[MS Tech] Microsoft® Windows® Malicious Software Removal Tool (KB890830)

[Steven Burn]

Microsoft® Windows® Malicious Software Removal Tool (KB890830)

http://surl.co.uk/?1097

Original URL:
http://www.microsoft.com/downloads/details.aspx?FamilyID=ad724ae0-e72d-4f54-
9ab3-75b8eb148356&DisplayLang=en

This tool checks your computer for infection by specific, prevalent
malicious software (including Blaster, Sasser, and Mydoom) and helps to
remove the infection if it is found.

Overview
This tool will help to remove specific, prevalent malicious software from
infected systems. Because computers can appear to function normally when
infected, Microsoft advises you to run this tool even if your computer seems
to be fine. In addition to using this tool, you should use an up-to-date
antivirus product to help protect your computer from other malicious
software. For more information, see Protect Your PC.

A new version of this tool is released on the second Tuesday of every month.
These new versions will be available from the Microsoft Download Center-this
page-as well as from Windows Update / Automatic Updates. An online version
of the tool is also available. It is recommended that Windows XP users use
Windows Update / Automatic Updates to download the tool. If you are using
any other version of Windows for which this tool is supported, please
download the tool from this page or run the online version of the tool at
least once a month to ensure that you are using the latest version of this
software.

After the tool has been executed and the End-User License Agreement (EULA)
is accepted, the tool automatically checks for infection by specific,
prevalent malicious software and removes any found. When the detection /
removal process is complete, the tool displays a message describing the
outcome of the execution-including what malicious software, if any, was
detected and removed. The tool can be safely deleted after it has run. Also,
the tool creates a log file named mrt.log in the
%WINDIR%\debug folder.

Please review KB890830 for the list of malicious software that the current
version of the tool is capable of removing as well as usage instructions.
Also, please be aware that this tool reports anonymous information back to
Microsoft in the event that an infection is found or an error is
encountered. The above KB article contains information on how to disable
this functionality and what specific information is sent to Microsoft.

It is strongly recommended that you review KB891716 before you consider
deploying this tool in an enterprise environment.

The user must be an administrator to run this tool. This tool will not run
on any version of Windows 98, Windows ME, or Windows NT 4.0.

List of malicious software detected:

http://go.microsoft.com/fwlink/?LinkId=40573

--

Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!

 

[WebWalker]

This tool checks your computer for infection by specific, prevalent
malicious software (including Blaster, Sasser, and Mydoom) and helps to
remove the infection if it is found.

I usually download this type of removal tool from Symantec site.

 

[Chewy Zekelo]

Also, please be aware that this tool reports anonymous information
back to
Microsoft in the event that an infection is found or an error is
encountered. The above KB article contains information on how to
disable
this functionality and what specific information is sent to Microsoft.

Hmmmm

 

[Bob Adkins]

I usually download this type of removal tool from Symantec site.

The Symantec tools sit there and run for 5 or 10 minutes before finishing.
The MS tools take 10-15 seconds.

-- Bob

 

[KHaled]

On Wed, 12 Jan 2005 12:09:49 +0800, WebWalker

The Symantec tools sit there and run for 5 or 10 minutes
before finishing. The MS tools take 10-15 seconds.

-- Bob

Just thinking, is that good or bad ?? Seems that if there is
such a huge difference then it would be reasoable to expect
huge difference in function..

--
KHaled

e-mail: khaledihREMOVEUPPERCASELETTERS at fusemail dot net
(correcting antispam crap..)
please start your subject line with the string "==NG=="

 

[Bob Adkins]

Just thinking, is that good or bad ?? Seems that if there is
such a huge difference then it would be reasoable to expect
huge difference in function..

I hear you. I've wondered the same thing.

If the programmer does thorough and time-consuming research, he can find out
exactly what the malware files are and where they reside, and go directly to
them. Or he can take the easy approach and search the entire system for
known malware, file by file.

-- Bob

 

[schrodinger's cat]

I hear you. I've wondered the same thing.

If the programmer does thorough and time-consuming research, he can find out
exactly what the malware files are and where they reside, and go directly to
them. Or he can take the easy approach and search the entire system for
known malware, file by file.

-- Bob

According to the MS info, the tool only scans for malware components
which are currently active in memory - it does not scan the hard
drive. This would explain the speed.

 

[KHaled]

According to the MS info, the tool only scans for malware
components which are currently active in memory - it does
not scan the hard drive. This would explain the speed.

If that is the case, when such malware is found, and removed,
it may result in "holly" memory which would be rather
unstable, leading to systems crashes.

--
KHaled

e-mail: khaledihREMOVEUPPERCASELETTERS at fusemail dot net
(correcting antispam crap..)
please start your subject line with the string "==NG=="

 

[Tim Weaver]

If that is the case, when such malware is found, and removed,
it may result in "holly" memory which would be rather
unstable, leading to systems crashes.

It also says it may tell you to reboot if it finds and removes something.

 

[Richard Steven Hack]

If the programmer does thorough and time-consuming research, he can find out
exactly what the malware files are and where they reside, and go directly to
them. Or he can take the easy approach and search the entire system for
known malware, file by file.

The latter approach is safest - otherwise, all the malware writer has
to do is change the location! He could even set up a randomizer to
switch locations periodically (depending on the nature of the
malware).

 

[Richard Steven Hack]

I usually download this type of removal tool from Symantec site.

Far as I can tell, this thing has a fairly limited set of malware it
removes at this point, at least. Stinger is much more comprehensive,
I think - although it too doesn't remove everything - just certain
common ones.

Most of the antivirus companies have tools like this - AVG, Avast,
Antivir IIRC all have them. I've got a bunch of them on my hard
drive.

 

[Richard Steven Hack]

The Symantec tools sit there and run for 5 or 10 minutes before finishing.
The MS tools take 10-15 seconds.

The MS tool checks for less, too.

You really are a Microsoft employee - you were off the gate in two
posts...

 

[Richard Steven Hack]

It also says it may tell you to reboot if it finds and removes something.

That's Microsoft, all right!

You probably have to reboot even if it DOESN'T find anything!