Error installing KB890830

[Guest]

Sorry for cross-posting but I just found this more-appropriate group.

My automatic updates on my WindowsXP will not install the above fix. It's
stuck in a loop asking to download, then asking to install, then telling me I
have the exact same KB waiting to download and install yet again.
I've tried to download and manually install the update but it only starts to
unpack (I see MRTSTUB.EXE) but then nothing happens.

 

[Guest]

Hello billls,

Suggest cleaning up the system (clearing out all the Temp/Tmp folders, and
included all offline content, clearing the browser TIF, Delete Cookies , do a
Disk CleanUp.

Please confirm your system clock and Time Zone also the Date set properly,
Having it set incorrectly can cause this type of behavior.

Just out of interest. What version of Windows are you using? Am I correct in
thinking that you are talking about Windows 2000?


Have you scanned your system for malware (spyware, adware, trojans, and
other pests) using other tools, like Ad-Aware, Spybot S&D, a-Squared, ewido,
Spyware Doctor, Pest Patrol (online)?


For the benefit of the community reading this post, please rate the pºst.

I hope this post is helpful.

Let us know how it works ºut.

Еиçεl

 

[Guest]

Disregard the question about Windows 2000.

 

[Bill Sanderson MVP]

Hmm - 890830 is the Malicious Software Removal Tool. This is unusual
behavior for it.

Under normal circumstances, this one is downloaded, saved on your disk, and
executes with no UI, and exits. It leaves behind its executable, which can
be run any time you want, and a log file of any results. If anything is
found, I believe you see something, but I've never seen what actually
happens in that case.

You can run this from its web page:

http://www.microsoft.com/security/malwareremove/default.mspx

I believe that if you run it directly, you will see some output.

Here's what the one on my disk looks like:


Directory of E:\WINDOWS\system32

06/06/2007 02:38 AM 15,747,032 MRT.exe
1 File(s) 15,747,032 bytes

So--it lives in %windir%\system32, and is called MRT.EXE.

The log file is in %windir%\debug, and is called mrt.log

If I run MRT.exe directly, I get a UI display.

Normally, you will see this file every month. It is revised monthly and it
is cumulative--it cleans more and more malware.

If that's what you mean by the repeat--it is normal. If it is repeating on
a daily or hourly basis, something is wrong.

This is definitely a security or patching issue which qualifies for free
support from Microsoft PSS. In the U.S. or Canada, you may call
1-866-PCSafety. Elsewhere, call the local number (if available) for paid
support for Windows, and ask for the free support for virus, spyware, or
security patch issues.

You might also consider doing a scan with the Windows Live safety scanner,
which is linked to from the page link I posted above.

 

[Guest]

I can run MRT.EXE from my \system32 folder and it runs a version of the
software from 3/06 flawlessly. It also says that it needs to be updated at
the beginning. It just doesn't seem to let the latest version install, even
with my Zonealarm disabled.
The repeat is the system tray notification that the KB needs to be
downloaded, then notification that it's ready to be installed. After it
installs, I get the notification again that I have updates waiting to be
downloaded again. Click on it and it's the same KB because the other never
installed.

 

[Bill Sanderson MVP]

Hmm. With most updates, the thing I try in this situation is to 1)
uninstall the update, if it shows as installed, and 2) download the update
as a separate package and save it to the desktop, then run that. If that
fails, there is a log file which may be worth reading through to see if
there are clues to what failed.

OK - so I'm going here:

http://www.microsoft.com/downloads/...e0-e72d-4f54-9ab3-75b8eb148356&displaylang=en

OK - downloaded to the desktop, and double-clicked. It opens UI, and I
choose a quick scan--not enough time tonight for a full scan. As it runs, I
see that in %windir%\debug there are two text files open, mrt and mrteng.

OK - nothing found, exit the UI.

mrteng shows that I've run the June version of this file three times
now--once when it arrived via AU, once yesterday when I responded to your
message, and once tonight.

mrt shows that I've been running this product since May of 2005, and every
run has a return code of zero, which I suspect is good, but boring for the
antimalware folks.

Neither of these has install/uninstall stuff. I can't spot a log file
related to the MRT except those noted above.

OK: 1) does %windir%\debug exist, and can you create and delete files in
it?
2) can you delete %windir%\system32\mrt.exe ?

Having done that, can you run the download I linked to above--and does it
place the current version in that location? (and if that works, does the
looping update quit, perhaps after another iteration?)

This is all I can see to look for--perhaps there are registry entries
associated with this critter, but I don't have a reference to them handy.
Can you imagine any app or settings on your system, changed since second
Tuesday of May, that might prevent access to the above locations?

--

 

[Guest]

Ok, fixed the problem. Deleted the existing MRT.EXE. Tried running the
downloaded executable and it "installed" and ran. After this, I went through
the motions for the automatic updates of downloading and installing. At this
point, it apparently "installed" and my yellow sheild went away in my system
tray.

Almost as if something (Windows?) was protecting the old MRT.EXE from being
overwritten? I hadn't installed this update for a while; I had just been
telling it to ignore it. This latest batch of patches wouldn't let me ignore
it, though.

 

[Bill Sanderson MVP]

It does sound as though something was keeping the existing MRT.exe from
being overwritten. Glad it was that easy to fix. I'm not sure what would
have done that, but I don't think I'd worry about it too much, unless it
recurs.

--