Microsoft Windows Malicious Software (MRT.EXE) Locks PC because of AutoKMS

Discussion in 'Windows 10' started by verndog, Mar 3, 2017.

  1. verndog

    verndog MDL Novice

    May 3, 2010
    40
    5
    0
    Somehow mr.exe gets executed and every boot it locks pc asking if it should change a setting.
    Deleting mrt.exe stops the popup, but on next update it wants to re-install Microsoft Windows Malicious Software again.

    I found this hack:
    Is anyone else having this issue. It only started this year.
     
  2. Enthousiast

    Enthousiast MDL Tester

    Oct 30, 2009
    15,464
    18,555
    340
    I've tested with the last mrt release and nothing happened with the kms activation, not even a AV report by Defender or MRT.
     
  3. s1ave77

    s1ave77 MDL Guide Dog/Dev

    Aug 15, 2012
    15,065
    20,289
    340
    Several others reported that behavior likewise. Couldn't notice it myself so far. Would be interesting to know why it is that random :g:.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. c6p0

    c6p0 MDL Novice

    Aug 17, 2010
    27
    11
    0
    i do not have the problem yet. will follow this thread

    PS: I have AutoKMS folder excluded in Windows Defender
     
  5. second_guess_everything

    Feb 10, 2015
    8
    4
    0
    that registry hack works but you need to delete the existing MRT.exe on ur computer (windir/system32)
     
  6. ultimate_live

    ultimate_live MDL Addicted

    Mar 15, 2011
    756
    627
    30
    I also have AutoKMS folder and Exe excluded in Windows Defender and Malwarebytes v3. No other issues here with AutoKMS.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. verndog

    verndog MDL Novice

    May 3, 2010
    40
    5
    0
    MRT.exe runs independent of Windows Defender, bit I also excluded AutoKMS. Something else is triggering MRT.
     
  8. Mr.X

    Mr.X MDL Guru

    Jul 14, 2013
    5,855
    13,397
    180
    #9 Mr.X, Mar 4, 2017
    Last edited by a moderator: Apr 20, 2017
    I think this other reg entry might help too:

    Code:
    Windows Registry Editor Version 5.00
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
    "DontOfferThroughWUAU"=dword:00000001
    
    I meant to prevent re-enabling of MRT.
     
  9. verndog

    verndog MDL Novice

    May 3, 2010
    40
    5
    0
    I didn't know what was triggering mrt, but I just found out:
    I am curious if anyone else has this flagged during startup. Here is the reg key:
     
  10. Enthousiast

    Enthousiast MDL Tester

    Oct 30, 2009
    15,464
    18,555
    340
    MRT stands for Microsoft Removal Tool (incorrect), it stands for: "Malicious Software Removal Tool".