Microsoft Windows Malicious Software (MRT.EXE) Locks PC because of AutoKMS

Discussion in 'Windows 10' started by verndog, Mar 3, 2017.

  1. verndog

    verndog MDL Novice

    May 3, 2010
    43
    6
    0
    Somehow mr.exe gets executed and every boot it locks pc asking if it should change a setting.
    Deleting mrt.exe stops the popup, but on next update it wants to re-install Microsoft Windows Malicious Software again.

    I found this hack:
    Is anyone else having this issue. It only started this year.
     
  2. Enthousiast

    Enthousiast MDL Tester

    Oct 30, 2009
    22,422
    31,064
    390
    I've tested with the last mrt release and nothing happened with the kms activation, not even a AV report by Defender or MRT.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. s1ave77

    s1ave77 Has left at his own request

    Aug 15, 2012
    16,135
    24,082
    340
    Several others reported that behavior likewise. Couldn't notice it myself so far. Would be interesting to know why it is that random :g:.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. c6p0

    c6p0 MDL Junior Member

    Aug 17, 2010
    57
    27
    0
    i do not have the problem yet. will follow this thread

    PS: I have AutoKMS folder excluded in Windows Defender
     
  5. second_guess_everything

    Feb 10, 2015
    8
    4
    0
    that registry hack works but you need to delete the existing MRT.exe on ur computer (windir/system32)
     
  6. ultimate_live

    ultimate_live MDL Addicted

    Mar 15, 2011
    780
    628
    30
    I also have AutoKMS folder and Exe excluded in Windows Defender and Malwarebytes v3. No other issues here with AutoKMS.
     
  7. verndog

    verndog MDL Novice

    May 3, 2010
    43
    6
    0
    MRT.exe runs independent of Windows Defender, bit I also excluded AutoKMS. Something else is triggering MRT.
     
  8. Mr.X

    Mr.X MDL Guru

    Jul 14, 2013
    6,410
    14,134
    210
    #9 Mr.X, Mar 4, 2017
    Last edited by a moderator: Apr 20, 2017
    I think this other reg entry might help too:

    Code:
    Windows Registry Editor Version 5.00
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
    "DontOfferThroughWUAU"=dword:00000001
    
    I meant to prevent re-enabling of MRT.
     
  9. verndog

    verndog MDL Novice

    May 3, 2010
    43
    6
    0
    I didn't know what was triggering mrt, but I just found out:
    I am curious if anyone else has this flagged during startup. Here is the reg key:
     
  10. Enthousiast

    Enthousiast MDL Tester

    Oct 30, 2009
    22,422
    31,064
    390
    MRT stands for Microsoft Removal Tool (incorrect), it stands for: "Malicious Software Removal Tool".
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...