How to disable Malicious Software Removal Tool ?

[AP]

After the last windows update the Malicious Software Removal Tool got
installed on my windows 2000 pc.
Is there a way I can disable this and only run it when i want it to run.
At the moment its killing the processing on my pc and cant do anything on it
at all.

 

[Malke]

AP wrote:

> After the last windows update the Malicious Software Removal Tool got
> installed on my windows 2000 pc.
> Is there a way I can disable this and only run it when i want it to run.
> At the moment its killing the processing on my pc and cant do anything on
> it at all.

This is extremely unlikely since that's not how the Windows Malicious
Software Removal Tool works. It downloads once a month, runs in quiet mode
and then it just deletes itself. After it is finished, it writes the result
to a log file.

To see the log file, run the following command from Start/Run:

notepad %windir%\Debug\Mrt.log

Malicious Software Removal Tool explanation -
http://www.microsoft.com/security/malwareremove/default.mspx

The Windows Malicious Software Removal Tool doesn't run resident so it is
probable that something else is going on with your machine. Have you gone
through the normal virus/malware removal scanning? If not, that would be a
good idea.

http://www.elephantboycomputers.com/page2.html#Removing_Malware

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
FAQ - http://www.elephantboycomputers.com/#FAQ

 

[AP]

Thanks for your prompt reply, much appreciated.

Unfortunately the scan is taking rather along time and i want to put a stop
to it.
I have tried removing the mrt.exe file while in safe mode, but it still
crops up a few minutes later on the windows 2000 machine.

Will deleteing the windows registry entry refeencing the scan work to put a
stop to the scan re-occuring?

"Malke" <malke@invalid.invalid> wrote in message
news:u$c2ARq2IHA.416@TK2MSFTNGP04.phx.gbl...
> AP wrote:
>
>> After the last windows update the Malicious Software Removal Tool got
>> installed on my windows 2000 pc.
>> Is there a way I can disable this and only run it when i want it to run.
>> At the moment its killing the processing on my pc and cant do anything on
>> it at all.
>
> This is extremely unlikely since that's not how the Windows Malicious
> Software Removal Tool works. It downloads once a month, runs in quiet mode
> and then it just deletes itself. After it is finished, it writes the
> result
> to a log file.
>
> To see the log file, run the following command from Start/Run:
>
> notepad %windir%\Debug\Mrt.log
>
> Malicious Software Removal Tool explanation -
> http://www.microsoft.com/security/malwareremove/default.mspx
>
> The Windows Malicious Software Removal Tool doesn't run resident so it is
> probable that something else is going on with your machine. Have you gone
> through the normal virus/malware removal scanning? If not, that would be a
> good idea.
>
> http://www.elephantboycomputers.com/page2.html#Removing_Malware
>
> Malke
> --
> MS-MVP
> Elephant Boy Computers - Don't Panic!
> FAQ - http://www.elephantboycomputers.com/#FAQ
>

 

[Malke]

AP wrote:

> Thanks for your prompt reply, much appreciated.
>
> Unfortunately the scan is taking rather along time and i want to put a
> stop to it.
> I have tried removing the mrt.exe file while in safe mode, but it still
> crops up a few minutes later on the windows 2000 machine.
>
> Will deleteing the windows registry entry refeencing the scan work to put
> a stop to the scan re-occuring?

Please explain in a clearer fashion what is happening. You have the MSRT
running and can't stop it? What is wrong with using Task Manager>End Task?
It starts up again when you reboot? Very strange. Since IIRC Win2k doesn't
have msconfig, use AutRuns to help you do a clean boot.

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

And you didn't answer my question about the virus/malware status of this
machine. Is it known clean? Is your operating system completely patched? Do
you use a firewall and an antivirus? Which ones?

How to Post:
http://www.elephantboycomputers.com/page2.html#Usenet
http://support.microsoft.com/default.aspx/kb/555375 - How to Ask a Question

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
FAQ - http://www.elephantboycomputers.com/#FAQ

 

[AP]

The MRT.exe loads up by it self without any user intervention, so somewhere
along the lines its autotsrating todo the scan. Killing the process in task
manager does not work 'access is denied' even logged in as an admin.

I think i got to he botom of this now, the scan log mrt.log showed an error

---------------
Microsoft Windows Malicious Software Removal Tool v1.42, June 2008
Started On Mon Jun 30 12:28:05 2008
->Scan ERROR: resource process://pid:1252 (code 0x00000057 (87))
->Scan ERROR: resource process://pid:1252 (code 0x0000054F (1359))
->Scan ERROR: resource process://pid:1368 (code 0x00000057 (87))
->Scan ERROR: resource process://pid:1368 (code 0x0000054F (1359))
->Scan ERROR: resource file://A:\ACTIVE~1\UNWISE.EXE (code 0x0000054F
(1359))
->Scan ERROR: resource file://A:\ACTIVE~1\UNWISE.EXE A:\ACTIVE~1\INSTALL.LOG
(code 0x0000054F (1359))
---------------

After some more digging around i found this to be related to a
task-scheduler that have been set by a piece of softwrae called "Active Sync
Recovery software".

Uninstalling the softwrae and deleeting the schedule backup job seems to
have fixed the MRT scan from hanging after 9minutes.

Just keeping everyone informed incase someone has the same problem in
future.

Thanks for you advice Malke.



"Malke" <malke@invalid.invalid> wrote in message
news:e1SrNkr2IHA.4920@TK2MSFTNGP05.phx.gbl...
> AP wrote:
>
>> Thanks for your prompt reply, much appreciated.
>>
>> Unfortunately the scan is taking rather along time and i want to put a
>> stop to it.
>> I have tried removing the mrt.exe file while in safe mode, but it still
>> crops up a few minutes later on the windows 2000 machine.
>>
>> Will deleteing the windows registry entry refeencing the scan work to put
>> a stop to the scan re-occuring?
>
> Please explain in a clearer fashion what is happening. You have the MSRT
> running and can't stop it? What is wrong with using Task Manager>End Task?
> It starts up again when you reboot? Very strange. Since IIRC Win2k doesn't
> have msconfig, use AutRuns to help you do a clean boot.
>
> http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
>
> And you didn't answer my question about the virus/malware status of this
> machine. Is it known clean? Is your operating system completely patched?
> Do
> you use a firewall and an antivirus? Which ones?
>
> How to Post:
> http://www.elephantboycomputers.com/page2.html#Usenet
> http://support.microsoft.com/default.aspx/kb/555375 - How to Ask a
> Question
>
> Malke
> --
> MS-MVP
> Elephant Boy Computers - Don't Panic!
> FAQ - http://www.elephantboycomputers.com/#FAQ
>

 

[Malke]

AP wrote:

> The MRT.exe loads up by it self without any user intervention, so
> somewhere along the lines its autotsrating todo the scan. Killing the
> process in task manager does not work 'access is denied' even logged in as
> an admin.
>
> I think i got to he botom of this now, the scan log mrt.log showed an
> error
>
> ---------------
> Microsoft Windows Malicious Software Removal Tool v1.42, June 2008
> Started On Mon Jun 30 12:28:05 2008
> ->Scan ERROR: resource process://pid:1252 (code 0x00000057 (87))
> ->Scan ERROR: resource process://pid:1252 (code 0x0000054F (1359))
> ->Scan ERROR: resource process://pid:1368 (code 0x00000057 (87))
> ->Scan ERROR: resource process://pid:1368 (code 0x0000054F (1359))
> ->Scan ERROR: resource file://A:\ACTIVE~1\UNWISE.EXE (code 0x0000054F
> (1359))
> ->Scan ERROR: resource file://A:\ACTIVE~1\UNWISE.EXE
> A:\ACTIVE~1\INSTALL.LOG (code 0x0000054F (1359))
> ---------------
>
> After some more digging around i found this to be related to a
> task-scheduler that have been set by a piece of softwrae called "Active
> Sync Recovery software".
>
> Uninstalling the softwrae and deleeting the schedule backup job seems to
> have fixed the MRT scan from hanging after 9minutes.
>
> Just keeping everyone informed incase someone has the same problem in
> future.
>
> Thanks for you advice Malke.

Glad you got it sorted. Thanks for posting back.

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
FAQ - http://www.elephantboycomputers.com/#FAQ