The user, studying running processes in the Task Manage, may come across an unfamiliar process of mrt.exe. We will tell you in more detail below about what he is
Programs for Windows 7 or any other version, including its own system tools for all occasions, are so diverse today that users often do not know what they are for. A particular misunderstanding is associated with system processes that can run in the background.
One such service is the process with the executable MRT.exe that is responsible for it. What is this system tool, many users even have no idea? That is why further it is proposed to understand what it is and why it is needed.
MRT.exe: what is this service?
The name of the executable file is an
abbreviation of the built-in protective tool of the system called Microsoft Removal Tool. Based on this, it is easy to conclude that this is a kind of anti-virus scanner, which is designed to protect the system from all sorts of threats.
However, not all so simple. The main problem of this service is related only to the fact that it is unable to detect threats at the entrance and protect the system in real time, and is used exclusively for scanning, detecting and removing viruses or malware in an already infected OS.
This is the main task of the MRT.exe scanner. What is this in terms of overall security? Here you can draw the simplest analogy with portable antivirus tools like Kaspersky Virus Removal Tool or something similar. Only here the functionality of this applet raises rather big doubts.
Why does mrt.exe occur
The mrt.exe process is launched by the Malicious Software Removal Tool service, a Microsoft antivirus utility that provides minimal protection against common malware variants. The component is a system component, the default is present in most versions of Windows.
“Malicious Software Removal Tool” is designed to find and eliminate infection on the computer. This utility does not provide active protection and is able to detect only already affected files and directories. It is launched either automatically when a virus threat is detected in the Windows system catalog, or manually by the user.
Under normal conditions, the process should automatically close after verification, peak memory consumption – up to 100 MB, processor load – no more than 25%
Location of the executable file
You can detect the location of the EXE file that starts the mrt.exe process as follows:
Launch the Task Manager, find mrt.exe in the process list, right-click on it and select the option “Open file storage location.”
Open the EXE file of the MRT.exe process through the Windows Task Manager
An “Explorer” window will appear with an open directory of the location of the executable file. Under normal conditions, mrt.exe is located in the System32Windows directory.
The location of the exe file of the MRT.exe process through the Windows Task Manager
Process completion
Even though mrt.exe is a component of the system, disabling it will in no way affect the performance of the OS. However, it is not recommended to forcibly close the process during the scanning of the file system by the Malicious Software Removal Tool.
Call the Task Manager and find the mrt.exe process on the list. Then click on it with RMB and select the option “End Process.”
Close the MRT.exe process through the Windows Task Manager
The process stop must be confirmed by clicking on the “End Process” button in the warning window.
Confirmation of closing the MRT.exe process through Windows Task Manager
How to use this tool?
As for the performance of a regular check, it is enough just to run the program as a .exe file or initially download the package KB890830 from the official Microsoft website.
After starting, the application will offer several scan options: fast, full and selective. After selecting one of the options, the test starts. If you find any threats or suspicious elements, the program, when issuing the result, will inform the user about their presence and the location of infected or virus objects.
Disabling and deleting process issues
Ironically, but sometimes the “Malicious Software Removal Tool” itself becomes a source of threat due to virus infection or the substitution of the original file.
The main sign of infection is the constant activity of the process and the location that is different from the address C:\Windows\System32.
Faced with such a problem, you should use third-party utility cleaners – for example, Dr. WEB CureIt, which is able to quickly and accurately eliminate malicious software.
But this is only part of the issue regarding the MRT.exe service. What it is, sorted out. Now let’s see if we can remove this component from the system.
Indeed, this applet is not required for Windows so that you can remove it without any problems. The process itself first ends in the Task Manager. After that, the above update package is uninstalled in the installed updates section. Which can be found in the list of installed updates in the programs and components section. You can also contact the “Update Center.”
How to determine what a virus is?
Unfortunately, despite the efforts of Microsoft to create a reliable means of detecting threats, modern viruses have learned to disguise themselves as a system scanner, which causes a lot of problems.
It is possible to determine that a virus of the same name has wound up in the system; it can be quite elementary using the Task Manager. When it is PCM, the process selects the point of displaying the location of the file and folder responsible for it.
The original service file is located on the path c: \ Windows \ System32 \ MRT.exe or in the same path, but the MRT folder. If a different path is indicated for the identified process, you can be sure that it is a virus.
To neutralize it, if possible, you should immediately remove the main directory and all its components. And also use a portable scanner to remove the threat from the system completely.
And remember that in matters of protection rely only on this scanner does not make any sense. As already mentioned, it is based on the principle of operation exclusively on the search for threats in already infected operating systems and is completely unsuitable for preventing their penetration into the system. Therefore, the presence of a regular anti-virus tool with proactive protection is required.