Ce site est optimisé pour être consulté depuis un navigateur moderne dans lequel JavaScript est activé.

Désactiver ou désinstaller l'outil de suppression de logiciels malveillants sur Windows Serveur KB890830

ayi

Nous avons a script that declines <a href="https://www.microsoft.com/en-us/download/malicious-software-removal-tool-details.aspx" rel="noopener nofollow ugc">KB890830 updates</a> for our on-premise Windows Update Server, but we recently found someone approved one of the monthly updates before the script could run and the Malicious Software Removal Tool (MRT) was installed on all of our servers.
We’ve had issues with MRT in the past and want to remove it, but now the script has declined the update and we cannot find anything under the <code>View installed updates</code> section to remove it. We also tried running <code>wusa.exe /uninstall /KB:890830</code> but it returned l’erreur:
<blockquote></blockquote>
The update KB890830 is not installed on this computer.
According to the <code>C:\Windows\debug\mrt.log</code>, <code>C:\Windows\System32\MRT.exe</code> is being run daily during the “Automatic Maintenance” window defined in the Action Center section of the control panel. So it is definitely installed and being run daily.
I tried using <a href="https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx" rel="noopener nofollow ugc">SysInternals AutoRuns</a> and looking at the Scheduled Tasks but was not able to find where it was being started.
How can we disable or uninstall the Malicious Software Removal Tool on our Windows Servers to prevent it from running?

ayi_2

Turns out the Automatic Maintenance tasks are managed by <code>C:\Windows\System32\MSchedExe.exe</code> and the Scheduled Tasks under the <code>\Microsoft\Windows\TaskScheduler</code> folder. It then will run other tasks that are defined but don’t have a specified trigger, one being the <code>MRT_HB</code> task under <code>\Microsoft\Windows\RemovalTools</code>.
Here you can see it calling MRT.exe to run the scan, and the last run time matches the information from the Action Center:
Si vous disable this Scheduled Task it should prevent the Malicious Software Removal Tool from running. You also can delete the task and the MRT.exe program using le suivant in an elevated PowerShell prompt:
<pre><code class="lang-auto">Unregister-ScheduledTask -TaskName 'MRT_HB' -TaskPath '\Microsoft\Windows\RemovalTools\' -Confirm:$false
Remove-Item 'C:\Windows\System32\MRT.exe' -Force

</code></pre>
Note, cependant, that si vous haven’t disabled the KB890830 update in WSUS or via <a href="https://superuser.com/a/895554/26374">the registry</a> it likely will be reinstalled, as MRT gets updated every patch Tuesday.