robertleeblairjr
-
Posts
21 -
Joined
-
Last visited
Content Type
Events
Profiles
Forums
Posts posted by robertleeblairjr
-
-
On 8/30/2017 at 11:31 AM, JRM said:
Same problem here, OS 10.12.5. RTProtection Daemon running Shows memory and CPU. The RTProtection Daemon actually keeps restarting as I See the PID change about 10 seconds
system log shows
Aug 30 12:07:23 XXXX-Mac-mini com.apple.xpc.launchd[1] (com.malwarebytes.mbam.settings.daemon[474]): Service exited with abnormal code: 69
Aug 30 12:07:23 XXXX-Mac-mini com.apple.xpc.launchd[1] (com.malwarebytes.mbam.settings.daemon): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug 30 12:07:25 XXXX-Mac-mini com.apple.xpc.launchd[1] (com.malwarebytes.mbam.rtprotection.daemon[471]): Service exited with abnormal code: 69
Aug 30 12:07:33 XXXX-Mac-mini com.apple.xpc.launchd[1] (com.malwarebytes.mbam.settings.daemon[476]): Service exited with abnormal code: 69Shows this over and over and over
The directory com.apple.xpc.launchd contains *.plist files that will contain entries for disabled daemons for different users. The location of the directory is '/private/var/db/com.apple.xpc.launchd/'. You can determine the numeric code for your User ID by entering the command 'id' in terminal. This will list the groups you're a member of, as well. So, the file '/private/var/db/com.apple.xpc.launchd/disabled.x.plist' whereby the "x" in 'disabled.x.plist' will be the User ID numeric code and is used for disabling the launching of daemons. Check the disabled files for any entries, which are in pairs of <key><value>, that contain strings referencing to Malwareybytes. You can use any program that will read/edit *.plist files, such as, Xcode or use 'cat' in terminal. If you find any entries for Malwarebytes in the *.plist files, except disabled.plist, then remove those entries. In the disabled.plist file, ensure that entries for Malwarebytes are set to false. If you've made any changes, then I suggest you to reboot your OS. You can perform a check on your system with the program EtreCheck. You can obtain a copy of a sample that I took for the process in a previous post to compare to the sample you could take of the RTProtectionDaemon process on your system. Also, I would suggest that you update your OS to 10.12.6.
-
I would suggest for you to perform a manual search for Malwareybtes created files and remove them or use another third-party application to search for the files for removal. You could use this program, EtreCheck, that's recommended by many users on the Apple Communities support site.
-
18 minutes ago, ChrisV said:
BTW. Is this the actual installed OS and not a virtualization of the OS? The initial errors in the sample maybe related to the touch control interface and I can't say that this doesn't cause a conflict. Change the the touch bar strip to "Expanded Control Strip" to test the app. This feature should resort to just the static function buttons; ie F1, F2, etc. I would suggest going, as far as, changing the function of the touch bar strip, uninstalling Malwarebytes with the uninstaller, removing any files created by Malwarebytes under /Library/, rebooting, and reinstalling Malwarebytes. If this doesn't work, then you may need someone to connect remotely to your system for providing assistance.
-
2 minutes ago, ChrisV said:
Yes, RTProtectionDaemon is present. I am running 10.12.6 on a MacBook Pro (15-inch, Late 2016) being booted from the internal HDD. I am not using any other anti-malware, anti-virus, or app monitoring programs
Select the 'RTProtectionDaemon' process under the memory tab and select the "i" tab to display information related to this process which will open in another window. From this window, select "Sample" which will open another window. Alternatively, the drop down menu with the sprocket has the same command to perform a 'Sample Process' of the highlighted running process. This command will take some time to perform iterations on this before it dumps a sample text in the window which you can save to a text file for uploading to the thread. I've attached a sample text of the 'RTProtectionDaemon' process, which you can feel free to download and compare with yours.
-
On 8/26/2017 at 0:29 PM, ChrisV said:
I ran both commands. It changed nothing. I am still getting the same error.
Open the "Activity Monitor" program. Is the 'RTProtectionDaemon' process active in the memory tab? Which OS version are you currently using and is it being booted from the internal drive? Are you using any other anti-malware, anti-virus, or app monitoring programs which would restrict the process from being launched by root?
-
4 hours ago, treed said:
Robert,
I appreciate that you are disappointed. You're making this exceedingly clear.
However, most people haven't even noticed this problem, much less any issues caused by it. And getting High Sierra compatibility into place is a far higher priority. That will have a far bigger impact if not fixed before the release of High Sierra. If we were to take time off of that to go through the additional processes necessary to release another update, it would put us behind schedule and cause far more significant problems to larger groups of people. If it were not for the critical need to finish work on the High Sierra issue, we would have released the RTProtectionDaemon fix by now.
Please be patient.
I DGAF if you appreciate any complaint I've made. When you get off the tip, then I've got one lined up for you to slob on. You can't confirm nor deny the vast number of people that are "actually" affected by this bug which doesn't target a small number of users. Why? Because statistically, unless you have a large enough and randomly selected sample size to mimic the population, then it's inaccurate to deduce there's a correlation to warrant an immediate repair. However, if it had been properly tested or if there were not enough resources allocated to support initial release bugs, then the release should have been postponed until the release of macOS 10.13. Instead, you condemn the users who are being used as the test bed for this software. In other words, your effective use to me for dealing with this program, thus far, is about the same as Tom.
-
I am curious as to if there's a correlation to the 'RTProtectionDaemon' process virtual memory size and the leaking of real memory. The current virtual memory size of 'RTProtectionDaemon' is approximately 2.5 GB, even though, the real memory use is less than 50 MB after I disabled Real-Time Protection. However, the increase in real memory size used by the process appears to reach virtual size. However, I killed the process before allowing it to go beyond 2 GB.
-
On 8/20/2017 at 11:28 AM, ChrisV said:
Just installed Malwarebytes for Mac 3.0. I can't get the interface to load. All I get is a window with Background Service is Offline. Running MacOS 10.12.6.
This can be caused by the 'RTProtectionDaemon' process being disabled and not actively persistent in memory, not present in the install, was corrupted, third-party program conflict, etc. It's possible that the problem is caused by another component of the Malwarebytes program. I can mimic this exact problem whenever disabling the load and persistence of 'RTProtectionDaemon' process by 'launchd'. I don't like the developer's choice to make the Malwarebytes GUI dependent upon 'RTProtectionDaemon' process being active since it's primary function is Real-Time Protection, which is a service component of the Trial and Premium subscription models. You could attempt the following commands in terminal to determine if this resolves the issue.
0. Issue the commands 'sudo launchctl enable system/Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'
1. Issue the commands 'sudo launchctl load /Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'
-
Remove the dependency of the Malwareybytes GUI being inoperable if RTProtectionDaemon is not persistent in memory. Perhaps, allow the program to not require this persistence once the model transitions to Free from Trial or Premium. I realize that this maybe a security feature for other potential programs' malicious intent to disable the Real-Time Protection feature but this was not a necessary feature of previous versions 1.x. Now that there's a subscription model for this program, this feature wouldn't be necessary for those users who choose to use manual scan/update and use only those features of the Free version.
-
22 minutes ago, robertleeblairjr said:
Can't blame you. It's not very impressive that a company allows a known bug which cripples the one feature of their program and is the foundation of their subscription model to exist this length of time with no intentions of repairing it for at least another month. It's apparent that lack of proper testing was conducted on the program before the initial release because of it existing on multiple OS versions and hardware platforms. I would suggest that you can disable Real-Time Protection and kill the running RTProtectionDaemon process. You can disable the daemon from launching and residing in memory, even after reboots, by using 'launchctl' in terminal.
Caution: This will render the Real-Time Protection service component of Malwarebytes inoperable. This will be persistent after reboots/shutdowns and updates to the program. To reverse the operation then issue the commands in steps 2 & 3 by replacing 'disable' and 'unload' with 'enable' and 'load' respectively.
0. Disable Real-Time Protection
1. Kill the process 'RTProtectionDaemon'
2. Issue the commands 'sudo launchctl disable /Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'
3. Issue the commands 'sudo launchctl unload /Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'
4. Check running processes to determine if 'RTProtectionDaemon' process is active
Step two has a missing reference in the command. "2. Issue the commands 'sudo launchctl disable system/Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'"
Caution: This will render the Real-Time Protection service component of Malwarebytes inoperable. This will be persistent after reboots/shutdowns and updates to the program. To reverse the operation then issue the commands in steps 2 & 3 by replacing 'disable' and 'unload' with 'enable' and 'load' respectively.
Warning: Malwarebytes GUI will become inoperable because of the reliance upon this background service persisting in memory.
-
On 8/24/2017 at 5:56 PM, ldc said:
RTProtectionDaemon consumed 50% of my physical RAM and rendered my iMac intolerably slow. I'm uninstalling it and removing it from my collection of software for my users until this is fixed. It's great software that is now as terrible as the dreaded MacKeeper as bloatware. Bummer.
Can't blame you. It's not very impressive that a company allows a known bug which cripples the one feature of their program and is the foundation of their subscription model to exist this length of time with no intentions of repairing it for at least another month. It's apparent that lack of proper testing was conducted on the program before the initial release because of it existing on multiple OS versions and hardware platforms. I would suggest that you can disable Real-Time Protection and kill the running RTProtectionDaemon process. You can disable the daemon from launching and residing in memory, even after reboots, by using 'launchctl' in terminal.
Caution: This will render the Real-Time Protection service component of Malwarebytes inoperable. This will be persistent after reboots/shutdowns and updates to the program. To reverse the operation then issue the commands in steps 2 & 3 by replacing 'disable' and 'unload' with 'enable' and 'load' respectively.
0. Disable Real-Time Protection
1. Kill the process 'RTProtectionDaemon'
2. Issue the commands 'sudo launchctl disable /Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'
3. Issue the commands 'sudo launchctl unload /Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'
4. Check running processes to determine if 'RTProtectionDaemon' process is active
-
This must be the thread for useless posts.
Great work on previous versions of Malwarebytes 1.x. However, I'm less impressed with the speed by which the developers issued an update to repair the one component of the program that the company is planning on people to purchase a subscription. Version 3.x still has an RTProtectionDaemon memory handling problem. The update to fix this bug won't be released until greater than 30 days since the initial reports of this malfunction. This problem is reported to affect multiple OS versions and platforms which leads me to speculate that there wasn't proper testing of the program before the release. I wouldn't value this service at $39.99/yr with this evident lack of concern to speedily repair nor to fully test a program that the company is wanting people to spend money towards. But, otherwise, excellent work.
-
5 hours ago, joshvickerson said:
I have a hunch this delay is related to the launch of macOS 10.13, which MWB doesn't work on because, IIRC, 10.13 is dropping support for kernel extensions which MWB currently relies on.
I too am having the problem with bloated RAM usage; at nearly 3GB after my Mac has been on for a couple days.
I just read an Apple Support page that references the changes to kernel extensions. Apple is not removing or eliminating support for third-party kernel extensions but are introducing a new feature called "User Approved Kernel Extension Loading". https://support.apple.com/en-us/HT208019
The feature which is described as being a secure kernel extension loading procedure is described in more detail on the Apple Developer site. https://developer.apple.com/library/content/technotes/tn2459/_index.html#//apple_ref/doc/uid/DTS40017658
-
6 hours ago, RonaldPR said:
I hope the fix will be published before my "premium trial" ends (in 14 days), so I can decide whether it is worth to pay for a license.
I accidentally became aware of the memory issue when I viewed Activity Monitor about some other unrelated process. RTProtectionDeamon was using 9.3GB (!) of memory. I have lots of memory installed, so it did not cause performance problems (yet). After a restart, memory usage by RTProtectionDeamon started with 30.5MB, steadily increasing. Now, about 20 hours later, it uses 426.5MB.
RTProtectionDaemon grew to almost 2GB within 24 hours of performing a clean installation, not an upgrade, with the latest version, 3.0.2.422. The developers are aware of the problem and/or know the program bug to squash with an update. However, it's yet to be seen that this is a priority for them to have a steadfast release. This is according to a staff member on this board who stated that the bug would not be resolved with an update until sometime in September.
-
4 hours ago, joshvickerson said:
I have a hunch this delay is related to the launch of macOS 10.13, which MWB doesn't work on because, IIRC, 10.13 is dropping support for kernel extensions which MWB currently relies on.
I too am having the problem with bloated RAM usage; at nearly 3GB after my Mac has been on for a couple days.
Fairly valid assumption. I can confirm the same malfunction exists, as the previous, 3.x version. The newest version, 3.0.2.422, that was released in the last couple of days is still having the runaway memory problem. My clean installation, not an upgrade, had RTProtectionDaemon grow to almost 2GB within 24 hours. I disabled Real-Time Protection and killed the process.
-
On 8/20/2017 at 9:34 PM, treed said:
FYI, we have a fix for the memory issue, which will be included in an update planned for September.
Okay. Thanks for the update. However, like myself and those only interested in occasionally using the manual scanning feature of the program, then this is irrelevant for us during the trial period. I would believe the company's concern would be a product that loses it's major selling point for a subscription if the feature that distinguishes it from the free version is malfunctioning. Hence, those that may consider subscribing to this product that are using it during the trial period are not able to depend on the initial release, 3.x, to not have memory leak issues could be the determining factor for them to not care for subscribing and staying with the free version. Either way, mine and others suggestions are to those who have the program and notice within their processes that RTProtectionDaemon is consuming large amounts of memory, then kill the process and disable Real-Time Protection. Also, you can disable the daemon from being launched by using 'launchctl' and its sub-commands because it is present, even after, disabling the Real-Time Protection feature upon reboot. I'm aware of why the daemon is present after the disabling of the feature in the GUI. So, if the user does not plan on re-enabling Real-Time Protection, then they do not have a need for the daemon residing in memory.
-
20 minutes ago, ManfredLC said:
Thanks for the good news! :-)
Manfred
Not sure which you believe is good about the news; the developers potentially discovering the problem or taking almost a month to release an update which is the selling feature of this program to gain subscribers. Otherwise, it's just a revised look of their older product which was more stable.
-
On 8/10/2017 at 1:20 PM, treed said:
Were you actually seeing RTProtectionDaemon taking large amounts of your CPU for no good reason? If so, send me a direct message. I'd like to gather more information.
If that wasn't the case, are you certain it was RTProtectionDaemon that caused the performance issue, or could it have been some other coincidental process? I'm not trying to deny the possibility, just trying to gather data.
RTProtectionDaemon was not, itself, showing high CPU utilization. However, I've noticed a correlation between it being enabled or disabled and the sudden "kernel_task" using many CPU cycles. I've done multiple trials and there appears to be some merit to this problem whenever performing certain tasks, especially, when the OS is transitioning to sleep or hibernate. I've made a copy of the file and unloaded the daemon from running until this problem is resolved in a future update.
-
On 8/9/2017 at 5:58 PM, Muckaluck said:
I found the Rtprotectiondaemon definitely slowed my computer down to a crawl, as it was taking up 1.5GB memory before i killed the process.
It seems to me that this is more like beta software, and that users need to tread carefully. I also noticed that unlike the PC version there's no way to end the trial, so users are stuck with the faulty realtime protection unless they carefully change the settings. This seems like an unfortunate time to start charging full price ($40/yr) for the Mac version.
I can confirm that this is exactly happening with my system. I've left "Real-Time Protection" disabled and the memory consumption of "RTProtectionDaemon" stays relatively small. Of course, the irony of this problem is that you lose the one function of this program which is supposed to encourage the user to purchase a subscription. Why purchase one when you can't use "Real-Time Protection" or do not want to be bothered with this problem and having to constantly kill the process? The program is nothing more than merely updated GUI and possibly improved scanning engine. However, the older version 1.x worked the same without "Real-Time Protection" and you didn't have to see that it was in "Trial Mode". Hopefully, Malwarebytes doesn't begin a nag campaign to subscribe with this new version.
-
I can confirm that this problem has plagued my system with macOS 10.12.6 since installing the newly released Malwarebytes version 3.x. If I have "Real-Time Protection" enabled, then the memory consumption increases to as large as 1GB before I've disabled it and killed the process. If I leave the "Real-Time Protection" disabled, then I do not experience this growing memory problem with "RTProtectionDaemon".
Background Service is Offline
in Malwarebytes for Mac Support Forum
Posted
This thread is not devoted to your curiosity about MacKeeper and whether to use that software. But, it's garbage and has had a bad history with its business model. Either way, create your own thread for these inquiries.