2

Whenever my system starts the last few days, windows (10 x64) asks me to install this

"C:\Windows\System32\mrt.exe" /R /RE

Now, I don't want to install it, so I deleted that file, but a couple of next start ups there it is again.

My questions are, what do the /R and the /RE after the file mean to windows and why is that file again in my system?

Update:

Thanks for the switches information (/R /RE), (as @TOOGAM correctly stated, I will try what you said later today) I corrected the information about the file, which didn't show the white spaces between the "file name" and the switches at the prompt, when hitting 'more info' on the dialog,

I tried which mrt ; system says which is not recognized. @DavidPostill probably meant mrt -version which shows the prompt in his answer, as with every other parameter... does it mean it's already installed, so the attempt of installing at startup is suspicious?

5
  • 2
    sounds like a case of spyware. The /R and /RE are switches. What they are designed to do are different for each program. but /R or /RE could stand for register which would be to nest itself into your computer.
    – LPChip
    Feb 26, 2017 at 14:49
  • 2
    MRT is the Malicious Software Removal Tool. It is a one-time run Antivirus scan that comes through Windows Update every month. The R and RE switches probably tell it to create a task to run later, or register it as a service. It isn't malware.
    – CConard96
    Feb 26, 2017 at 15:44
  • Nice @CConard96. That pretty much marks some of my answer as not-the-best-route-to-go. Interestingly, mrt/? shows the same parameters documented by MS KB 890830, currently also shown in a screenshot in DavidPistill's answer, and doesn't mention /R or /RE, so we still probably don't know what they are. (But "register" sounds sensible, so testing for that might confirm that.)
    – TOOGAM
    Feb 26, 2017 at 19:39
  • I did some testing now that I finally have access to my PC. See my answer below.
    – CConard96
    Feb 26, 2017 at 20:14
  • I have a which.cmd - Determines the full path of the file that would execute if CommandName were executed.
    – DavidPostill
    Feb 26, 2017 at 20:41

3 Answers 3

4

MRT is the Malicious Software Removal Tool. It is a one-time run Antivirus scan that comes through Windows Update every month. The R and RE switches probably tell it to create a task to run later, or register it as a service. It isn't malware.

The switches /R and /RE appear to be undocumented yet valid. I ran several different switches from command line and viewed the output in the MRT log file (C:\Windows\debug\mrt.log).

I first ran "mrt.exe /Q" as a baseline. This added an entry with "Run Mode: Scan Run in Quite Mode".

Next I ran an invalid switch "mrt.exe /X" which didn't add any output.

"mrt.exe /R" Added "Run Mode: Post Reboot Actions" which leads me to believe it is telling MRT to run either the scan or perhaps some cleanup actions after a reboot.

"mrt.exe /RE" Added "Run Mode: Interactive Graphical Mode" which opened up a wizard which had different configuration options for the scan, and guided me through the scanning procedure. This is what happens when you open MRT.exe without any switches, but since the effect was different than an invalid switch like /X it still seems to do something.

Both /R and /RE together added "Run Mode: Post Reboot Actions".

While I wasn't able to verify the exact effect both of those switches have, they do appear to be valid in the normal MRT program. The reason the program keeps reappering is probably due to Windows Updates running and replacing the file, or a System File Check running and replacing the file from the WinSxS store.

1
  • +1 even if this doesn't entirely answer the question conclusively, it does tell us the location of the log file, and gives us some more material we've had than before. So, the answer is Useful (which is the criteria for upvoting, according to the hovertext). Thank you CConard96 for identifying the software and taking the time for going through these tests.
    – TOOGAM
    Feb 26, 2017 at 22:14
1

What do the /R and the /RE after the file mean to windows?

As explained in the other answers they are command line switches.

However the official Microsoft Malicious Software Removal Tool (mrt.exe) does not support these options (see below).

This implies that the version your system is trying to install may be malware.

See How can I remove malicious spyware, malware, adware, viruses, trojans or rootkits from my PC? for instructions on removing malware.


mrt command line options

WMSRT MRT.exe supports four command line switches listed below, which is optional and most of the time not necessary unless you’re administrator for corporate network:

  • /Q or /quiet – Use quiet mode. This option suppresses the user interface of the tool.
  • /? – Display a dialog box that lists the command-line switches.
  • /N – Run in detect-only mode. In this mode, malicious software will be reported to the user but will not be removed.
  • /F – Force an extended scan of the computer.
  • /F:Y – Force an extended scan of the computer and automatically clean any infections found.

Source How to Use Windows Malicious Software Removal Tool

> which mrt
C:\Windows\System32\MRT.exe

> mrt /?

Displays the following dialog:

enter image description here

4
  • 1
    Nice idea. But a search for mrt.exe /R /RE suggests that these parameters are used on a number of systems. So either this malware has been sufficiently spread, or there may be another cause. e.g., They might be undocumented parameters that do something, or maybe Microsoft code (like Windows Update) is specifying useless parameters (possibly as a side effect of doing something different, like using the same code that may also pass those same parameters to Microsoft Forefront software.
    – TOOGAM
    Feb 26, 2017 at 19:44
  • Maybe they're just undocumented? Feb 26, 2017 at 20:30
  • @TOOGAM Could be just undocumented. mrt runs without complaint given those parameters ...
    – DavidPostill
    Feb 26, 2017 at 20:36
  • @grawity Could be just undocumented. mrt runs without complaint given those parameters ...
    – DavidPostill
    Feb 26, 2017 at 20:36
0

Some of the questions you have do not have clear complete answers. Here is what we do know.

As LPChip's comment correctly stated, the /R/RE appear to be switches. In the traditional command prompt, placing a forward slash on the command line specifies the start of a switch. e.g., "dir/w" means to use the "dir" command, and specify the "/w" switch. (Switches are also called "parameters".)

In PowerShell, that doesn't work: you would need a space before the switch. The Registry is just a giant collection of data, so whether the space is needed, or not, would depend on what program is using that data.

Since you're being asked about installing the program, I'm guessing that the prompt is coming from "user account control" ("UAC"). So UAC is effectively protecting you from having the program be installed. Just say no.

Now, as for why that is happening for every reboot, that is something that I cannot readily say, but I can provide some advice for figuring this out. There are multiple ways that Microsoft Windows allows a program to start up. You can check the Startup folder (from your Start menu), but most likely you'll find your answer in the registry. Check out these keys in RegEdit:

  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
  • HKEY_Local_Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • HKEY_Local_Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

That is probably how the program is starting.

However, although deleting that registry entry will likely stop the program from running, this doesn't answer the question of how the program keeps coming back after you successfully delete it. This is not very normal behavior, except if your computer is already compromised by malicious software (a.k.a. "malware"). If malware is re-creating the file, chances are good that malware will also re-create the registry entry.

So you probably need to find the malware. The easy way to do that is likely to run a scan with anti-malware software. If whatever you have installed doesn't work, try Malware Bytes (which is often good at finding stuff, and often works alongside existing anti-malware software), and/or other anti-malware software (although you may need to uninstall each anti-malware software before trying another, as multiple pieces of anti-malware software often tend to conflict with each other).

Hopefully that works; sometimes you need to do some more serious efforts to successfully get the machine cleaned, which may involve not booting from the long term storage device (e.g., "hard drive", "solid state drive") that you're using (because the drive you're currently using might be sufficiently compromised).

1
  • If you can't find it, let us know which OS, etc. and we will give other ways to safely determine if it is or is not malware.
    – DaaBoss
    Feb 26, 2017 at 19:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .