Microsoft Windows Malicious Software Removal Tool - how does it work?

Elroy Jetson · January 11th, 2005

Windows update installed the Microsoft Windows Malicious Software Removal Tool, buit how does it work? I have no link to the program anywhere i can see? What does it do, and how?

Any help greatly appreciated!
EJ ;-)

**j79zlr** · January 11th, 2005

http://support.microsoft.com/?id=890830

Elroy Jetson · January 11th, 2005

Originally Posted by j79zlr

http://support.microsoft.com/?id=890830

Yes, thanks j79zlr, i saw and read through this, but it still does not say how it actually runs. is it scheduled somehow, command line only (in which case, what is the file name?), ...

I am clueless!

RickyC · January 11th, 2005

It isn't installed on your PC, you can download a manual version, it's just a run once type of program. If you visit Windows Update you should still see it there.

Manual DL:

http://www.microsoft.com/downloads/d...displaylang=en

Elroy Jetson · January 11th, 2005

Originally Posted by RickyC

It isn't installed on your PC, you can download a manual version, it's just a run once type of program. If you visit Windows Update you should still see it there.

Nope, it is gone. just visited the windowsupdate, and it is not there. will it reappear every month, though? strange tool...

and the installation history tells me it was successful, too.
see: Malicious Software Removal Tool - January 2005 (KB890830) Successful Wednesday, 12 January 2005 Windows Update website

and if it is a run once thing, where is it stored? I can't even find a file ...

**Electronic Punk** · January 11th, 2005

Check out the frontpage for a link to it.
It will be updated every month.

Pretty neat and I hope it has the desired effect.

Elroy Jetson · January 11th, 2005

Originally Posted by Electronic Punk

Check out the frontpage for a link to it.
It will be updated every month.

Pretty neat and I hope it has the desired effect.

Yes, I could do this, but windowsupdate tells me it was installed, and I CANNOT FIND IT !!!!!

RickyC · January 11th, 2005

It downloads a cab file to a temp folder and extracts it, check your temp folders though it may just delete the files after it has run

Check my above post if you want to DL it again

(oops didn't see it on the frontpage)

leedogg · January 12th, 2005

Yeah I was looking around like crazy trying to figure out how to run it after it was installed...found out it runs right after install and just checks once. When you click on finish, thats actually the report saying that it has or has not found something. to run the online version click here:

http://www.microsoft.com/security/ma...e/default.mspx

Elroy Jetson · January 12th, 2005

Originally Posted by leedogg

Yeah I was looking around like crazy trying to figure out how to run it after it was installed...found out it runs right after install and just checks once. When you click on finish, thats actually the report saying that it has or has not found something. to run the online version click here:

http://www.microsoft.com/security/ma...e/default.mspx

So do I understand it corretly, then, that with each windows update from now on I will be downloading a new version of this "software" rather than update a current version on my system? What a stupid, stupid way of distributing such a piece of code. M$, you have done it again ....

<walks away scratches his haed>

EJ

leedogg · January 12th, 2005

I think so. I dont quite get it either...but it really is only a check for a handful of worms/trojans. similar to mcafee's stinger.

leedogg · January 12th, 2005

I found out where this gets installed. Go to internet options, under temp internet files, click on settings, click view objects. You should see it in there.

**NetRyder** · January 12th, 2005

Bear in mind that this is NOT meant to be a replacement for your regular antivirus software (just a heads up for those who were even thinking along these lines). It's targeted towards clueless users who don't have AV software installed (or those with definitions that haven't been updated in months because of an expired subscription) and are hit by the most common worms.

Basically, it's just a removal tool that'll check your computer once every month. Realtime scanning will still need to be handled by third-party antivirus software.

**j79zlr** · January 13th, 2005

What I don't understand is that it scans for worms that exploit holes patched months ago, now if they go to Windows Update and get the stupid removal tool, they should just update their entire system, and then you don't need the removal tool. Anyone follow?

**falconguard** · January 13th, 2005

yes , I agree. But what if the worms already resided on the hard drive previous to updating? You know the fact of updating would not be necessary if everybody did it, but let's be honest Windows went to automatic updates becuase there were the few out there who just never bothered. You know who you are...

leedogg · January 13th, 2005

Agreed, this simply sounds like a service MS provides, scanning for particular trojans right before you update patches.

January 11th, 2005	Top \| #1
Elroy Jetson Little Dipper School Joined: October 2002 Location: Adelaide, Australia Posts: 330 Reputation: 10 Power: 120	Microsoft Windows Malicious Software Removal Tool - how does it work? Windows update installed the Microsoft Windows Malicious Software Removal Tool, buit how does it work? I have no link to the program anywhere i can see? What does it do, and how? Any help greatly appreciated! EJ ;-)

January 11th, 2005	Top \| #2
j79zlr Glaanies script monkey Joined: February 2003 Location: Chicago Posts: 2,725 Reputation: 1520 Power: 155	http://support.microsoft.com/?id=890830 http://www.j79zlr.com

January 11th, 2005	Top \| #3
Elroy Jetson Little Dipper School Joined: October 2002 Location: Adelaide, Australia Posts: 330 Reputation: 10 Power: 120	Originally Posted by j79zlr http://support.microsoft.com/?id=890830 Yes, thanks j79zlr, i saw and read through this, but it still does not say how it actually runs. is it scheduled somehow, command line only (in which case, what is the file name?), ... I am clueless!

January 11th, 2005	Top \| #5
Elroy Jetson Little Dipper School Joined: October 2002 Location: Adelaide, Australia Posts: 330 Reputation: 10 Power: 120	Originally Posted by RickyC It isn't installed on your PC, you can download a manual version, it's just a run once type of program. If you visit Windows Update you should still see it there. Nope, it is gone. just visited the windowsupdate, and it is not there. will it reappear every month, though? strange tool... and the installation history tells me it was successful, too. see: Malicious Software Removal Tool - January 2005 (KB890830) Successful Wednesday, 12 January 2005 Windows Update website and if it is a run once thing, where is it stored? I can't even find a file ...

January 11th, 2005	Top \| #7
Elroy Jetson Little Dipper School Joined: October 2002 Location: Adelaide, Australia Posts: 330 Reputation: 10 Power: 120	Originally Posted by Electronic Punk Check out the frontpage for a link to it. It will be updated every month. Pretty neat and I hope it has the desired effect. Yes, I could do this, but windowsupdate tells me it was installed, and I CANNOT FIND IT !!!!!

Latest News Posts

Latest Forum Posts

Latest Member Blogs

January 11th, 2005	Top \| #4
RickyC OSNN Addict Joined: September 2004 Location: Earth Posts: 199 Reputation: 110 Power: 96	It isn't installed on your PC, you can download a manual version, it's just a run once type of program. If you visit Windows Update you should still see it there. Manual DL: http://www.microsoft.com/downloads/d...displaylang=en

January 11th, 2005	Top \| #6
Electronic Punk The Last High Joined: December 2001 Location: London Posts: 18,510 Blog Entries: 51 Reputation: 3652 Power: 349	Check out the frontpage for a link to it. It will be updated every month. Pretty neat and I hope it has the desired effect.

January 11th, 2005	Top \| #8
RickyC OSNN Addict Joined: September 2004 Location: Earth Posts: 199 Reputation: 110 Power: 96	It downloads a cab file to a temp folder and extracts it, check your temp folders though it may just delete the files after it has run Check my above post if you want to DL it again (oops didn't see it on the frontpage)

January 12th, 2005	Top \| #9
leedogg Gojyone kawaiiiiiiii! Joined: March 2002 Posts: 820 Reputation: 190 Power: 134	Yeah I was looking around like crazy trying to figure out how to run it after it was installed...found out it runs right after install and just checks once. When you click on finish, thats actually the report saying that it has or has not found something. to run the online version click here: http://www.microsoft.com/security/ma...e/default.mspx

January 12th, 2005	Top \| #10
Elroy Jetson Little Dipper School Joined: October 2002 Location: Adelaide, Australia Posts: 330 Reputation: 10 Power: 120	Originally Posted by leedogg Yeah I was looking around like crazy trying to figure out how to run it after it was installed...found out it runs right after install and just checks once. When you click on finish, thats actually the report saying that it has or has not found something. to run the online version click here: http://www.microsoft.com/security/ma...e/default.mspx So do I understand it corretly, then, that with each windows update from now on I will be downloading a new version of this "software" rather than update a current version on my system? What a stupid, stupid way of distributing such a piece of code. M$, you have done it again .... <walks away scratches his haed> EJ

January 12th, 2005	Top \| #11
leedogg Gojyone kawaiiiiiiii! Joined: March 2002 Posts: 820 Reputation: 190 Power: 134	I think so. I dont quite get it either...but it really is only a check for a handful of worms/trojans. similar to mcafee's stinger.

January 12th, 2005	Top \| #12
leedogg Gojyone kawaiiiiiiii! Joined: March 2002 Posts: 820 Reputation: 190 Power: 134	I found out where this gets installed. Go to internet options, under temp internet files, click on settings, click view objects. You should see it in there.

January 12th, 2005	Top \| #13
NetRyder Tech Junkie Joined: April 2002 Location: New York City Posts: 13,256 Reputation: 4260 Power: 298	Bear in mind that this is NOT meant to be a replacement for your regular antivirus software (just a heads up for those who were even thinking along these lines). It's targeted towards clueless users who don't have AV software installed (or those with definitions that haven't been updated in months because of an expired subscription) and are hit by the most common worms. Basically, it's just a removal tool that'll check your computer once every month. Realtime scanning will still need to be handled by third-party antivirus software. http://kunal.kundaje.net

January 13th, 2005	Top \| #14
j79zlr Glaanies script monkey Joined: February 2003 Location: Chicago Posts: 2,725 Reputation: 1520 Power: 155	What I don't understand is that it scans for worms that exploit holes patched months ago, now if they go to Windows Update and get the stupid removal tool, they should just update their entire system, and then you don't need the removal tool. Anyone follow? http://www.j79zlr.com

January 13th, 2005	Top \| #15
falconguard Carbon based lifeform Joined: February 2004 Location: SoCal Posts: 3,406 Reputation: 2305 Power: 158	yes , I agree. But what if the worms already resided on the hard drive previous to updating? You know the fact of updating would not be necessary if everybody did it, but let's be honest Windows went to automatic updates becuase there were the few out there who just never bothered. You know who you are...

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Microsoft Change Analysis Diagnostic Tool for Windows XP (SP2)	madmatt	Windows Desktop Systems	13	March 29th, 2007 2:53am
Norton Removal Tool	tdinc	Windows Desktop Systems	3	January 22nd, 2007 1:30pm
Malicious Software Removal Tool version 1.5	enuffsaid	Windows Desktop Systems	0	June 14th, 2005 4:15pm
Microsoft Malicious Software Removal Tool 1.2	Lee	Windows Desktop Systems	8	April 12th, 2005 1:26pm
MyDoom removal tool	FishBoy	Windows Desktop Systems	0	November 17th, 2004 5:29am

January 13th, 2005	Top \| #16
leedogg Gojyone kawaiiiiiiii! Joined: March 2002 Posts: 820 Reputation: 190 Power: 134	Agreed, this simply sounds like a service MS provides, scanning for particular trojans right before you update patches.