Jump to content
LarB

is RTProtectionDaemon a legit part of Malwarebytes?

Recommended Posts

On 8/24/2017 at 5:56 PM, ldc said:

RTProtectionDaemon consumed 50% of my physical RAM and rendered my iMac intolerably slow. I'm uninstalling it and removing it from my collection of software for my users until this is fixed. It's great software that is now as terrible as the dreaded MacKeeper as bloatware. Bummer.

Can't blame you. It's not very impressive that a company allows a known bug which cripples the one feature of their program and is the foundation of their subscription model to exist this length of time with no intentions of repairing it for at least another month. It's apparent that lack of proper testing was conducted on the program before the initial release because of it existing on multiple OS versions and hardware platforms. I would suggest that you can disable Real-Time Protection and kill the running RTProtectionDaemon process. You can disable the daemon from launching and residing in memory, even after reboots, by using 'launchctl' in terminal.

Caution: This will render the Real-Time Protection service component of Malwarebytes inoperable. This will be persistent after reboots/shutdowns and updates to the program. To reverse the operation then issue the commands in steps 2 & 3 by replacing 'disable' and 'unload' with 'enable' and 'load' respectively.

0. Disable Real-Time Protection

1. Kill the process 'RTProtectionDaemon'

2. Issue the commands 'sudo launchctl disable /Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'

3. Issue the commands 'sudo launchctl unload /Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'

4. Check running processes to determine if 'RTProtectionDaemon' process is active

Share this post


Link to post
Share on other sites
22 minutes ago, robertleeblairjr said:

Can't blame you. It's not very impressive that a company allows a known bug which cripples the one feature of their program and is the foundation of their subscription model to exist this length of time with no intentions of repairing it for at least another month. It's apparent that lack of proper testing was conducted on the program before the initial release because of it existing on multiple OS versions and hardware platforms. I would suggest that you can disable Real-Time Protection and kill the running RTProtectionDaemon process. You can disable the daemon from launching and residing in memory, even after reboots, by using 'launchctl' in terminal.

Caution: This will render the Real-Time Protection service component of Malwarebytes inoperable. This will be persistent after reboots/shutdowns and updates to the program. To reverse the operation then issue the commands in steps 2 & 3 by replacing 'disable' and 'unload' with 'enable' and 'load' respectively.

0. Disable Real-Time Protection

1. Kill the process 'RTProtectionDaemon'

2. Issue the commands 'sudo launchctl disable /Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'

3. Issue the commands 'sudo launchctl unload /Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'

4. Check running processes to determine if 'RTProtectionDaemon' process is active

Step two has a missing reference in the command. "2. Issue the commands 'sudo launchctl disable system/Library/LaunchDaemons/com.malwarebytes.mbam.rtprotection.daemon.plist'"

Caution: This will render the Real-Time Protection service component of Malwarebytes inoperable. This will be persistent after reboots/shutdowns and updates to the program. To reverse the operation then issue the commands in steps 2 & 3 by replacing 'disable' and 'unload' with 'enable' and 'load' respectively.

Warning: Malwarebytes GUI will become inoperable because of the reliance upon this background service persisting in memory.

Share this post


Link to post
Share on other sites
On 8/26/2017 at 10:31 AM, robertleeblairjr said:

Can't blame you. It's not very impressive that a company allows a known bug which cripples the one feature of their program and is the foundation of their subscription model to exist this length of time with no intentions of repairing it for at least another month.

Robert,

I appreciate that you are disappointed. You're making this exceedingly clear.

However, most people haven't even noticed this problem, much less any issues caused by it. And getting High Sierra compatibility into place is a far higher priority. That will have a far bigger impact if not fixed before the release of High Sierra. If we were to take time off of that to go through the additional processes necessary to release another update, it would put us behind schedule and cause far more significant problems to larger groups of people. If it were not for the critical need to finish work on the High Sierra issue, we would have released the RTProtectionDaemon fix by now.

Please be patient.

Share this post


Link to post
Share on other sites
4 hours ago, treed said:

Robert,

I appreciate that you are disappointed. You're making this exceedingly clear.

However, most people haven't even noticed this problem, much less any issues caused by it. And getting High Sierra compatibility into place is a far higher priority. That will have a far bigger impact if not fixed before the release of High Sierra. If we were to take time off of that to go through the additional processes necessary to release another update, it would put us behind schedule and cause far more significant problems to larger groups of people. If it were not for the critical need to finish work on the High Sierra issue, we would have released the RTProtectionDaemon fix by now.

Please be patient.

I DGAF if you appreciate any complaint I've made. When you get off the tip, then I've got one lined up for you to slob on. You can't confirm nor deny the vast number of people that are "actually" affected by this bug which doesn't target a small number of users. Why? Because statistically, unless you have a large enough and randomly selected sample size to mimic the population, then it's inaccurate to deduce there's a correlation to warrant an immediate repair. However, if it had been properly tested or if there were not enough resources allocated to support initial release bugs, then the release should have been postponed until the release of macOS 10.13. Instead, you condemn the users who are being used as the test bed for this software. In other words, your effective use to me for dealing with this program, thus far, is about the same as Tom.

Share this post


Link to post
Share on other sites

Since a restart two days ago,  RTProtectionDeamon memory usage is stable at 24.8 MB. I have absolutely no idea what is different now. Still the same version 3.0.2.422 and Real-Time Protection on.

Share this post


Link to post
Share on other sites

I'm probably a bit late to this thread as I see a fix is promised for early Sept.

I'm using a Late 2012, 27" iMac, 3.4 GHz Intel Core i7, with 16GB RAM and OS 10.12.6 (Sierra)

With a slowing mac, I've been running Activity Monitor for about 10 days and noticed "RTProtectionDaemon" hogging top spot in Memory and %CPU all that time.

Memory currently about 6GB and %CPU from 15% to.......100% (occassionaly)

I'm looking forward to the update. I hope it makes a big difference. ;o)

(The numbers in this thread may not be indicative of how many people are suffering issues, as many won't know to use Activity Monitor to identify the problem, and then Googling "RT Protection Daemon" comes up with no helpful results, it has to be written "RTProtectionDaemon" to find it is a Malwarebytes issue.)

Edited by TimBall

Share this post


Link to post
Share on other sites

I have the 3.1.1.505 version installed and it still takes up over 50% of my CPU.

I will be uninstalling immediately. Too bad since I loved the older version and use it on al my Windows PCs.

Share this post


Link to post
Share on other sites
21 hours ago, pkdesign said:

I have the 3.1.1.505 version installed and it still takes up over 50% of my CPU.

From the log files you sent me, it looks like your installation of Malwarebytes for Mac has been damaged somehow, and is not operating correctly. I'd recommend uninstalling and then reinstalling. If that doesn't help, you may have a problem with your system, though what that might be I don't know.

Share this post


Link to post
Share on other sites

I am still seeing this issue on the latest Mac OSX. 

RTP Protection demon and other Malwarebytes components are also showing that they are missing code signatures (install LittleSnitch and then install Malwarebytes) and these missing signatures prevent auto updating of the malware detection library. The only way to allow it is add an exception to the improperly / unsigned code... This really should be fixed urgently as it looks like Malwarebytes actually contains compromised code (malware...?)... That is not good. It must be resolved.

Also RTP is using a lot of memory.

Share this post


Link to post
Share on other sites

This has been fixed already.

We've seen some cases where, following a Malwarebytes update from the older version that had the code signing issue, macOS does not refresh a kernel cache that can result in this problem. If you restart your computer, it should clear it up.

Share this post


Link to post
Share on other sites

Unfortunately it's not fixed. Run LittleSnitch and you will see (it's a great / the best firewall I've ever used by the way so useful anyway). It alerts to a discrepancy between code signatures, even on the version of Malwarebytes from last night. I've tried many times.

Share this post


Link to post
Share on other sites
2 minutes ago, ns108 said:

Unfortunately it's not fixed. Run LittleSnitch and you will see (it's a great / the best firewall I've ever used by the way so useful anyway). It alerts to a discrepancy between code signatures, even on the version of Malwarebytes from last night. I've tried many times.

It has, we've tested and verified with Little Snitch and Apple's own code signature tools. There's nothing wrong with the code signature on the latest several versions of Malwarebytes for Mac.

You need to:

  1. Make absolutely sure you're running the latest version of Malwarebytes for Mac (currently, that's version 3.1.1)
  2. Restart the computer

If that doesn't fix it, something has corrupted your installation of Malwarebytes for Mac, and you should uninstall it and reinstall.

Uninstall directions: https://support.malwarebytes.com/docs/DOC-1928

Share this post


Link to post
Share on other sites

Thank you for your incredible proactive support first of all. Really commendable!

I have done what you suggest but will try again. Each time however, the result is the same... so far.

I assume latest version is the one I downloaded from my inside my premium account on your site, correct?

Share this post


Link to post
Share on other sites
Just now, ns108 said:

I assume latest version is the one I downloaded from my inside my premium account on your site, correct?

It should be, but just in case there's any question, you can get the latest version directly from here:

https://malwarebytes.com/mac-download

Currently, that should give you version 3.1.1.

Share this post


Link to post
Share on other sites

FWIW I am still finding that turning on real-time protection on the current version of MWB for Mac (3.2.36) is having the same problems as a few months ago. The RTProtectionDaemon ended up having noticeably high processor usage over time (confirmed by Activity Monitor) so I had to turn it off again.

Share this post


Link to post
Share on other sites

I am trialling MB on two Macs and on both the RT Protection Daemon is using a lot of CPU time and slowing the machines down. Memory seems OK but not happy with CPU usage. Any thoughts? Cheers Robert

Mini-SSD- 2018-05-29 at 11.02.44 am.png

Share this post


Link to post
Share on other sites

Yes, Treed monitors this forum and has replied multiple times, probably with all the ideas he has.

Make sure you are running the latest version 3.3.32.1398. 

There is a beta version 3.3.33.xxxx available for testing now if you would be willing to try it. Just check the appropriate box in Settings under "Beta Application Updates" and then select "Check for Updates..." from the Malwarebytes menu.

If you've tried everything without success then open a support ticket

Share this post


Link to post
Share on other sites
On 5/28/2018 at 6:05 PM, robfol said:

I am trialling MB on two Macs and on both the RT Protection Daemon is using a lot of CPU time and slowing the machines down. Memory seems OK but not happy with CPU usage. Any thoughts? Cheers Robert

This thread really isn't the right place to get help with this. There have been many changes to the software since this thread started, and there are many different unrelated conversations here. I recommend doing exactly what Al said. Specifically:

  1. Get the latest release version of the software. Currently, in-app updates are being metered, so you may not see the latest version yet, but you can download it from here:
    • https://malwarebytes.com/mac-download
    • Once you have the latest version, in the future, a manual check for updates in-app will always give you the latest version, regardless of metering.
  2. If that doesn't help, turn on Beta Application Updates and install the latest beta, if any.
  3. If that still doesn't help, submit a support ticket. We may need to ask you to collect more information about your computer and the state of the Malwarebytes software, and doing that on a public forum is not the best idea.

Share this post


Link to post
Share on other sites

THANKS, Thomas & Alvarnell, will follow your advice. You should note that for a newcomer it is almost impossible to know where to go in the very confusing forums

Edited by robfol

Share this post


Link to post
Share on other sites

'Fraid I've suffered from this issue also. The RTProtection Daemon was monopolizing CPU to the point where MS Word in particular had slowed below a crawl on my MacBook Pro. Was tearing my hair out with spectres of expensive hardware issues until combination of Activity Monitor and Google led me to this thread -  and the real culprit. 

Malwarebytes now uninstalled and normal service resumed.  

And I was just on verge of signing up for an annual subscription, too... :(

 

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.