How to know MRT version?

[camelia]

Hello,

How do I know the Malware Removal Tool installed version via terminal in macOS Mojave and macOS High Sierra?

Thanks
Came

 

[honestone33]

Not sure what you are asking. Do you have a "Malware Removal Tool" already installed on your Mac? And if so, what is the name of it?

 

[camelia]

Not sure what you are asking. Do you have a "Malware Removal Tool" already installed on your Mac? And if so, what is the name of it?

MRTConfigData_10.14.pkg

 

[chabig]

Open System Information (option-Apple) is a quick way. Then select Applications (under Software) in the left column. MRT will be in the resulting application list, along with the version number and date installed.

 

[camelia]

Open System Information (option-Apple) is a quick way. Then select Applications (under Software) in the left column. MRT will be in the resulting application list, along with the version number and date installed.

I need the code to run in terminal

running in Terminal

Thanks
Camelia

 

[chabig]

A quick web search returned this:

How to Check XProtect Version in Mac OS

Need to know what version of Gatekeeper and Xprotect are installed on a Mac? You can find this information through the command line of Mac OS. GateKeeper, MRT (Malware Removal Tool), and XProtect a…

osxdaily.com

 

[revmacian]

A quick web search returned this:

How to Check XProtect Version in Mac OS

Need to know what version of Gatekeeper and Xprotect are installed on a Mac? You can find this information through the command line of Mac OS. GateKeeper, MRT (Malware Removal Tool), and XProtect a…

osxdaily.com

Good find!

 

[honestone33]

Hmm, never knew about MRT. As they say, learn something new every day!

I use Malwarebytes and ClamXAv to check on adware/malware/viruses.

 

[gilby101]

Silent Knight from here: https://eclecticlight.co/2019/11/04/silentknight-and-silnite-now-look-at-firmware-more-thoroughly/ tells you all the macOS security versions.

 

[bogdanw]

GetSysInfo.scpt https://gist.github.com/b0gdanw/9829f8ca03655b77cf08aeb3af936c93

set MacOSVers to do shell script "defaults read /System/Library/CoreServices/SystemVersion.plist ProductVersion"
set MacOSBuild to do shell script "defaults read /System/Library/CoreServices/SystemVersion.plist ProductBuildVersion"

set XProtectVers to do shell script "defaults read /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.meta.plist Version"
set XProtectDate to do shell script "GetFileInfo -d /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.meta.plist"

set GatekeeperVers to do shell script "defaults read /private/var/db/gkopaque.bundle/Contents/version.plist CFBundleShortVersionString"
set GatekeeperDate to do shell script "GetFileInfo -d /private/var/db/gkopaque.bundle/Contents/version.plist"

set SIPVer to do shell script "defaults read /System/Library/Sandbox/Compatibility.bundle/Contents/version.plist CFBundleShortVersionString"
set SIPDateShort to do shell script "GetFileInfo -d /System/Library/Sandbox/Compatibility.bundle/Contents/version.plist"

set MRTVer to do shell script "defaults read /System/Library/CoreServices/MRT.app/Contents/version.plist CFBundleShortVersionString"
set MRTDate to do shell script "GetFileInfo -d /System/Library/CoreServices/MRT.app/Contents/version.plist"

set SIPStatus to do shell script "/usr/bin/csrutil status"
set GatekeeperStatus to do shell script "spctl --status | sed -e s/'assessments'//g"

display dialog tab & tab & tab & "MacOS " & MacOSVers & " (" & MacOSBuild & ")" & return & return & "Component " & tab & tab & "Version " & tab & tab & "Updated " & return & return & "XProtect " & tab & tab & XProtectVers & tab & tab & XProtectDate & return & "Gatekeeper " & tab & tab & GatekeeperVers & tab & tab & tab & GatekeeperDate & return & "SIP" & tab & tab & tab & tab & SIPVer & tab & tab & tab & SIPDateShort & return & "MRT " & tab & tab & tab & MRTVer & tab & tab & tab & MRTDate & return & return & SIPStatus & return & "Gatekeeper Status:" & GatekeeperStatus & return buttons {"Close"} default button 1

Displays results like this

 

[camelia]

I found the code to run in terminal and I do not need to download anything:

defaults read /System/Library/CoreServices/MRT.app/Contents/version CFBundleShortVersionString

Thanks
Camelia

 

[Riwam]

May I ask you where do you look for code when needed. Do you have a book with Terminal instructions and if there is such a book may I know it’s name and the author?
Thank you very much in advance!
Ed

 

[camelia]

May I ask you where do you look for code when needed. Do you have a book with Terminal instructions and if there is such a book may I know it’s name and the author?
Thank you very much in advance!
Ed

No, I do not have a book to suggest you, but google is your best friend

Came

 

[Riwam]

No, I do not have a book to suggest you, but google is your best friend

Came

Thank you!

 

[madmin]

You already have a solution but I wanted to point out another very easy method using the softwareupdate utility in terminal, eg:

softwareupdate --history --all --verbose | more

This shows all your installs including XProtect and MRT updates. If you're only interested in the MRT stuff you can adjust the command to something like:

softwareupdate --history --all --verbose | grep MRT

 

[bogdanw]

softwareupdate --history --all --verbose | grep MRT

Thanks for that, it's more compact than system_profiler SPInstallHistoryDataType | grep -A 4 "MRTConfigData"

 

[camelia]

You already have a solution but I wanted to point out another very easy method using the softwareupdate utility in terminal, eg:

softwareupdate --history --all --verbose | more

This shows all your installs including XProtect and MRT updates. If you're only interested in the MRT stuff you can adjust the command to something like:

softwareupdate --history --all --verbose | grep MRT

So for Gatekeeper the command to run in terminal will be

softwareupdate --history --all --verbose | grep Gatekeeper

?

Thanks
Camelia

 

[madmin]

@camelia yes. Actually you can shorten it somewhat, which may please @bogdanw, to:

softwareupdate --history |grep Gatek

on my current machine that will output the following:

Gatekeeper Configuration Data 181 28/08/2019 at 17:14:29
Gatekeeper Configuration Data 174 01/08/2019 at 08:24:31
Gatekeeper Configuration Data 173 23/07/2019 at 17:21:12
Gatekeeper Configuration Data 172 17/07/2019 at 19:30:40
Gatekeeper Configuration Data 171 03/07/2019 at 07:54:27
Gatekeeper Configuration Data 170 25/06/2019 at 18:54:03
Gatekeeper Configuration Data 169 18/06/2019 at 05:13:21
Gatekeeper Configuration Data 167 04/06/2019 at 09:52:26
Gatekeeper Configuration Data 166 13/05/2019 at 20:24:02
Gatekeeper Configuration Data 165 18/04/2019 at 20:31:59
Gatekeeper Configuration Data 164 26/03/2019 at 07:54:44
Gatekeeper Configuration Data 163 21/02/2019 at 07:46:22
Gatekeeper Configuration Data 162 07/02/2019 at 23:54:02
Gatekeeper Configuration Data 160 23/01/2019 at 09:12:24
Gatekeeper Configuration Data 158 09/01/2019 at 18:43:21
Gatekeeper Configuration Data 157 06/12/2018 at 23:59:53
Gatekeeper Configuration Data 156 31/10/2018 at 15:15:29
Gatekeeper Configuration Data 155 25/09/2018 at 20:33:12
Gatekeeper Configuration Data 154 08/09/2018 at 15:39:51

If you only want to see the last installation of Gatekeeper (or whatever) you can add a -m flag like so

softwareupdate --history |grep -m 1 Gatek

which would output:

Gatekeeper Configuration Data 181 28/08/2019 at 17:14:29

voilà HTH.

 

[camelia]

@camelia yes. Actually you can shorten it somewhat, which may please @bogdanw, to:

softwareupdate --history |grep Gatek

on my current machine that will output the following:

Gatekeeper Configuration Data 181 28/08/2019 at 17:14:29
Gatekeeper Configuration Data 174 01/08/2019 at 08:24:31
Gatekeeper Configuration Data 173 23/07/2019 at 17:21:12
Gatekeeper Configuration Data 172 17/07/2019 at 19:30:40
Gatekeeper Configuration Data 171 03/07/2019 at 07:54:27
Gatekeeper Configuration Data 170 25/06/2019 at 18:54:03
Gatekeeper Configuration Data 169 18/06/2019 at 05:13:21
Gatekeeper Configuration Data 167 04/06/2019 at 09:52:26
Gatekeeper Configuration Data 166 13/05/2019 at 20:24:02
Gatekeeper Configuration Data 165 18/04/2019 at 20:31:59
Gatekeeper Configuration Data 164 26/03/2019 at 07:54:44
Gatekeeper Configuration Data 163 21/02/2019 at 07:46:22
Gatekeeper Configuration Data 162 07/02/2019 at 23:54:02
Gatekeeper Configuration Data 160 23/01/2019 at 09:12:24
Gatekeeper Configuration Data 158 09/01/2019 at 18:43:21
Gatekeeper Configuration Data 157 06/12/2018 at 23:59:53
Gatekeeper Configuration Data 156 31/10/2018 at 15:15:29
Gatekeeper Configuration Data 155 25/09/2018 at 20:33:12
Gatekeeper Configuration Data 154 08/09/2018 at 15:39:51

If you only want to see the last installation of Gatekeeper (or whatever) you can add a -m flag like so

softwareupdate --history |grep -m 1 Gatek

which would output:

Gatekeeper Configuration Data 181 28/08/2019 at 17:14:29

voilà HTH.

May I ask you what macOS do you have installed in your Mac? (HS, Mojave or Catalina)

Thanks
Came

 

[madmin]

May I ask you what macOS do you have installed in your Mac? (HS, Mojave or Catalina)

Mojave. Did you try this on Catalina ?

 

[camelia]

Mojave. Did you try this on Catalina ?

Nop, I haven't install Catalina yet, what I have read in this forum Catalina still has some bugs...

Came

 

[madmin]

Nop, I haven't install Catalina yet, what I have read in this forum Catalina still has some bugs...

Came

Yeah same here, I don't want to be dealing with the bugs right now. Last year I upgraded relatively early to Mojave, this time I'm going to wait. I think I'll do some tests of Catalina in VMs beforehand as well.

 

[Peadogie]

Mojave. Did you try this on Catalina ?

I tried the 'softwareupdate --history --all --verbose | more' command in Catalina and it does work.

 

[donmontalvo]

For Big Sur:

/usr/bin/defaults read /Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist CFBundleShortVersionString