Microsoft Malicious Software Removal Tool runs multiple times daily - not once per month as expected

Anonymous
2016-01-02T22:29:43+00:00

Since, it seems, the 1151 Windows 10 Home 64b upgrade, my laptop has been running MRT on a more than daily basis, producing high disk usage. At least twice, I've run it manually, which allows me to see the details, and noticed MRT detecting 97 malicious files, but then, continuing to run, looping and scanning the same set of files repeatedly, until it finally quits with no malicious files detected.

Norton Internet Security, Norton Power Eraser, and Malware Bytes, all current, have detected no malicious files, but I am thinking it is obvious there are malicious files. Not sure what else to do at this point, any advice would be appreciated.

Moved from Windows

Original title: Microsoft Software Removal Tool running more than daily, with high disk usage

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

44 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2016-02-06T16:21:15+00:00

    Hi Brian,

    Thank you very much for your hard work and detailed explanations to clarify the problem (and rule out some alternatives).  Folks like you make it so much easier to identify such problems and get them resolved much more quickly.

    I've little doubt your dedication helped Paul a great deal in reproducing the problem and, as a Forum Owner, he'll be naturally more effective escalating this with the internal Microsoft team that handles this.  He really has the ball now from the perspective of this Forum.

    Now comes the REALLY hard part: being patient while they find the cause and implement (and/or possibly provide an interim workaround) fix.

    "Just in case" {and for educational purposes}, I'll also be keeping an eye on this thread until it is resolved.

    Thanks once again - and best wishes.

    Kosh

    Was this answer helpful?

    0 comments
  2. Anonymous
    2016-02-05T20:16:37+00:00

    To Kosh - The latest quick and full scans I listed, immediately before your latest reply, as well as one of the scans I ran back on January 3rd, were indeed run manually from the 890830 link you posted, and downloaded only 5 minutes before I started running the scans. The results of running it on January 3rd, and February 3rd were virtually the same, at a point 7-10 minutes into the scan, it lists 97 infected files, and continues to list them through the rest of the process, whether quick, or full. Yet when the program completes, it states no files are infected. Again, these are the results while running the manual versions, and the one run on February 3rd was a different up to date version.

    Also, though I did run the manual version on January 3rd, the 'automatic' Windows Update version did continue to run many times daily. Below is the log listing all the times MRT has run During and after the last manual full scan run on February 3rd using the separate version:

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Wed Feb 03 19:42:07 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Results Summary:

    ----------------

    No infection found.

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 15:10:19 2016

    Return code: 0 (0x0)

    .12202.0)

    Started On Thu Feb 04 04:29:20 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 04:32:01 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Thu Feb 04 16:11:02 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 16:11:11 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Thu Feb 04 16:40:54 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 16:41:05 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Thu Feb 04 17:00:31 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 17:00:42 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Thu Feb 04 19:19:03 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 19:19:28 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Thu Feb 04 20:02:00 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 20:02:13 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Thu Feb 04 20:52:28 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 20:52:42 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Thu Feb 04 21:03:44 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 21:03:50 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Thu Feb 04 21:12:33 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 21:12:40 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Thu Feb 04 21:20:41 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 21:20:48 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Thu Feb 04 21:35:13 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 21:35:23 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Thu Feb 04 21:46:00 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 21:46:06 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Fri Feb 05 02:40:08 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Fri Feb 05 02:43:36 2016

    Return code: 0 (0x0) 

    The only reason there is only one scan listed for the 5th is that my laptop was off until I replied to this thread.

    The bold part shows that the 'automatic' version ran once during  4:29am for a few minutes while the manual full image was in the middle of running for 20 hours straight.

    Below that, you can see that MRT has continued to run many times daily for the past two days since that manual run.

    Hope this helps.

    To PaulSey - I am glad to hear the behavior is reproducible, as that should make it possible to identify the issue and fix it.

    Thanks for the update.

    -Brian

    Was this answer helpful?

    0 comments
  3. Anonymous
    2016-02-05T17:05:50+00:00

    Thank you very much, Paul.

    Kosh

    Was this answer helpful?

    0 comments
  4. Anonymous
    2016-02-05T15:58:40+00:00

    Hi Brian,

    I wanted to let you know that I was able to reproduce the scenario you are describing with MRT appearing to run multiple times in a given day.

    It has been reported to the correct team and I have been told this is not intended and we are working towards a resolution.

    Paul...

    Was this answer helpful?

    0 comments
  5. Anonymous
    2016-02-04T20:36:46+00:00

    Hi Brian,

    Please see https://support.microsoft.com/en-us/kb/890830 and download this separate though very similar version of the program and install it.  Read the information.  It does not replace the monthly (normally once-run) version, but I'm hoping the similarities might "break the cycle of repetition."

    This is a actually a new way to manually run it on your system at your whim vs. "monthly" - though I'd consider it rarely needed - but should help us test a lot easier.  When we're done, you can delete it if you wish.

    Please run this new version first in quick mode, reboot, and check/post the log entries and/or see if anything different occurs with this run.  Let's see if you see the interim 97 threat report.  Wait to see if the repetition problem returns.  If neither, then let's cross our fingers.  If so, please provide the requested screenshots.

    Thanks,

    Kosh

    Was this answer helpful?

    0 comments