Malicious Software Removal Tool in Win10 Home won't run

Obviously we were each writing our most recent posts at the same time, so mine provides more info that may have changed your thoughts already.

However, I don't think that running the manually downloaded tool has anything to do with the operation of the "installed" System32 copy, except possibly if both were executed at the same time, but even then the system should be able to handle it with only some additional delay.  Since they're named differently, they'd only conflict if someone manually renamed and replaced the System32 copy, which the OP here wasn't even aware existed until you told him as I recall.

My own Windows 10 log only contains entries back to April, so it must have been reset when the Creators Update occurred, since it's been Windows 10 since just before the final deadline to upgrade free from Windows 7 on July 29th 2016.

The file creation date for MRT.exe doesn't change because the file is overwritten rather than deleted and replaced.

Rob

Actually, the 3 shorter scan attempts using the May v5.48 MSRT all failed, since they skipped the portion of the log indicating the results or infections found information.

This matches what RikDatta has been seeing visually, though we can't tell if all of these failures were for one tool or both, since either the locally installed or downloaded copy all display the same log information within the same monthly copy.

To me the times for the automatic quick scans seem long. but since I have an SSD, the typical time of 1.5 minutes is obviously faster than for an HDD.

It's is quite interesting that the June v5.49 tool is apparently operating daily, though I don't know what might be causing this to trigger.

What the above tells me is that at least the copy of the May v5.48 tool logged isn't a file permissions issue, since it initially executes, but fails to perform the scan and probably even open the interface from what's been described.

This now appears to be a suppression of operation issue, though I don't believe that it's lack of Administrator access for the entire account, since this would create many other unrelated problems as well.  I'd be looking for anything else indicating problems with initializing programs, which if I recall correctly, RikDatta may have already mentioned relating to tiled (used to be called "Metro") apps earlier in the thread?

This might be aided by looking in the Event Viewer - Application or System logs for errors when these launches are attempted, since any messages found there might help explain the failures more clearly.

Rob

Agreed.

However, my position is that the OP may have had a part in creating this problem by downloading the tool manually after it has already been downloaded by windows update (and in this case over and over again). When manually downloading it how is it being saved, Save as to a location of choice or if Save is used is it directed to the default Windows location? (Note that the online download is intended for use only for devices that are not receiving the tool from auto update).

To explain further, I have never manually downloaded the tool, ever. As you can see from the properties dialog of MRT.exe, which resides in my system 32 folder, that apparently the file does not get replaced each month, it gets modified to the current version when downloaded (by Windows update).

The created date is from when Win 10 Pro v1511 was first installed on this workstation.

My log file goes back to Aug, 2016 when the v1607 upgrade/update was done (with no problems at all). I have never experienced a problem of any kind with the MSRT.

What are your thoughts on this?

-Richard

An additional note that I just ran the "installed" System32 copy of the June v5.49 MSRT on my Windows 10 desktop system (logs above were from a Windows 8.1 laptop) with no issues.

After a manual execution with a Windows UAC prompt for administrator elevation which I accepted, I tried this again by refusing the elevation with a "No" response, which of course stopped the program from executing.  Note that in this case there was no log entry displayed at all, so as you'd expect, the program never even initializes.

Since the symptom here for at least one of the program execution types is an abort before displaying the interactive graphical interface with truncated log entries as well, this clearly doesn't match either a permissions or administrative access issue.  So for at least those aborted log entries, the problem appears to be an application crash.

I also confirmed the NVidia driver update, but this had occurred on June 3rd for my Windows 10 system, so that seems too long ago to have been involved in this problem, though of course that would depend on when and if this occurred on RikDatta's system.

Good luck and I hope all of this helps.

Rob

Actually, the 3 shorter scan attempts using the May v5.48 MSRT all failed, since they skipped the portion of the log indicating the results or infections found information.

This matches what RikDatta has been seeing visually, though we can't tell if all of these failures were for one tool or both, since either the locally installed or downloaded copy all display the same log information within the same monthly copy.

To me the times for the automatic quick scans seem long. but since I have an SSD, the typical time of 1.5 minutes is obviously faster than for an HDD.

It's quite interesting that the June v5.49 tool is apparently operating daily, though I don't know what might be causing this to trigger.

What the above tells me is that at least the copy of the May v5.48 tool logged isn't a file permissions issue, since it initially executes, but fails to perform the scan and probably even open the interface from what's been described.

This now appears to be a suppression of operation issue, though I don't believe that it's lack of Administrator access for the entire account, since this would create many other unrelated problems as well.  I'd be looking for anything else indicating problems with initializing programs, which if I recall correctly, RikDatta may have already mentioned relating to tiled (used to be called "Metro") apps earlier in the thread?

This might be aided by looking in the Event Viewer - Application or System logs for errors when these launches are attempted, since any messages found there might help explain the failures more clearly.

Rob

<EDIT> Note that since the failures seem not to allow the visual display of the initial scan selection screen, this could be as simple as an application crash caused by problems with display.  Since I believe I recall recently receiving an NVidia driver update for my own older Windows 10 system, there could have been a problem with some systems relating to this update.

This is just a wild guess, but it's the type of issue were looking for that might cause various apps to fail to display and so appear not to operate at all.

This is what a normal log should look like (if the tool is not being run manually).

Microsoft Windows Malicious Software Removal Tool v5.43, December 2016 (build 5.43.13300.0)

Started On Tue Dec 13 23:47:28 2016

Engine: 1.1.13303.0

Signatures: 1.233.993.0

Run Mode: Scan Run From Windows Update

Results Summary:

---

No infection found.

Successfully Submitted Heartbeat Report

Microsoft Windows Malicious Software Removal Tool Finished On Tue Dec 13 23:48:41 2016

Return code: 0 (0x0)

---

Microsoft Windows Malicious Software Removal Tool v5.44, January 2017 (build 5.44.13400.0)

Started On Wed Jan 11 00:39:49 2017

Engine: 1.1.13303.0

Signatures: 1.233.3409.0

Run Mode: Scan Run From Windows Update

Results Summary:

---

No infection found.

Successfully Submitted Heartbeat Report

Microsoft Windows Malicious Software Removal Tool Finished On Wed Jan 11 00:41:05 2017

Return code: 0 (0x0)

---

Microsoft Windows Malicious Software Removal Tool v5.45, February 2017 (build 5.45.13501.0)

Started On Wed Feb 22 22:58:43 2017

Engine: 1.1.13407.0

Signatures: 1.235.1858.0

Run Mode: Scan Run From Windows Update

Results Summary:

---

No infection found.

Successfully Submitted Heartbeat Report

Microsoft Windows Malicious Software Removal Tool Finished On Wed Feb 22 22:59:53 2017

Return code: 0 (0x0)

---

Microsoft Windows Malicious Software Removal Tool v5.46, March 2017 (build 5.46.13601.0)

Started On Tue Mar 14 15:21:37 2017

Engine: 1.1.13504.0

Signatures: 1.237.571.0

Run Mode: Scan Run From Windows Update

Results Summary:

---

No infection found.

Successfully Submitted MAPS Report

Successfully Submitted Heartbeat Report

Microsoft Windows Malicious Software Removal Tool Finished On Tue Mar 14 15:22:42 2017

Return code: 0 (0x0)

---

Microsoft Windows Malicious Software Removal Tool v5.47, April 2017 (build 5.47.13703.0)

Started On Tue Apr 11 15:59:01 2017

Engine: 1.1.13601.0

Signatures: 1.239.313.0

Run Mode: Scan Run From Windows Update

Results Summary:

---

No infection found.

Successfully Submitted Heartbeat Report

Microsoft Windows Malicious Software Removal Tool Finished On Tue Apr 11 15:59:57 2017

Return code: 0 (0x0)

---

Microsoft Windows Malicious Software Removal Tool v5.48, May 2017 (build 5.48.13801.0)

Started On Tue May 09 19:32:16 2017

Engine: 1.1.13701.0

Signatures: 1.241.491.0

Run Mode: Scan Run From Windows Update

Results Summary:

---

No infection found.

Successfully Submitted MAPS Report

Successfully Submitted Heartbeat Report

Microsoft Windows Malicious Software Removal Tool Finished On Tue May 09 19:33:28 2017

Return code: 0 (0x0)

---

Microsoft Windows Malicious Software Removal Tool v5.48, May 2017 (build 5.48.13803.0)

Started On Mon May 22 19:29:02 2017

Engine: 1.1.13704.0

Signatures: 1.243.729.0

Run Mode: Scan Run From Windows Update

Results Summary:

---

No infection found.

Successfully Submitted Heartbeat Report

Microsoft Windows Malicious Software Removal Tool Finished On Mon May 22 19:30:14 2017

Return code: 0 (0x0)

---

Microsoft Windows Malicious Software Removal Tool v5.49, June 2017 (build 5.49.13902.0)

Started On Wed Jun 14 02:22:00 2017

Engine: 1.1.13804.0

Signatures: 1.245.112.0

Run Mode: Scan Run From Windows Update

Results Summary:

---

No infection found.

Successfully Submitted Heartbeat Report

Microsoft Windows Malicious Software Removal Tool Finished On Wed Jun 14 02:23:45 2017

Return code: 0 (0x0)