Re: MRT.exe CPU usage

David H. Lipman

unread,

Nov 9, 2005, 2:31:50 PM11/9/05

to

From: "T_o_n_y" <T_o...@discussions.microsoft.com>

| I'm wondering if it is normal for the MRT.exe (microsoft malicious software
| removal tool) to take over 98% of the cpu. My computer has been sitting
| there for well over an hour with this going on. The tool was apparently
| activated by the "Automatic Updates" feature which is still sitting there
| also saying
|
| "Installing Windows Malicious Software Removal Tool - November 2005
| (KB890830) (update 2 of 2)..."
|
| I admit that anytime I open another application that the CPU number drops.
| But still, to have it taking 98% otherwise seems a lot.
|
| I have a lot of small html pages on my computer -- perhaps 100,000 -- and it
| could be that the tool is investigating each one of those. When my Norton
| scans the computer it says 500,000 files, and take a while too. I'm running
| xp pro and have 768MB ram and 60GB drive.

It is not normal. and I don't know why it is using that amount of resources.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Mike Treit [MSFT]

unread,

Nov 9, 2005, 11:38:42 PM11/9/05

to

This is definitely not expected. Did it ever finish?

In any event, can you check %windir%\debug\mrt.log and see what it says?

Thanks

-Mike

--
This posting is provided "AS IS" with no warranties, and confers no rights.

"T_o_n_y" <T_o...@discussions.microsoft.com> wrote in message
news:13752855-60DD-4541...@microsoft.com...

Matt Braverman [MSFT]

unread,

Nov 9, 2005, 11:44:11 PM11/9/05

to

Thanks for the note Tony.

Can you please send me a mail at matt...@microsoft.com ? I'd like to
follow-up with you to investigate this issue.

Thanks,
Matt Braverman
Security Technology Unit
Microsoft Corporation

T_o_n_y

unread,

Nov 9, 2005, 11:52:04 PM11/9/05

to

The answer is "no". Eventually, after about 4 hours, I got tired of waiting,
and I shut it down and rebooted. I then ran a system recover to bring me
back to the state 2 days ago. As a result, I don't see the mrt.log file
saying anything about a scan today.

Strange...I'll be running a virus scan tonight with NIS. I'll post here if
I discover anything.

Thanks again both of you for replying so quickly.

David H. Lipman

unread,

Nov 10, 2005, 9:00:47 AM11/10/05

to

From: "T_o_n_y" <To...@discussions.microsoft.com>

| The answer is "no". Eventually, after about 4 hours, I got tired of waiting,
| and I shut it down and rebooted. I then ran a system recover to bring me
| back to the state 2 days ago. As a result, I don't see the mrt.log file
| saying anything about a scan today.
|
| Strange...I'll be running a virus scan tonight with NIS. I'll post here if
| I discover anything.
|
| Thanks again both of you for replying so quickly.

If you mean you did a System Restore to a previous restore point then a LOG file should be
unaffected and the MRT.LOG file would not have been overwritten with an older version.

Bad Wind

unread,

Nov 11, 2005, 1:35:45 PM11/11/05

to

The same thing happens to me on both my desktop and laptop computers.

I have downloaded the latest Malicious Software Removal tool from the MS
site and even this freezes and the CPU usage runs up to 100%. There appears
to be something wrong with the tool.

David H. Lipman

unread,

Nov 11, 2005, 1:51:53 PM11/11/05

to

From: "Bad Wind" <repl...@group.net>

| The same thing happens to me on both my desktop and laptop computers.
|
| I have downloaded the latest Malicious Software Removal tool from the MS
| site and even this freezes and the CPU usage runs up to 100%. There appears
| to be something wrong with the tool.
|

Posted by MattBraverman on this issue..

"Can you please send me a mail at matt...@microsoft.com ? I'd like to
follow-up with you to investigate this issue.

Thanks,
Matt Braverman
Security Technology Unit
Microsoft Corporation"

--

T_o_n_y

unread,

Nov 11, 2005, 5:23:04 PM11/11/05

to

I've now had this happen to me twice...that is, I've now gotten stuck in a
state where the mrt.exe uses 90+% while never seeming to end. Each time I've
solved the problem by doing a system restore to earlier times. I now have
Windows Update waiting to install the tool again. What should I do?

Below is the content of my mrt.log file stored in c:\windows\debug\

-Tony

---------------------------------------------------------------------------------------

Microsoft Windows Malicious Software Removal Tool v1.2, March 2005
Started On Tue Mar 08 17:19:01 2005

Results Summary:
----------------
No infection found.

Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Tue Mar 08
17:19:23 2005

---------------------------------------------------------------------------------------

Microsoft Windows Malicious Software Removal Tool v1.3, April 2005
Started On Tue Apr 12 14:51:20 2005

Results Summary:
----------------
No infection found.

Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Tue Apr 12
14:51:38 2005

---------------------------------------------------------------------------------------

Microsoft Windows Malicious Software Removal Tool v1.4, May 2005
Started On Wed May 11 08:27:22 2005

Results Summary:
----------------
No infection found.

Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Wed May 11
08:27:48 2005

---------------------------------------------------------------------------------------

Microsoft Windows Malicious Software Removal Tool v1.5, June 2005
Started On Tue Jun 14 17:51:17 2005

Results Summary:
----------------
No infection found.

Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Tue Jun 14
17:51:44 2005

---------------------------------------------------------------------------------------

Microsoft Windows Malicious Software Removal Tool v1.8, September 2005
Started On Wed Sep 14 12:01:10 2005

Results Summary:
----------------
No infection found.

Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Wed Sep 14
12:01:31 2005

---------------------------------------------------------------------------------------

Microsoft Windows Malicious Software Removal Tool v1.9, October 2005
Started On Fri Oct 14 23:50:41 2005

Results Summary:
----------------
No infection found.

Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Fri Oct 14
23:52:25 2005

---------------------------------------------------------------------------------------

Microsoft Windows Malicious Software Removal Tool v1.10, November 2005
Started On Wed Nov 09 08:28:55 2005

---------------------------------------------------------------------------------------

Microsoft Windows Malicious Software Removal Tool v1.10, November 2005
Started On Fri Nov 11 04:56:00 2005

MowGreen

unread,

Nov 13, 2005, 6:25:27 PM11/13/05

to

Tony,

As Matt requested, and as David was so kind to point out, send an email
to Matt, matt...@microsoft.com , so that he can pursue this issue with you.
Do you have McAfee or Norton AV installed ? There have been similar
posts on the Windows Update newsgroup and each User experiencing this
issue, save one person, had McAfee installed.

MowGreen [MVP 2003-2006]
===============
*-343-* FDNY
Never Forgotten
===============

T_o_n_y

unread,

Nov 13, 2005, 10:33:04 PM11/13/05

to

MowGreen,

I did follow up with Matt, and I've included a copy below if you are
interested. It looks like I'm exception #2 because I do not have McAfee
installed. I use NIS 2005. I was able to get the "download center" version
of the mrt tool to work. See more details in my letter to Matt below:

***************************************************
Matthew,

I wasn't sure what you meant by "download center" version, so I did the
wrong thing at first. But then it worked. Here is exactly what I did. I
first used IE 6 to go to Tools-->Windows Update and then it said I needed the
following:

Windows Malicious Software Removal Tool - November 2005 (KB890830)

Download size: 0 KB , 0 minutes (Downloaded; ready to install)
After the download, this tool runs once to check your computer for infection
by specific, prevalent malicious software (including Blaster, Sasser, and
Mydoom) and helps to remove any infection found. If an infection is found,
the tool will display a status report the next time you start your computer.
A new version of the tool will be offered every month. If you want to
manually run the tool on your computer, you can download a copy from the
Microsoft Download Center or run an online version from microsoft.com. This
tool is not a replacement for an anti-virus product. To help protect your
computer, you should use an anti-virus product. Details...

I then chose to install that and in the "Installing Updates" window it read:

Installing Windows Malicious Software Removal Tool - November 2005

(KB890830) (update 1 of 1)...

Meanwhile the CPU went to 98% with MRT.exe. After about 5 minutes of that I
stopped it using the cancel button of that window. However, even though it
read "Canceling updates..." in that window, the CPU continued at about 97%
for 5 more minutes. I finally stopped it via Windows Task Manager.

I then found the microsoft download center version at:
http://www.microsoft.com/downloads/details.aspx?FamilyID=ad724ae0-e72d-4f54-9ab3-75b8eb148356&displaylang=en

and after chosing "download" I chose to "run" rather than saving the
download. It ran very quickly and said "no malicious" detected. I actually
did that twice...each time, quick, and no cpu problem.

Thank you. Can you explain what happened? Should I be concerned about what
might have been happening to my computer during the times the CPU was racing
like that? Should I once again run "system recover" to get it back to the
state prior to that?

-Tony
----- Original Message -----
From: Matthew Braverman
To: myothe...@hotmail.com
Sent: Friday, November 11, 2005 3:40 PM
Subject: RE: Writing per your request

Tony can you try running the download center version

-----Original Message-----
From: "MO"<myothe...@hotmail.com>
Sent: 11/11/05 2:20:35 PM
To: "matt...@microsoft.com"<matt...@microsoft.com>
Cc:
Subject: Writing per your request

Per your request, I'm writing to you (see below). As I posted in the forum:

-Tony

---------------------------------------------------------------------------------------

***************************************************

T_o_n_y

unread,

Nov 13, 2005, 10:35:04 PM11/13/05

to

David,

Please see my detailed message in reply to "MowGreen". I include the log
file in that post.

Matthew Braverman [MSFT]

unread,

Nov 14, 2005, 2:33:55 AM11/14/05

to

All,

Thank you for reporting this issue. As a result of your feedback, we've
found and fixed an issue in the tool. The tool was updated on Windows Update
/ Automatic Updates, the Download Center
(http://www.microsoft.com/downloads/details.aspx?FamilyID=ad724ae0-e72d-4f54-9ab3-75b8eb148356&displaylang=en),
and http://www.microsoft.com/malwareremove on Friday morning.

For those of you who have had issues with the tool, can you please try to
run it again (i.e. from the Download Center or
http://www.microsoft.com/malwareremove) and let me know if you still see
this issue ?

Thanks,
Matt
matt...@microsoft.com