KB890830 ?

[Dave]

Recently Windows XP Update installed KB890830. The explanation for this fix
states

"Malicious Software Removal Tool - January 2005 (KB890830)
This tool checks your computer for infection by specific, prevalent
malicious software (including Blaster, Sasser, and Mydoom) and helps remove
any variants found. You should also use an antivirus product to remove other
malicious software that may be present. This tool helps maintain your
computer, and its appearance does not indicate that your machine is infected
with malicious software. After you run this item, you may have to restart
your computer.
Help and support
http://go.microsoft.com/fwlink/?LinkId=39987"

This link leads to
http://support.microsoft.com/?kbid=890830

The explanation is not very clear. I cannot find where this tool has been
loaded/installed on my computer or how I can manually run it. Therefore, I
went to
http://www.microsoft.com/downloads/...e0-e72d-4f54-9ab3-75b8eb148356&displaylang=en,
downloaded and saved the tool to desktop.

Is it intended that this tool and subsequent monthly issues are only run
once, at the time of downloading Windows Monthly Updates?

 

[RJK]

It's just installed on my PC, and I had a quick rummage around to see if I
could it - I couldn't !

So thoughtful of MS to stuff things into my PC without a hint as to where
they've disappeared to - and without any hint as to whether it's automatic /
tsr / does nothing until you "fire it up" etc. !!!!

regards, Richard

 

[mark]

If so, this means that the Microsoft tool will be current one day per month.

 

[RJK]

....http://support.microsoft.com/?kbid=890830

LOL

Q3: How do I remove this tool?
A3: The tool does not have to be removed because the tool is never
installed. No Programs folder entry or Add/Remove Programs entry is created
when the tool is run. However, there may be a temporary folder left in the
root of one of your disks. This folder will be removed on next restart.

.....that makes sense

Q34: Is there a newsgroup available to discuss this tool?
A34: Yes. You can use the microsoft.public.security.virus newsgroup.

regards, Richard

 

[RJK]

MS could have pointed out that after getting it via WU, it runs and then
VANISHES into the ether !!

regards, Richard

 

[Dave]

Where did MS point out that after getting it via WU, it runs and then
VANISHES into the ether................?
I can't find this statement.
Dave

 

[Dave]

Richard,
This tool was downloaded as part of Windows XP SP2 Update. I don't wish to
discuss the merits of its operation (on microsoft.public.security.virus) but
where did Windows Update place this fix tool on my computer. This is why I
posted my comment on microsoft.public.windowsxp.general and not at your
suggested forum.
Dave

 

[Bill]

I dont think anything gets installed. It seems to be a free scan done
whenever windows update has it available. Its web based and not a tsr or
similar

And I think RJKs second post said "MS could have etc " Not that MS said.

bill

 

[Bart Marks]

Recently Windows XP Update installed KB890830. The explanation for
this fix states

"Malicious Software Removal Tool - January 2005 (KB890830)
This tool checks your computer for infection by specific,
prevalent
malicious software (including Blaster, Sasser, and Mydoom) and helps
remove any variants found. You should also use an antivirus product to
remove other malicious software that may be present. This tool helps
maintain your computer, and its appearance does not indicate that your
machine is infected with malicious software. After you run this item,
you may have to restart your computer.
Help and support
http://go.microsoft.com/fwlink/?LinkId=39987"

This link leads to
http://support.microsoft.com/?kbid=890830

The explanation is not very clear. I cannot find where this tool has
been loaded/installed on my computer or how I can manually run it.
Therefore, I went to
http://www.microsoft.com/downloads/thankyou.aspx?FamilyID=ad724ae0-e72d
-4f54-9ab3-75b8eb148356&displaylang=en, downloaded and saved the tool
to desktop.

Is it intended that this tool and subsequent monthly issues are only
run once, at the time of downloading Windows Monthly Updates?

Sometimes, especially with the Microsoft article writers, who must be
woefully underpaid or overworked, the design is definately in the details:

Help and support:

http://go.microsoft.com/fwlink/?LinkId=39987

More information:

http://go.microsoft.com/fwlink/?LinkId=39987


RUN AN ONLINE VERSION:

http://www.microsoft.com/security/malwareremove/default.mspx


It's just a little ActiveX dealy'o, which doesn't remain [necessarily] on
your system, which uses the Windows Update system file to record it's use
on individual machines, which would be apparent if everyone had their IE6
configured like mine (^; - but you can always do it manually, if that would
be easier for anyone.

 

[Ron AG]

From article http://support.microsoft.com/?kbid=890830

"Note that the tool is not actually installed on a computer. Therefore, no
entry is created for it in the Programs folder or in Add/Remove Programs"

 

[Gerry Cornell]

Dave

There follows the best plain English explanation I have so far seen:

<quote>
Starting from January 11th, 2005, Microsoft will provide Windows
customers with Malicious Software Removal Tools. New versions of these
tools will be available monthly (second Tuesday of every month on the
same schedule that Microsoft already delivers other security updates) or
more frequently if necessary.

These removal tools are an extension of virus or worm specific removal
tools that Microsoft released in 2004. While tools released in 2004 have
been specific to a single virus (and some of its variants), the new
removal tools provide more convenience for customers by rolling up all
viruses and variants targeted into a common removal tool.

Microsoft will provide new versions of this tool updated to remove
malicious software that is found to be prevalent for that month. The
first version of the tool available in January will be able to remove
Blaster, Sasser, MyDoom, DoomJuice, Zindos, Berweb (also known as
Download.Ject), Gailbot and Nachi viruses / worms.

These removal tools will be made available to customers through the
following delivery vehicles:
- As a download through the Microsoft Download Center
- As a critical update through Windows Update and through Auto Update
for those customers who have Auto Update turned on
- As an ActiveX control also available at
www.microsoft.com/malwareremove

Additional Information

For additional information about today's announcements regarding
Microsoft Windows AntiSpyware and Microsoft Malicious Software Removal
Tools, please see the public press release located here:
http://www.microsoft.com/presspass/press/2005/jan05/01-06NewSolutionsPR.asp
</quote>

This was posted by PA Bear but I am not sure where it originates.

--

~~~~~~


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Guest]

Recently Windows XP Update installed KB890830. The explanation for this fix
states

"Malicious Software Removal Tool - January 2005 (KB890830)
This tool checks your computer for infection by specific, prevalent
malicious software (including Blaster, Sasser, and Mydoom) and helps remove
any variants found. You should also use an antivirus product to remove other
malicious software that may be present. This tool helps maintain your
computer, and its appearance does not indicate that your machine is infected
with malicious software. After you run this item, you may have to restart
your computer.
Help and support
http://go.microsoft.com/fwlink/?LinkId=39987"

This link leads to
http://support.microsoft.com/?kbid=890830

The explanation is not very clear. I cannot find where this tool has been
loaded/installed on my computer or how I can manually run it. Therefore, I
went to
http://www.microsoft.com/downloads/...e0-e72d-4f54-9ab3-75b8eb148356&displaylang=en,
downloaded and saved the tool to desktop.

Is it intended that this tool and subsequent monthly issues are only run
once, at the time of downloading Windows Monthly Updates?

Hello, KB890830 is located on this unit :
C:\Windows\SoftwareDistribution\Download\Install
KB890830-ENU.exe
This is were the Microsoft auto update placed the file when it was
downloaded this AM.
Take Care.
beamish.

 

[Bruce Chambers]

Is it intended that this tool and subsequent monthly issues are only run
once, at the time of downloading Windows Monthly Updates?

Yes, that's exactly what that KB Article explains.

--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH

 

[Gerry Cornell]

Dave

You will find a log of the scan in mrt.log in \windows\debug.



~~~~~~


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~