J. P. Gilliver (John) wrote:
In message , Paul
writes:
[]
I then got a EULA popup containing two boxes. The top, small, box says:
"Windows Malicious Software Removal Tool - November 2018 (KB890830)"
fair enough.
The lower, large, box says:
"Prerelease Version of Service Pack 2 for Microsoft Windows XP
Professional, Home, Media Center, or Tablet PC Edition
END-USER LICENSE AGREEMENT
[]
I've since scanned briefly through the EULA, and it really is the one
for XPSP2 - "solely in connection with a licensed copy of
Microsoft Windows XP Professional Edition, Windows
XP Home Edition, Windows XP Media Center Edition,
or Windows XP Tablet PC Edition operating systems for which the Software
is designed", and other such snippets.

Running 7 Hope Premium, SP1, 32 bit, if that makes any difference.

By any chance, does the C: volume have a boot.ini on it ?

Paul
Not that I can see, using Everything (looking everywhere - it stops
finding anything as soon a I've typed as far as "boot.i"), XTGold
(looking in the root), or Windows Explorer (looking in the root - and I
do have show hidden files etc.).

Is KB890830 the right identity for the November 2018 Malicious Software
Removal Tool?

Yes.

KB890830 is used everywhere.

It has a version number. It's been issued a bunch
of times, so the version number should be pretty high.

In effect, it's a Windows Update that keeps getting
re-issued, each time with a one-higher version number.
The version number is not a "visible" property, most
of the time.

https://www.catalog.update.microsoft...%20windows%207

There are two files listed per update.
The delta isn't the one you want.

I downloaded this sample for a look.

windows-kb890830-x64-v5.66_324d7f131dd4bd5ede96c9526a81970efeaa9d4e.exe

L:\mrt.exe\.rsrc\
version.txt

FILEVERSION 1,279,836,0
PRODUCTVERSION 1,279,836,0
FILEFLAGSMASK 0x3F
FILEFLAGS 0x0
FILEOS VOS_UNKNOWN | VOS__WINDOWS32
FILETYPE VFT_APP
FILESUBTYPE 0x0
{
BLOCK "StringFileInfo"
{
BLOCK "040904b0"
{
VALUE "CompanyName", "Microsoft Corporation"
VALUE "FileDescription", "MSRT Definition Database"
VALUE "InternalName", "itw"
VALUE "LegalCopyright", "Copyright (c) Microsoft Corporation. All rights reserved."
VALUE "OriginalFilename", "itw.vdm"
VALUE "ProductName", "Microsoft Malware Protection"
VALUE "FileVersion", "1.279.836.0"
VALUE "ProductVersion", "1.279.836.0"
}
}
BLOCK "VarFileInfo"
{
VALUE "Translation", 0x409, 1200
}
}

No mention of WinXP in that dump.

The MRT.exe file is version "5.66.15456.1".
In the one I downloaded for Win7 32 bit.

Paul