MRT.exe

Question

Hi

On my Windows 7 Laptop I have two very large items in the system32 folder that seem to be ralated to the removal of malicious software etc which is a monthly update from Microsoft. As I use the Norton 360 software this would seem to be unnecessary and I would like to remove the two items, MRT.exe and KB890830, from my laptop.

Can I do this and how to go about it.

When the monthly malicious removal update appears I shal hide it so it doesn't install anything.

Regards

Eric Athroll

Answer 1

The Windows Malicious Software Removal Tool was designed by Microsoft as a sanity check for versions of Windows that your existing security software is truly working, since that's commonly been a problem when either the current Microsoft (e.g. Defender, Microsoft Security Essentials} or any 3rd-party) security application has been attacked and successfully disabled or damaged by malware.

For that reason, it's always recommended by Microsoft that this app delivered monthly via Windows or Microsoft Update to detect and remove certain prevalent forms of malware be allowed to run.

Since the app itself is a portable executable and not actually installed, but simply copied into the Windows\System folder by default and executed once during an update cycle, its removal is just as simple, simply delete the file(s) associated with its installation and operation.

Here's the document that covers most of this and following is the excerpt that munitions its removal.

Remove specific prevalent malware with Windows Malicious Software Removal Tool (KB890830) - Microsoft Support

How to remove the MSRT

The MSRT does not use an installer. Typically, when you run the MSRT, it creates a randomly named temporary directory on the root drive of the computer. This directory contains several files, and it includes the Mrtstub.exe file. Most of the time, this folder is automatically deleted after the tool finishes running or after the next time that you start the computer. However, this folder may not always be automatically deleted. In these cases, you can manually delete this folder, and this has no adverse effect on the computer.

< EDIT > Note from the same document about Windows version support:

"In compliance with the Microsoft Support Lifecycle policy, the MSRT is no longer supported on Windows Vista or earlier platforms. For more information, go to Microsoft Support Lifecycle."

It seems funny to me that some people can't seem to remember that to anyone with an early Windows 7 computer that wasn't upgraded for free to Windows 10, may have also had a very early HDD that in relative terms to today would be considered tiny, since in many cases the PC might have already been upgraded from an earlier Windows version such as Windows XP, which quite often may have had a HDD close to the then minimum size of 1.5GB. In relative terms to this, figures above 100MB begin to appear significant.

Funny how we tend to quickly forget the past. My first computer which was considered quite decked out for its day eventually had 4 MHz Z80 processor, 64 KB RAM, 128 KB RAM-Disk and dual 8" loppies with maximum 600 KB storage capacity. OF course, that was in the early 1980' for an IMSAI 8080 based microcomputer initially purchased in 1979 with 2 MHz 8080, 12 KB RAM and audio cassette tape storage of BASIC language programs only. Those less than 20 years old or even older may have a hard time believing that computer ever existed.

Rob

Answer 2

FWIW

Win 7 went out of support Jan 2020, and no updates from MS of any type since that date.

Answer 3

Although you can certainly make the registry change to cause Windows Update to ignore the monthly download of the Microsoft Malicious Software Removal tool (MRT.exe), your question suggests that something more sinister may be going on.

The Malicious Software Removal tool itself (MRT.exe) is saved in C:\Windows\System32 in compressed form (if you have the default color settings for Windows Explorer, the file name will be in blue text). If you right-click on the file and select "Properties," you should see that it is 183 MB (192,651,728 bytes) but only occupies 107 MB (113,127,424 bytes) on the disk. This is for the current 64-bit version, 5.123.24040.1001 April 10, 2024.

Although KB890830 is indeed the KB article corresponding to MRT, you should not have any file named KB890830 anywhere, much less in C:\Windows\System32.

If you deliberately went to the Microsoft Update Catalog and downloaded the MRT tool, that would be a file named windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe. That's a compressed file of 65.8 MB (69,014,128 bytes); when you run it, MRT.exe is extracted as the same 183 MB (192,651,728 bytes) file (again, size is for the current version).

From the KB article (https://support.microsoft.com/en-us/topic/remove-specific-prevalent-malware-with-windows-malicious-software-removal-tool-kb890830-ba51b71f-39cd-cdec-73eb-61979b0661e0):

How to remove the MSRT

The MSRT does not use an installer. Typically, when you run the MSRT, it creates a randomly named temporary directory on the root drive of the computer. This directory contains several files, and it includes the Mrtstub.exe file. Most of the time, this folder is automatically deleted after the tool finishes running or after the next time that you start the computer. However, this folder may not always be automatically deleted. In these cases, you can manually delete this folder, and this has no adverse effect on the computer.

To conclude:

1. If you have a file in C:\Windows\System32 named MRT.exe that is "very large" -- significantly larger than 183 MB, which these days I would consider fairly small -- I would be very suspicious of malware. Upload that file to https://www.virustotal.com/gui/home/upload where it will be scanned by an array of antimalware tools.
2. If you have a file whose file name includes kb890830 located anywhere in your computer, but particularly in C:\Windows\System32, unless the complete file name looks similar to the long file name described above as downloaded from the Update Catalog, I would be even more suspicious of this file, especially if it is "very large."

Answer 4

When the monthly malicious removal update appears I shal hide it so it doesn't install anything.

Tell Windows Update to disregard it.

Disable Malicious Software Removal Tool From Installing.reg

Answer 5

Not so. I still receive the Malicious Software Tool updates and occasional Security Updates.

I any cas ethis doesn't answer my question.