safari modifiers and extensions, such as Nariabox.safariextz, SafariProxy, parts of Dok, and so on. Apple updates MRT.app from time to time, and those updates can affect the definitions of other antivirus software, causing it to incorrectly flag MRT.app as malware.