Microsoft Malicious Software Removal Tool runs multiple times daily - not once per month as expected

Anonymous

Since, it seems, the 1151 Windows 10 Home 64b upgrade, my laptop has been running MRT on a more than daily basis, producing high disk usage. At least twice, I've run it manually, which allows me to see the details, and noticed MRT detecting 97 malicious files, but then, continuing to run, looping and scanning the same set of files repeatedly, until it finally quits with no malicious files detected.

Norton Internet Security, Norton Power Eraser, and Malware Bytes, all current, have detected no malicious files, but I am thinking it is obvious there are malicious files. Not sure what else to do at this point, any advice would be appreciated.

Moved from Windows

Original title: Microsoft Software Removal Tool running more than daily, with high disk usage

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

44 answers

Anonymous

2016-02-28T18:58:59+00:00

SusanMillerVA has said on February 9/15, 2016 (Source):

Questions about MSRT, Microsoft Safety Scanner and browser’s private window apparently needed to download MSRT/Microsoft Safety Scanner made me question if there was something else wrong with my computer and question MSRT and the Safety Scanner as good/bad for Windows 10!

I even checked my downloaded MSRT at VirusTotal

(https://www.virustotal.com/en/file/9bf978045b8d1e198cf8b42a68c20bb9bfcad67d3d394bea9114fe3cc7b66c05/analysis/1454379543/).

With questions still in my head about MSRT, I was following [this] thread [and] noticed that my MSRT was running more than once daily and that my issue had started much earlier than I thought.

Here is my log:

Microsoft Windows Malicious Software Removal Tool v5.31, December 2015 (build 5.31.12100.0)

Started On Mon Dec 21 08:45:53 2015

Engine: 1.1.12300.0

Signatures: 1.211.637.0

Microsoft Windows Malicious Software Removal Tool Finished On Mon Dec 21 08:47:26 2015

Return code: 0 (0x0)

Microsoft Windows Malicious Software Removal Tool v5.31, December 2015 (build 5.31.12100.0)

Started On Mon Dec 21 09:51:18 2015

Engine: 1.1.12300.0

Signatures: 1.211.637.0

Microsoft Windows Malicious Software Removal Tool Finished On Mon Dec 21 09:51:23 2015

Return code: 0 (0x0)

Microsoft Windows Malicious Software Removal Tool v5.31, December 2015 (build 5.31.12100.0)

Started On Mon Dec 21 10:07:29 2015

Engine: 1.1.12300.0

Signatures: 1.211.637.0

Microsoft Windows Malicious Software Removal Tool Finished On Mon Dec 21 10:07:34 2015

Return code: 0 (0x0)

===============================================

Microsoft Windows Malicious Software Removal Tool v5.31, December 2015 (build 5.31.12100.0)

Started On Tue Jan 12 20:48:38 2016

Microsoft Windows Malicious Software Removal Tool v5.31, December 2015 (build 5.31.12100.0)

Started On Wed Jan 13 00:27:43 2016

Engine: 1.1.12300.0

Signatures: 1.211.637.0

Microsoft Windows Malicious Software Removal Tool Finished On Wed Jan 13 00:28:13 2016

Return code: 0 (0x0)

Microsoft Windows Malicious Software Removal Tool v5.31, December 2015 (build 5.31.12100.0)

Started On Wed Jan 13 01:53:08 2016

Engine: 1.1.12300.0

Signatures: 1.211.637.0

Microsoft Windows Malicious Software Removal Tool Finished On Wed Jan 13 01:53:19 2016

Return code: 0 (0x0)

Microsoft Windows Malicious Software Removal Tool v5.31, December 2015 (build 5.31.12100.0)

Started On Wed Jan 13 10:12:56 2016

Microsoft Windows Malicious Software Removal Tool v5.31, December 2015 (build 5.31.12100.0)

Started On Wed Jan 13 10:20:54 2016

Engine: 1.1.12300.0

Signatures: 1.211.637.0

Microsoft Windows Malicious Software Removal Tool Finished On Wed Jan 13 10:22:06 2016

Return code: 0 (0x0)

Microsoft Windows Malicious Software Removal Tool v5.31, December 2015 (build 5.31.12100.0)

Started On Wed Jan 13 10:58:06 2016

Engine: 1.1.12300.0

Signatures: 1.211.637.0

Microsoft Windows Malicious Software Removal Tool Finished On Wed Jan 13 10:58:29 2016

Return code: 0 (0x0)

Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

Started On Wed Jan 13 17:48:44 2016

Engine: 1.1.12400.0

Signatures: 1.213.1308.0

Quick Scan Results:

Threat Detected: Program:Win32/CompromisedCert.D and Removed!

Action: Remove, Result: 0x00000000

rootcert://02C2D931062D7B1DC2A5C7F5F0685064081FB221

SigSeq: 0x00006A6C1B37DFA6

Results Summary:

Found Program:Win32/CompromisedCert.D and Removed!

Microsoft Windows Malicious Software Removal Tool Finished On Wed Jan 13 17:53:53 2016

Return code: 6 (0x6)

Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

Started On Wed Jan 13 18:12:02 2016

Engine: 1.1.12400.0

Signatures: 1.213.1308.0

Microsoft Windows Malicious Software Removal Tool Finished On Wed Jan 13 18:12:20 2016

Return code: 0 (0x0)

Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

Started On Wed Jan 13 23:48:27 2016

Engine: 1.1.12400.0

Signatures: 1.213.1308.0

Microsoft Windows Malicious Software Removal Tool Finished On Wed Jan 13 23:48:37 2016

Return code: 0 (0x0)

===============================================

Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

Started On Wed Feb 10 10:14:12 2016

Engine: 1.1.12400.0

Signatures: 1.213.1308.0

Microsoft Windows Malicious Software Removal Tool Finished On Wed Feb 10 10:14:19 2016

Return code: 0 (0x0)

Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

Started On Thu Feb 11 01:35:28 2016

Engine: 1.1.12400.0

Signatures: 1.213.1308.0

Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 11 01:36:13 2016

Return code: 0 (0x0)

Microsoft Windows Malicious Software Removal Tool v5.33, February 2016 (build 5.33.12300.0)

Started On Thu Feb 11 08:46:55 2016

Engine: 1.1.12400.0

Signatures: 1.213.4702.0

Results Summary:

No infection found.

Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 11 08:51:33 2016

Return code: 0 (0x0)

Microsoft Windows Malicious Software Removal Tool v5.33, February 2016 (build 5.33.12300.0)

Started On Thu Feb 11 09:07:46 2016

Engine: 1.1.12400.0

Signatures: 1.213.4702.0

Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 11 09:08:51 2016

Return code: 0 (0x0)

Microsoft Windows Malicious Software Removal Tool v5.33, February 2016 (build 5.33.12300.0)

Started On Thu Feb 11 09:25:58 2016

Engine: 1.1.12400.0

Signatures: 1.213.4702.0

Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 11 09:26:04 2016

Return code: 0 (0x0)

==================================================

Should MRT_HB appear in a Windows 10's Task Scheduler log (My Task Scheduler has this...)?

... waiting for Microsoft to solve the three runs per day of MRT.exe. I will certainly have to wait for that to happen for my MRT.exe to stop running that many times.

Reposting...

@PaulSey...

Any updates about the ongoing investigation you may share with us?

Just as a side note, I wonder why the current Jan-V32 (to expire next PatchTuesday) was/is not listed in KB890830 (Last Review: 01/12/2016 19:53:00 - Revision: 161.2)?

Let's hope a fix is coming with the next update release (Feb-V33).

I may suspect the expected fix was not included with the February (V33) release, nor this latest version is listed (same as for the Jan-V32 as quoted above) in KB890830 (Last Review: 02/09/2016 18:46:00 - Revision: 162.0)?
Was this answer helpful?

0 comments No comments
Anonymous

2016-02-15T19:40:49+00:00

@PaulSey...

Any updates about the ongoing investigation you may share with us?

Just as a side note, I wonder why the current Jan-V32 (to expire next PatchTuesday) was/is not listed in KB890830 (Last Review: 01/12/2016 19:53:00 - Revision: 161.2)?

Let's hope a fix is coming with the next update release (Feb-V33).

I may suspect the expected fix was not included with the February (V33) release, nor this latest version is listed (same as for the Jan-V32 as quoted above) in KB890830 (Last Review: 02/09/2016 18:46:00 - Revision: 162.0)?
Was this answer helpful?

0 comments No comments
Anonymous

2016-02-15T18:28:11+00:00

No this is not expected behaviour.

Microsoft got informed and they are looking for a solution:

![](http://fud.community.services.support.microsoft.com/Fud/FileDownloadHandler.ashx?fid=d7249dd7-0847-44e9-b46e-cf9c780fcd3b)

See this thread for more information: <removed because threads got merged>

Cheers,

J
Was this answer helpful?

0 comments No comments
Anonymous

2016-02-15T17:01:42+00:00

Folks,

before Windows 10 the MSRT was downloaded and run with the monthly security updates and produced one log entry per month in C:\Windows\debug\mrt.log.

I find from the log on our new W10 PC that MSRT is run a number of times each day - instead of one entry per month in the log there are now several each day. I suspect it is related to the 'Maintenance' schedule as some of the times

coincide, although the schedule I have set is ignored and Maintenance seems to do its own thing.

Is this expected behaviour and is the list of malware being updated each time ?

As the log is just a text file can I purge old entries occasionally to make it more readable ?

Regards

Tom

[Moved from Windows]
Was this answer helpful?

0 comments No comments
Anonymous

2016-02-06T21:44:28+00:00

1+

And thanks to you too, Kosh, for having a look.

Just as a side note, I wonder why the current Jan-V32 (to expire next PatchTuesday) was/is not listed in KB890830 (Last Review: 01/12/2016 19:53:00 - Revision: 161.2)?

Lets hope a fix is coming with the next update release (Feb-V33).
Was this answer helpful?

0 comments No comments