Any way of knowing when/if MS Malicious Software Removal Tool runs?

coylemj

On the second Tuesday of each month, MS releases a new version of their Malicious Software Removal Tool. It's normally the next day in Ireland when you can see it and the most recent version was downloaded and installed today along with some Windows updates. The Malicious Software Removal Tool supposedly does a one-off scan on your machine looking for malware and I assume that it does this when my machine is idle but I'm wondering is there any way to tell if it has run since it was last updated?

I usually leave my laptop switched on and idle for a couple of hours after the tool has been updated but it would be useful to know that it has actually run.

If you've never heard of it, details here...

http://www.microsoft.com/en-gb/security/pc-security/malware-removal.aspx

maki

It actually runs during Windows update. When it says it's installing MSRT it's actually downloading the newest definitions and doing a scan. Once the scan is done it marks the install as complete and moves onto the next update.

Logs are at \windows\debug\mrt.log if you're interested.

coylemj

maki wrote: »

Logs are at \windows\debug\mrt.log if you're interested.

There is no such file anywhere on my machine which BTW is Win7.

In windows/debug there is a single file called PASSWD.LOG and a folder called WIA which contains one file - wiatrace.log which was last modified in January.

HereIBe

http://www.sevenforums.com/tutorials/24076-malicious-software-removal-tool.html

May not be installed at all on yours.

search for mrt.exe on your machine

coylemj

HereIBe wrote: »

http://www.sevenforums.com/tutorials/24076-malicious-software-removal-tool.html

May not be installed at all on yours.

search for mrt.exe on your machine

I know it's installed because I saw it on the list of items being installed last week along with a monthly bundle of Windows updates and there is a file called mrt.exe dated March 12th 2014 in C:\windows\system32

It also appears to have run immediately after being installed as described above by maki because the 'install' step took much longer than expected so it was clearly doing the scan. Hence the mystery as to why there is no log or any way of confirming that it did actually run.

Edit: Manually ran it just now (quick scan) and it did create an mrt.log file in c:\windows\debug The original question remains - how do I know if it ever ran in the past? After the windows updates installed last week, I rebooted and left the machine idle for a couple of hours, did it run then? If it did or it did a scan just after being installed, why didn't it create the mrt.log file?

maki

You don't use CCleaner by any chance? By default it clears some log files, including that one.

coylemj

maki wrote: »

You don't use CCleaner by any chance? By default it clears some log files, including that one.

Yes I do, every day. Ran it earlier and that mrt.log file is now gone! Many thanks.