Secret Malicious Software Removal Tool

[Guest]

Microsoft has published a 'Malicious Software Removal Tool'. It is install at
a secrect location on disk under a secret name. The refuse to tell us how to
use it. The tool has a command line interface. That does do any good unless
they publish the name of the tool.

Does anyone know the name of the tool and how to find it?

 

[David H. Lipman]

Actually, just go the online scanner --
http://www.microsoft.com/security/malwareremove/default.mspx

That's it !

--
Dave





| Microsoft has published a 'Malicious Software Removal Tool'. It is install at
| a secrect location on disk under a secret name. The refuse to tell us how to
| use it. The tool has a command line interface. That does do any good unless
| they publish the name of the tool.
|
| Does anyone know the name of the tool and how to find it?

 

[Malke]

Microsoft has published a 'Malicious Software Removal Tool'. It is
install at a secrect location on disk under a secret name. The refuse
to tell us how to use it. The tool has a command line interface. That
does do any good unless they publish the name of the tool.

Does anyone know the name of the tool and how to find it?

If you are talking about the tool that appears on Windows Update, it is
not installed at all, let alone at a "secret location". It runs and
checks out your machine for those specific viruses and if your machine
is clean, disappears. If you are referring to the beta antispyware
removal tool instead, you can refer to these newsgroups:

- microsoft.private.security.spyware.announcements
- microsoft.private.security.spyware.appcompat
- microsoft.private.security.spyware.general
- microsoft.private.security.spyware.install
- microsoft.private.security.spyware.networking
- microsoft.private.security.spyware.signatures
- microsoft.private.security.spyware.onlinecommunity
These newsgroups can be accessed via NNTP or HTTP.

To access these newsgroups using HTTP, please go to the following
location:

http://communities.microsoft.com/newsgroups/default.asp?ICP=spyware&sLCID=us

To access these newsgroups using NNTP, please use the following
information for your NNTP client (such as Microsoft Outlook Express):

- NNTP Server: privatenews.microsoft.com
- Account name: privatenews\spyware
- Password: spyware

NOTE: No password will be required via the HTTP link

Malke

 

[Torgeir Bakken \(MVP\)]

Microsoft has published a 'Malicious Software Removal Tool'. It is install at
a secrect location on disk under a secret name. The refuse to tell us how to
use it. The tool has a command line interface. That does do any good unless
they publish the name of the tool.

Does anyone know the name of the tool and how to find it?

Hi

Download Windows-KB890830-ENU.exe from here
http://go.microsoft.com/fwlink/?linkid=40587

Run it like this to scan the computer in unattended mode:
Windows-KB890830-ENU.exe /Q

After the scan is complete, the tool creates a file Mrt.log that
contains the results of the scan. The file is in the %windir%\Debug
folder.

If you run
Windows-KB890830-ENU.exe /?
you will get this message box:

---------------------------
Microsoft® Windows® Malicious Software Removal Tool
---------------------------
Usage:
/Q - quiet mode; if set, no UI is shown
/? - displays usage and engine version information
---------------------------
OK
---------------------------

Mere here also:

Deployment of the Microsoft Windows Malicious Software Removal Tool in an
enterprise environment
http://support.microsoft.com/default.aspx?scid=kb;en-us;891716

 

[Guest]

Torgier
I have search my Harddisk and I can't find Windows-KB890830-ENU.exe. I
thought I downloaded that fix. (Is your name Norwegian?)
Arne

 

[Torgeir Bakken \(MVP\)]

Torgier
I have search my Harddisk and I can't find Windows-KB890830-ENU.exe. I
thought I downloaded that fix.

Well, download it (again) from the link I provided...

(Is your name Norwegian?)

Yes (see my signature below).

 

[Guest]

Microsoft's web site for this KB states:
• When you download the tool from Windows Update or from Automatic Updates,
the tool always runs in quiet mode.
• When you run the tool from our Web site at http://www.microsoft.com, the
tool always displays a user interface (UI).
• When you download the tool from the Microsoft Download Center, the tool
ordinarily displays a UI when it runs. However, if you supply the /Q
command-line switch, it runs in quiet mode.

 

[Bruce Chambers]

Microsoft has published a 'Malicious Software Removal Tool'. It is install at
a secrect location on disk under a secret name. The refuse to tell us how to
use it. The tool has a command line interface. That does do any good unless
they publish the name of the tool.

Does anyone know the name of the tool and how to find it?

You really need to read the KB Article that describes the use of
this tool. The tool is updated the second Tuesday of each month, appears
as a "Critical Update" on the Windows Update site, and runs only when
"downloaded." Nothing is installed; there's nothing to run at a later
date; there's nothing to ever uninstall.

http://support.microsoft.com/default.aspx?scid=kb;en-us;890830

--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH

 

[Guest]

Microsoft has published a 'Malicious Software Removal Tool'. It is install at
a secrect location on disk under a secret name. The refuse to tell us how to
use it. The tool has a command line interface. That does do any good unless
they publish the name of the tool.

Does anyone know the name of the tool and how to find it?

I think that I may have the same issue... maybe.

Today I noticed in a strange and un-related location a folder with some
random number... "d3d6210958507540672ebedd".

I wondered where this foder came from... so i looked inside, and found 2
files... "mrt.exe" and "mrtstub".

I have no idea where they came from. If it was from Mircosoft with my
automatic updates, why did it install it is such a random loacation?
(secondary HD)

I researched this a bit, and found simmilar posts about people wondering if
this is a virus or whatever. I am wondering if i can get any answeres here.

Is this mysterious folder that says... "malicious software removalt tool"
related to MS? Or is it a virus?

Thanks

 

[David H. Lipman]

From: "Woody" <[email protected]>


|
| I think that I may have the same issue... maybe.
|
| Today I noticed in a strange and un-related location a folder with some
| random number... "d3d6210958507540672ebedd".
|
| I wondered where this foder came from... so i looked inside, and found 2
| files... "mrt.exe" and "mrtstub".
|
| I have no idea where they came from. If it was from Mircosoft with my
| automatic updates, why did it install it is such a random loacation?
| (secondary HD)
|
| I researched this a bit, and found simmilar posts about people wondering if
| this is a virus or whatever. I am wondering if i can get any answeres here.
|
| Is this mysterious folder that says... "malicious software removalt tool"
| related to MS? Or is it a virus?
|
| Thanks

MRT.EXE is the Malicious Software Removal Tool, a "On Demand" and malware scanner.

Upon installation, the utility is...
%windir%\system32\MRT.exe

If you had a folder such as "c:\d3d6210958507540672ebedd" then this is a remanant of a
HotFix or update via Windows Update and for some unknown reason was NOT auto-deleted when
the files were extracted and used/moved.

Command line switches...

/? or /HELP = displays the command line switches
/Q = quiet
/N = detect only
/F = force extended scan
/F:Y = force extended scan and automatically clean infected files

The following is the resultant log file...

%windir%\Debug\mrt.log