Microsoft Malicious Software Removal Tool runs multiple times daily - not once per month as expected

Hi Brian,

Thank you for your reply.

I suggest you to Run the Safety Scanner and check if it helps.

Refer the link below to download the Microsoft Safety scanner.

http://www.microsoft.com/security/scanner/en-us/default.aspx?wa=wsignin1.0

Note: The Microsoft Safety Scanner expires 10 days after being downloaded. To rerun a scan with the latest anti-malware definitions, download and run the Microsoft Safety Scanner again.

Anti-Virus Disclaimer:

For antivirus scan:

Note**:** Any data files that are infected may only be cleaned by deleting the file entirely, which means there is a potential for data loss.

Hope this helps. If the issue remains unresolved, please get back to us and we would be happy to help.

Hi, I did run the above on the default setting, not the full scan, and it detected nothing.

I again noticed the same files being scanned more than once over the hour or so it took to run. Is this indeed regular behavior, for both the Safety Scanner and Malicious Software Removal Tool, just checking the same file for different infections, or is it irregular to scan the same file multiple times?

As the above Scanner did not detect anything, I downloaded and manually ran the MRT. The results were reproduced. At a point about 7 minutes in, the window quickly updated to show 97 files infected:


Yet, by the time it finished running around 50 minutes later, it displayed no infections:


When I viewed details, no infection was listed as present in the list. I do not know if there is any accessible log that might list those 97 files.

I just ran Malware Bytes today as well, with no malware detected. A recent full scan using Norton Internet Security and even Norton Power Eraser, which required a restart, detected nothing as well.

Yet the 'automatic' version of MRT is still running more than once daily, though it is supposed to run only once a month, according to Microsoft documents:

 

I've never seen a status report announcing an infection.

I still wonder about infection, and also to what extent MRT, and my other virus protection, has been compromised. I also wonder how MRT might be repaired so it will not continue to run on a more than daily basis.

Thank you for your time and expertise.

I did provide a reply one month ago and never received a response, other than to mark this as answered, or provide a reply. ;-)

Correct. Although we may have seen this behavior in the past, I think this thread is a good candidate to be escalated (together with some other similar/related reports) to see if we can get some attention from someone from the MS Antimalware Team to take a look.

L8R

PD.- For testing purposes: Is NIS working correctly? May you be willing to 'uninstall' it and temporarily use WD instead?

Hi Brian,

Please open a command prompt as an Administrator and type the following and then hit enter:

%windir%\debug\mrt.log

and copy/paste the last page or so of the results in your next reply.

It should look something like the following, but note the difference between the last 2 entries (red arrows + 1 to different text; note red arrow & 2 showing it took minutes (not seconds) to complete). That's sort of what I'm looking for:


Please see https://support.microsoft.com/en-us/kb/890830 and download this separate program and install it.  Read the information.  Please run if first in quick mode and then again in full mode.  This is a way to manually run it on your system at your whim vs. "monthly" - though I'd consider it rarely needed - but should help us test a lot easier.  When we're done, you can delete it if you wish.

Despite the "all clear" from the other programs you used, I suspect the root issue is either some infection or the remnant of an infection OR a problem with the most recent update/upgrade (or both).  This download should help rule out the latter.  Then we'll need to delve deeper into making sure your system is clear of all infections.  But small steps so we don't get ahead of ourselves.

Hope this helps and please keep us informed.

Thanks,

Kosh