Microsoft Malicious Software Removal Tool runs multiple times daily - not once per month as expected

Anonymous
2016-01-02T22:29:43+00:00

Since, it seems, the 1151 Windows 10 Home 64b upgrade, my laptop has been running MRT on a more than daily basis, producing high disk usage. At least twice, I've run it manually, which allows me to see the details, and noticed MRT detecting 97 malicious files, but then, continuing to run, looping and scanning the same set of files repeatedly, until it finally quits with no malicious files detected.

Norton Internet Security, Norton Power Eraser, and Malware Bytes, all current, have detected no malicious files, but I am thinking it is obvious there are malicious files. Not sure what else to do at this point, any advice would be appreciated.

Moved from Windows

Original title: Microsoft Software Removal Tool running more than daily, with high disk usage

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

44 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2016-03-26T23:06:22+00:00

    Hi All, sorry for the delayed response. I was actually gone most of last week as well, and have been spending this week catching up.

    I just reviewed my logs using, '%windir%\debug\mrt.log', and discovered a large change with the March Update to MRT. Through February, the log shows MRT running many times daily, up to a dozen, but this is past history since the March Update, so I won't post the log. This is the log since March 8:

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Tue Mar  8 21:52:43 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Results Summary:

    No infection found.

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Mar  8 22:15:19 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Tue Mar  8 22:26:08 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Mar  8 22:26:14 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Sun Mar 13 19:22:11 2016

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Sun Mar 13 19:32:18 2016

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Sun Mar 13 20:18:06 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Sun Mar 13 20:22:22 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Mon Mar 14 01:22:21 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send ServiceErrorReport heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Mar 14 01:23:28 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Mon Mar 14 06:23:14 2016

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Mon Mar 14 11:22:21 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send ServiceErrorReport heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Mar 14 11:23:25 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Mon Mar 14 16:22:21 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send ServiceErrorReport heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Mar 14 16:23:47 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Mon Mar 14 20:01:19 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Mar 14 20:02:24 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Mon Mar 14 21:22:21 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send ServiceErrorReport heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Mar 14 21:23:14 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Tue Mar 15 02:22:21 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send ServiceErrorReport heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Mar 15 02:23:25 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Tue Mar 15 07:22:22 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send ServiceErrorReport heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Mar 15 07:25:26 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Tue Mar 15 12:22:21 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send ServiceErrorReport heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Mar 15 12:23:27 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Tue Mar 15 17:22:21 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send ServiceErrorReport heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Mar 15 17:23:20 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Tue Mar 15 20:05:46 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Mar 15 20:06:37 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Wed Mar 16 21:09:30 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Wed Mar 16 21:10:24 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Thu Mar 17 09:22:22 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send ServiceErrorReport heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Mar 17 09:23:19 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Thu Mar 17 20:31:59 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Mar 17 20:32:59 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Fri Mar 18 10:22:22 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send ServiceErrorReport heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Fri Mar 18 10:23:19 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Fri Mar 18 22:09:25 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Microsoft Windows Malicious Software Removal Tool Finished On Fri Mar 18 22:10:26 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Sat Mar 19 16:22:22 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Microsoft Windows Malicious Software Removal Tool Finished On Sat Mar 19 16:24:17 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Sat Mar 19 22:56:38 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Microsoft Windows Malicious Software Removal Tool Finished On Sat Mar 19 22:57:30 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Sun Mar 20 20:07:53 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Microsoft Windows Malicious Software Removal Tool Finished On Sun Mar 20 20:08:07 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Mon Mar 21 21:52:11 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Microsoft Windows Malicious Software Removal Tool Finished On Mon Mar 21 21:53:48 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Tue Mar 22 21:57:55 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Mar 22 22:00:14 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Wed Mar 23 19:36:33 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Microsoft Windows Malicious Software Removal Tool Finished On Wed Mar 23 19:36:49 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Thu Mar 24 20:12:48 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Failed to collect/send heartbeat. HR = 83760002

    Microsoft Windows Malicious Software Removal Tool Finished On Thu Mar 24 20:14:13 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Fri Mar 25 11:14:13 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Microsoft Windows Malicious Software Removal Tool Finished On Fri Mar 25 11:17:31 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Fri Mar 25 20:05:32 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Microsoft Windows Malicious Software Removal Tool Finished On Fri Mar 25 20:06:20 2016

    Return code: 0 (0x0)

    I noticed one complete run on March 8, during the running of Windows update. After that, every run seems to have been for less than one minute. The gap from March 8 to March 13, was because my laptop was turned off.

    Then from the 13th through the 15th, I got 4-6 runs daily, And the message,

    "Failed to collect/send ServiceErrorReport heartbeat. HR = 83760002"

    and

    "Failed to collect/send heartbeat. HR = 83760002",

    appeared for the first time, and with virtually every 'run' in that period, and through the 18th. 

    From the 16th on MRT has 'only' been running once or twice a day...but is still running once or twice a day, rather than once a month. Since the 18th, for whatever reason, I've only received one heartbeat message. I also noticed a few runs that start, and never give a finish message.

    @Susan Miller I did check the Task Scheduler and this is what I got:

    I'd bet for that period from the 13th through the 18th, I'd have been getting the error message as well, so the cases may at least be somewhat related.

    Not sure what else to do at this point. At least MRT is now down to running less than one minute at a time and only once or twice a day, it used run for over an hour and take up much of my CPU. Making me restart my laptop.

    Regards,

    Brian

    Was this answer helpful?

    0 comments
  2. Anonymous
    2016-03-30T03:09:32+00:00

    Brian, you can see my MRT problems in my new thread http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/mrthb-or-mrterrorhb-or-mrtexe-runs-daily-instead/f823ac2e-3971-4561-a139-3b140772c047?tm=1458872277533

    There are pictures of Task Scheduler there.

    It's good to see results! Thanks for posting a reply to my post.

    Susan Miller

    Was this answer helpful?

    0 comments
  3. Anonymous
    2016-04-03T02:23:05+00:00

    @Brian, I hope you will keep posting your results in your thread or tell PaulSey..what is going on. Your problem is just as important as mine! I have added a reply to my thread after your reply to my thread (which was in my thread). I will be busy at least until Wednesday with other stuff so please don't expect more results until after Wednesday. For convenience, here is a link to my thread:

    http://http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/mrthb-or-mrterrorhb-or-mrtexe-runs-daily-instead/f823ac2e-3971-4561-a139-3b140772c047

    @PaulSey...Please get back to Brian's thread and to mine! Any news is a relief! Thanks!!!!

    Susan MillerVA

    Was this answer helpful?

    0 comments
  4. Anonymous
    2016-04-17T05:10:41+00:00

    Hi Brian:

    ... I just reviewed my logs ... and discovered a large change with the March Update to MRT. Through February, the log shows MRT running many times daily, up to a dozen, but this is past history since the March Update, so I won't post the log.

    From the 16th [of March] on, MRT has 'only' been running once or twice a day...but is still running once or twice a day,rather than once a month. Since the 18th, for whatever reason, I've only received one heartbeat message. I also noticed a few runs that start, and never give a finish message.

    Any updates to this thread (i.e., after the April 12th update - V35) you can share with Susan and us all?

    Was this answer helpful?

    0 comments
  5. Anonymous
    2016-04-17T19:23:27+00:00

    Hi @RickCP @PaulSey @SusanMillerVA

    I'm currently back up in Maine, away from my old laptop. When I get back tomorrow, I can run my old laptop at least once more, to update it to the April patch, and see the behavior in the log.

    However, I did finally upgrade my laptop. I chose an Alienware (Dell) laptop, running Windows 10 Pro 64. So far, so good. MRT ran once on April 8th, probably when I ran my first Windows Update on receiving the laptop. MRT ran again on the 12th, when the April patch was released. It has not run since! The total log so far:

    Microsoft Windows Malicious Software Removal Tool v5.34, March 2016 (build 5.34.12400.0)

    Started On Fri Apr  8 11:56:16 2016

    Engine: 1.1.12400.0

    Signatures: 1.213.7173.0

    Results Summary:

    No infection found.

    Microsoft Windows Malicious Software Removal Tool Finished On Fri Apr  8 11:57:16 2016

    Return code: 0 (0x0)

    Microsoft Windows Malicious Software Removal Tool v5.35, April 2016 (build 5.35.12524.0)

    Started On Tue Apr 12 15:39:47 2016

    Engine: 1.1.12603.0

    Signatures: 1.217.515.0

    Results Summary:

    No infection found.

    Microsoft Windows Malicious Software Removal Tool Finished On Tue Apr 12 15:41:39 2016

    Return code: 0 (0x0)

    The above was the entire log. I'm thinking the run times are so quick because there isn't much on the new HD's yet, either apps or data. I guess this issue is resolved for me, if only because I upgraded my laptop.

    Thanks to everyone for their time, effort and communication. I do have to state, at least the situation was steadily improving on my old laptop. When I first posted this thread, MRT was monopolizing my CPU, and making my poor, old laptop nonfunctional. I had to restart it in order to be able to use it. Since February or so, I actually had to check the log to even notice MRT was still running daily on the old laptop. Both the number of times it ran, and the length of time each instance ran greatly decreased.

    Best of luck to those still dealing with this issue @SusanMillerVA . I'll keep my eye on all my logs, 3 computers, just in case.

    Was this answer helpful?

    0 comments