Microsoft Malicious Software Removal Tool runs multiple times daily - not once per month as expected

Anonymous
2016-01-02T22:29:43+00:00

Since, it seems, the 1151 Windows 10 Home 64b upgrade, my laptop has been running MRT on a more than daily basis, producing high disk usage. At least twice, I've run it manually, which allows me to see the details, and noticed MRT detecting 97 malicious files, but then, continuing to run, looping and scanning the same set of files repeatedly, until it finally quits with no malicious files detected.

Norton Internet Security, Norton Power Eraser, and Malware Bytes, all current, have detected no malicious files, but I am thinking it is obvious there are malicious files. Not sure what else to do at this point, any advice would be appreciated.

Moved from Windows

Original title: Microsoft Software Removal Tool running more than daily, with high disk usage

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

44 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2016-02-02T17:54:48+00:00

    Hi,

    I have removed the escalation and have sent the details to the concerned team. Will reply here once we hear from them.

    We appreciate your patience meanwhile.

    Thank you.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2016-02-02T21:28:59+00:00

    Thank you both Kosh and Arvind for actions taken.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2016-02-03T23:31:58+00:00

    Hi, 

    Thanks All,

    As it turns out, this is indeed still going on.

    The MRT log goes back as far as November 21, and shows that MRT has run up to 20 times a day on a daily basis since then. Here is the log only for February: (I've been turning my laptop off more often lately just to stop MRT from running)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 02:35:28 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 02:36:08 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 02:47:22 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 02:47:25 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 11:46:09 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 11:46:24 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 12:17:12 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 12:17:18 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 16:17:36 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 16:18:00 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 20:14:58 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 20:15:50 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 21:24:17 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 21:24:23 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 21:38:40 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 21:38:44 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 21:59:41 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 21:59:47 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 22:08:27 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 22:08:30 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 22:23:18 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 22:23:21 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 22:33:21 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 22:33:23 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 22:38:40 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 22:38:43 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 22:55:07 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 22:55:09 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 23:09:12 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 23:09:16 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 23:16:42 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 23:16:45 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 23:31:38 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 23:31:41 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 23:39:09 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 23:39:12 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Mon Feb 01 23:48:32 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Feb 01 23:48:38 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Tue Feb 02 00:11:13 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Feb 02 00:11:15 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Tue Feb 02 02:02:54 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Feb 02 02:03:42 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Tue Feb 02 02:19:14 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Feb 02 02:19:23 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Tue Feb 02 14:14:00 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Feb 02 14:14:09 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Tue Feb 02 17:51:57 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Feb 02 17:51:59 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Tue Feb 02 17:56:48 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Feb 02 17:56:50 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Tue Feb 02 18:23:24 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Feb 02 18:23:25 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Tue Feb 02 22:37:57 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Feb 02 22:39:11 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Wed Feb 03 01:41:36 2016

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Wed Feb 03 02:19:29 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Wed Feb 03 02:19:45 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Wed Feb 03 02:29:33 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Wed Feb 03 02:29:38 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Wed Feb 03 10:18:27 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Wed Feb 03 10:18:48 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Wed Feb 03 16:06:08 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Microsoft Windows Malicious Software Removal Tool Finished On Wed Feb 03 16:06:19 2016

    Return code: 0 (0x0)

    This was the first listing from the log:

    Microsoft Windows Malicious Software Removal Tool v5.30, November 2015 (build 5.30.12000.0)

    Started On Sat Nov 21 00:41:32 2015

    Engine: 1.1.12205.0

    Signatures: 1.209.673.0

    Microsoft Windows Malicious Software Removal Tool Finished On Sat Nov 21 00:46:48 2015

    Return code: 0 (0x0)

    As you can see, Windows Update has correctly been updating the MRT, as the version, build, engine and signatures have changed through automatic Windows Update, yet it still continues to run multiple times on a daily basis. Also, it now seems each time it tries to run, it only runs for seconds before it is somehow interrupted. Back when I started this thread, it was running much longer and at times slowing my computer to a crawl. 

    I can post the full log, though it is very long, if you want to see how it has changed since late November.

    As I stated in my January 3rd post, I ran both the Safety Scanner and the manual version of MRT multiple times. When I did, at one point, 7 minutes in, each scan listed 97 infected files. Yet each scan continued to run 50 more minutes, and when they each completed, neither listed any infected files.

    I'll now try to run a full scan, but in the past, the option did not seem to come up, as the result of each quick scan was negative by the time it completed, and so the full scan did not come up.

    I'll let you know how it goes, but that may take hours, and so I wanted to respond with the logs etc., before then.

    Thank you all for your time.

    Regards,

    Brian

    Was this answer helpful?

    0 comments
  4. Anonymous
    2016-02-04T20:20:39+00:00

    Ran the Full Scan. After 10 minutes, this came up:

    By the time it was done, around 20 hours later, this was the result:

    the log for that scan states:

    Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)

    Started On Wed Feb 03 19:42:07 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.1308.0

    Results Summary:

    No infection found.

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 15:10:19 2016

    Return code: 0 (0x0)

    .12202.0)

    Another impossibly short scan ran this afternoon.

    Brian

    Was this answer helpful?

    0 comments
  5. Anonymous
    2016-02-04T20:36:46+00:00

    Hi Brian,

    Please see https://support.microsoft.com/en-us/kb/890830 and download this separate though very similar version of the program and install it.  Read the information.  It does not replace the monthly (normally once-run) version, but I'm hoping the similarities might "break the cycle of repetition."

    This is a actually a new way to manually run it on your system at your whim vs. "monthly" - though I'd consider it rarely needed - but should help us test a lot easier.  When we're done, you can delete it if you wish.

    Please run this new version first in quick mode, reboot, and check/post the log entries and/or see if anything different occurs with this run.  Let's see if you see the interim 97 threat report.  Wait to see if the repetition problem returns.  If neither, then let's cross our fingers.  If so, please provide the requested screenshots.

    Thanks,

    Kosh

    Was this answer helpful?

    0 comments