This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Since, it seems, the 1151 Windows 10 Home 64b upgrade, my laptop has been running MRT on a more than daily basis, producing high disk usage. At least twice, I've run it manually, which allows me to see the details, and noticed MRT detecting 97 malicious files, but then, continuing to run, looping and scanning the same set of files repeatedly, until it finally quits with no malicious files detected.
Norton Internet Security, Norton Power Eraser, and Malware Bytes, all current, have detected no malicious files, but I am thinking it is obvious there are malicious files. Not sure what else to do at this point, any advice would be appreciated.
Moved from Windows
Original title: Microsoft Software Removal Tool running more than daily, with high disk usage
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
Hi Brian,
I wanted to let you know that I was able to reproduce the scenario you are describing with MRT appearing to run multiple times in a given day.
It has been reported to the correct team and I have been told this is not intended and we are working towards a resolution.
Paul...
Thank you very much, Paul.
Kosh
To Kosh - The latest quick and full scans I listed, immediately before your latest reply, as well as one of the scans I ran back on January 3rd, were indeed run manually from the 890830 link you posted, and downloaded only 5 minutes before I started running the scans. The results of running it on January 3rd, and February 3rd were virtually the same, at a point 7-10 minutes into the scan, it lists 97 infected files, and continues to list them through the rest of the process, whether quick, or full. Yet when the program completes, it states no files are infected. Again, these are the results while running the manual versions, and the one run on February 3rd was a different up to date version.
Also, though I did run the manual version on January 3rd, the 'automatic' Windows Update version did continue to run many times daily. Below is the log listing all the times MRT has run During and after the last manual full scan run on February 3rd using the separate version:
Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)
Started On Wed Feb 03 19:42:07 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 15:10:19 2016
Return code: 0 (0x0)
.12202.0)
Started On Thu Feb 04 04:29:20 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 04:32:01 2016
Return code: 0 (0x0)
Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)
Started On Thu Feb 04 16:11:02 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 16:11:11 2016
Return code: 0 (0x0)
Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)
Started On Thu Feb 04 16:40:54 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 16:41:05 2016
Return code: 0 (0x0)
Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)
Started On Thu Feb 04 17:00:31 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 17:00:42 2016
Return code: 0 (0x0)
Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)
Started On Thu Feb 04 19:19:03 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 19:19:28 2016
Return code: 0 (0x0)
Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)
Started On Thu Feb 04 20:02:00 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 20:02:13 2016
Return code: 0 (0x0)
Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)
Started On Thu Feb 04 20:52:28 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 20:52:42 2016
Return code: 0 (0x0)
Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)
Started On Thu Feb 04 21:03:44 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 21:03:50 2016
Return code: 0 (0x0)
Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)
Started On Thu Feb 04 21:12:33 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 21:12:40 2016
Return code: 0 (0x0)
Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)
Started On Thu Feb 04 21:20:41 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 21:20:48 2016
Return code: 0 (0x0)
Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)
Started On Thu Feb 04 21:35:13 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 21:35:23 2016
Return code: 0 (0x0)
Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)
Started On Thu Feb 04 21:46:00 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 04 21:46:06 2016
Return code: 0 (0x0)
Microsoft Windows Malicious Software Removal Tool v5.32, January 2016 (build 5.32.12202.0)
Started On Fri Feb 05 02:40:08 2016
Engine: 1.1.12400.0
Signatures: 1.213.1308.0
Microsoft Windows Malicious Software Removal Tool Finished On Fri Feb 05 02:43:36 2016
Return code: 0 (0x0)
The only reason there is only one scan listed for the 5th is that my laptop was off until I replied to this thread.
The bold part shows that the 'automatic' version ran once during 4:29am for a few minutes while the manual full image was in the middle of running for 20 hours straight.
Below that, you can see that MRT has continued to run many times daily for the past two days since that manual run.
Hope this helps.
To PaulSey - I am glad to hear the behavior is reproducible, as that should make it possible to identify the issue and fix it.
Thanks for the update.
-Brian
Hi Brian,
Thank you very much for your hard work and detailed explanations to clarify the problem (and rule out some alternatives). Folks like you make it so much easier to identify such problems and get them resolved much more quickly.
I've little doubt your dedication helped Paul a great deal in reproducing the problem and, as a Forum Owner, he'll be naturally more effective escalating this with the internal Microsoft team that handles this. He really has the ball now from the perspective of this Forum.
Now comes the REALLY hard part: being patient while they find the cause and implement (and/or possibly provide an interim workaround) fix.
"Just in case" {and for educational purposes}, I'll also be keeping an eye on this thread until it is resolved.
Thanks once again - and best wishes.
Kosh
1+
And thanks to you too, Kosh, for having a look.
Just as a side note, I wonder why the current Jan-V32 (to expire next PatchTuesday) was/is not listed in KB890830 (Last Review: 01/12/2016 19:53:00 - Revision: 161.2)?
Lets hope a fix is coming with the next update release (Feb-V33).
