Microsoft Windows Malicious Software (MRT.EXE) Locks PC because of AutoKMS

Discussion in 'Windows 10' started by verndog, Mar 3, 2017.

  1. verndog

    verndog MDL Member

    May 3, 2010
    211
    93
    10
    Somehow mr.exe gets executed and every boot it locks pc asking if it should change a setting.
    Deleting mrt.exe stops the popup, but on next update it wants to re-install Microsoft Windows Malicious Software again.

    I found this hack:
    Is anyone else having this issue. It only started this year.
     
  2. Enthousiast

    Enthousiast MDL Tester

    Oct 30, 2009
    47,262
    94,705
    450
    I've tested with the last mrt release and nothing happened with the kms activation, not even a AV report by Defender or MRT.
     
  3. s1ave77

    s1ave77 Has left at his own request

    Aug 15, 2012
    16,104
    24,378
    340
    Several others reported that behavior likewise. Couldn't notice it myself so far. Would be interesting to know why it is that random :g:.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. c6p0

    c6p0 MDL Junior Member

    Aug 17, 2010
    74
    47
    0
    i do not have the problem yet. will follow this thread

    PS: I have AutoKMS folder excluded in Windows Defender
     
  5. second_guess_everything

    Feb 10, 2015
    11
    4
    0
    that registry hack works but you need to delete the existing MRT.exe on ur computer (windir/system32)
     
  6. ultimate_live

    ultimate_live MDL Expert

    Mar 15, 2011
    1,022
    671
    60
    I also have AutoKMS folder and Exe excluded in Windows Defender and Malwarebytes v3. No other issues here with AutoKMS.
     
  7. verndog

    verndog MDL Member

    May 3, 2010
    211
    93
    10
    MRT.exe runs independent of Windows Defender, bit I also excluded AutoKMS. Something else is triggering MRT.
     
  8. Mr.X

    Mr.X MDL Guru

    Jul 14, 2013
    8,575
    15,646
    270
    #9 Mr.X, Mar 4, 2017
    Last edited by a moderator: Apr 20, 2017
    I think this other reg entry might help too:

    Code:
    Windows Registry Editor Version 5.00
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
    "DontOfferThroughWUAU"=dword:00000001
    
    I meant to prevent re-enabling of MRT.
     
  9. verndog

    verndog MDL Member

    May 3, 2010
    211
    93
    10
    I didn't know what was triggering mrt, but I just found out:
    I am curious if anyone else has this flagged during startup. Here is the reg key:
     
  10. Enthousiast

    Enthousiast MDL Tester

    Oct 30, 2009
    47,262
    94,705
    450
    MRT stands for Microsoft Removal Tool (incorrect), it stands for: "Malicious Software Removal Tool".