Microsoft Windows Malicious Software Removal Tool?

On Thu, 22 Oct 2015 18:46:27 -0400, Stan Brown
wrote:

On Thu, 22 Oct 2015 12:12:32 -0700, Ken Blake, MVP wrote:
Necessary? No. But it' a good idea, since it lowers the risk of
malware.


But does it? That's the question.


As far as I'm concerned, it clearly does.


Certainly Microsoft Security
Essentials is nowhere near #1 in threat detection. Why should we
expect the Microsoft Software Removal Tool to be better than the
combination of a top-rated antivirus plus Malwarebytes?


Better? No, I don't think so. And I didn't say so. But the extra check
it provides lowers the risk.

On Thu, 22 Oct 2015 16:52:49 -0600, Ken1943 wrote:

On Thu, 22 Oct 2015 18:46:27 -0400, Stan Brown
wrote:

On Thu, 22 Oct 2015 12:12:32 -0700, Ken Blake, MVP wrote:
Necessary? No. But it' a good idea, since it lowers the risk of
malware.


But does it? That's the question. Certainly Microsoft Security
Essentials is nowhere near #1 in threat detection. Why should we
expect the Microsoft Software Removal Tool to be better than the
combination of a top-rated antivirus plus Malwarebytes?

Because it is programmed to only detect malware that has been reported
in the wild. No two programs look in the same area. Each is a little
different.



Exactly! I should have said that in the reply I just sent, but I
didn't.

On Thu, 22 Oct 2015 18:46:27 -0400, Stan Brown
wrote:

On Thu, 22 Oct 2015 12:12:32 -0700, Ken Blake, MVP wrote:
Necessary? No. But it' a good idea, since it lowers the risk of
malware.


But does it? That's the question. Certainly Microsoft Security
Essentials is nowhere near #1 in threat detection. Why should we
expect the Microsoft Software Removal Tool to be better than the
combination of a top-rated antivirus plus Malwarebytes?

I don't think it claims to be better than those, either combined or
separately.

It's just claimed to be better than nothing, and probably is.


--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

On Thu, 22 Oct 2015 18:46:27 -0400, Stan Brown
wrote:

On Thu, 22 Oct 2015 12:12:32 -0700, Ken Blake, MVP wrote:
Necessary? No. But it' a good idea, since it lowers the risk of
malware.


But does it? That's the question. Certainly Microsoft Security
Essentials is nowhere near #1 in threat detection. Why should we
expect the Microsoft Software Removal Tool to be better than the
combination of a top-rated antivirus plus Malwarebytes?

What I always wondered was, why did they call it a *software* removal tool?
Why not a malware removal tool? If I want to remove software, I hardly want
to wait a month for the next iteration of MSRT. ;-)

--

Char Jackson

On Thu, 22 Oct 2015 23:06:50 -0500, Char Jackson
wrote:

On Thu, 22 Oct 2015 18:46:27 -0400, Stan Brown
wrote:

On Thu, 22 Oct 2015 12:12:32 -0700, Ken Blake, MVP wrote:
Necessary? No. But it' a good idea, since it lowers the risk of
malware.


But does it? That's the question. Certainly Microsoft Security
Essentials is nowhere near #1 in threat detection. Why should we
expect the Microsoft Software Removal Tool to be better than the
combination of a top-rated antivirus plus Malwarebytes?

What I always wondered was, why did they call it a *software* removal tool?
Why not a malware removal tool? If I want to remove software, I hardly want
to wait a month for the next iteration of MSRT. ;-)

"Malware" is surely an abbreviastion for MALicious softWARE.


--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

Ed Cryer wrote:
Paul wrote:
David E. Ross wrote:
On 10/22/2015 11:39 AM, David E. Ross wrote:
On 10/22/2015 11:11 AM, wrote:
I have an Important Update(s) for the Microsoft Windows Malicious
Software
Removal Tool (KB890830). Is this Tool necessary and safe - it
updates every
month.

Do everyone update it when presented?

Any thoughts really appreciated and would be helpful.

charliec

I never use or update the Windows Malicious Software Removal Tool. I
depend on non-Microsoft anti-malware applications to detect and remove
malicious software.


Oops! I forgot to say why I do not use Microsoft's tool. Microsoft
constantly finds security vulnerabilities in its software. This makes
me wary of using a Microsoft tool to mitigate malware. That is, if they
cannot make their other applications safe, why should I trust the
Windows Malicious Software Removal Tool to be safe?


The tool is an attempt to remove the top fifty or so,
forms of malware. If the industry notices there are
a million machines in a botnet say, maybe MSRT has a
tool added to remove or quarantine part of that.

So rather than being a substitute for an AV program,
it's a tool focused on those people who run no AV
at all, and the tool removes the high-runner malwares.
It's still possible for a million different malwares
to get in the machine, or be missed entirely by the tool.

Think of it as the "FBI Ten Most Wanted List". It's that
list, only for malware.

The scan runs during the Windows Update tool installation,
with options being available later to extend the scan
if you want. Thus, for the average user who does not
investigate, this is a very quick and dirty check for malware,
and is intended to be an aid for those who don't have a tool
collection for this purpose.

I install it (and let it run), but do not have
high expectations it's going to be doing anything
for me.

Paul

I let it run as well. I have done for years. But I can't recall a single
occasion when it's had a hit. Maybe that's thanks to good firewall and
AV that I run. I've had those two have hits. Similarly with my web
browser; Firefox.

Ed

Likewise I install it when offered. Never found anything, nor has any
AV/AM program I've used on multiple machines (MSFT, ESET, Avast, Norton
AV stand-alone). The last intrusion was decades ago and from a Word
doc macro - relatively harmless and easily resolved without the need for
AV/AM ware.


--
....winston
msft mvp consumer apps

On Fri, 23 Oct 2015 02:04:21 +0100, Mandy Liefbowitz
wrote:

On Thu, 22 Oct 2015 12:31:33 -0700, wrote:

On Thu, 22 Oct 2015 12:42:00 -0600, Ken1943 wrote:

On Thu, 22 Oct 2015 11:11:36 -0700, wrote:

I have an Important Update(s) for the Microsoft Windows Malicious Software
Removal Tool (KB890830). Is this Tool necessary and safe - it updates every
month.

Do everyone update it when presented?

Any thoughts really appreciated and would be helpful.

charliec
It is safe to let it run.


Ken1943

I have current version of Norton AntiVirus running in live mode, and have the
current version of Malwarebytes which I run manually for full scans on a regular
basis (but do not have it in live mode - did not want the two to conflict).

MSRT rarely conflicts with anything.

Oh, we're talking about MSRT! I thought it was MSRP.

There isn't much that's sold at the manufacturer's suggested retail
price, anymore, so that's why I don't worry about it.

I'd be tempted to say it never conflicts but some numpty would
immediately tell us that it did on his system with some rare
combination of seventy-seven anti-malware products that he runs all at
once in fifty different virtual machines with eighty separate
operating systems.
There is *always* one. .
MSRT is supposed to find and bin malware on startup or login or

Oh, yeah. I get that too! It hasn't hurt me.

whenever it feels like it but it's not a real-time scanner, it just
has a look, says your system is clean and buggers off quietly. Like a
manual scan using MalwareBytes.
So far as I know it has *never* falsely deleted anything useful on
anyone's machine *ever*.
And, again, somebody is going to come in and tell me I'm wrong in
this.
But if it does delete anything, it usually tell you, allegedly.
https://en.wikipedia.org/wiki/Malici...e_Removal_Tool and
there's a link to the MS Support site on that page.

In short, it is safe.
Mand.


charliec

On Fri, 23 Oct 2015 07:22:56 +0200, Steve Hayes
wrote:

On Thu, 22 Oct 2015 23:06:50 -0500, Char Jackson
wrote:

On Thu, 22 Oct 2015 18:46:27 -0400, Stan Brown
wrote:

On Thu, 22 Oct 2015 12:12:32 -0700, Ken Blake, MVP wrote:
Necessary? No. But it' a good idea, since it lowers the risk of
malware.


But does it? That's the question. Certainly Microsoft Security
Essentials is nowhere near #1 in threat detection. Why should we
expect the Microsoft Software Removal Tool to be better than the
combination of a top-rated antivirus plus Malwarebytes?

What I always wondered was, why did they call it a *software* removal tool?
Why not a malware removal tool? If I want to remove software, I hardly want
to wait a month for the next iteration of MSRT. ;-)

"Malware" is surely an abbreviastion for MALicious softWARE.



Yes, it is! You took the words out of my (figurative) mouth.

On Fri, 23 Oct 2015 10:34:21 -0400, Wolf K wrote:

On 2015-10-23 00:06, Char Jackson wrote:
On Thu, 22 Oct 2015 18:46:27 -0400, Stan Brown
wrote:

On Thu, 22 Oct 2015 12:12:32 -0700, Ken Blake, MVP wrote:
Necessary? No. But it' a good idea, since it lowers the risk of
malware.


But does it? That's the question. Certainly Microsoft Security
Essentials is nowhere near #1 in threat detection. Why should we
expect the Microsoft Software Removal Tool to be better than the
combination of a top-rated antivirus plus Malwarebytes?

What I always wondered was, why did they call it a *software* removal tool?
Why not a malware removal tool? If I want to remove software, I hardly want
to wait a month for the next iteration of MSRT. ;-)

Erm, it's "malicious software", not "malicious...tool"

Which is admittedly a possible reading, because English spelling
ignores compounds, and we don't indicate the stress patterns that signal
compounds in speech. But that's OT (again :-) ).

Thanks, everyone, for the follow-ups, but I'm disappointed. I guess no one
saw or understood the emoticon.

--

Char Jackson

On Thu, 22 Oct 2015 11:11:36 -0700, wrote:

I have an Important Update(s) for the Microsoft Windows Malicious Software
Removal Tool (KB890830). Is this Tool necessary and safe - it updates every
month.

Do everyone update it when presented?

Any thoughts really appreciated and would be helpful.

charliec

I know this thread is 2 weeks old but I just came across this
somewhe

Microsoft is very clear that MSRT is not an antivirus program:

It offers no protection from infection. As Microsoft terms it,
MSRT is a "post-infection removal tool".
It only targets malware that Microsoft has judged to be the most
important. Full blown anti-malware software works against a much wider
range of software.
It only gets updated once a month. Full blown anti-malware
software is updated daily, at least.

http://www.computerworld.com/article...oval-tool.html

You can run MSRT manually at any time. In Windows XP, use Start - Run
- mrt.exe. You can even get away with just "mrt" in the Run box. In
Vista, type "mrt" into the search box (yes, it's "mrt" not "msrt"). It
seems to do a lot of processing before displaying the initial window,
expect a delay of 5 to 10 seconds. A portion of the initial window is
shown below.


It sounds like a good idea to me, to run it. I think I'll run it
right now.

On Thu, 22 Oct 2015 11:11:36 -0700, wrote:

I have an Important Update(s) for the Microsoft Windows Malicious Software
Removal Tool (KB890830). Is this Tool necessary and safe - it updates every
month.

Do everyone update it when presented?

Any thoughts really appreciated and would be helpful.

charliec

BTW,
1) is this cumulative? I think the answer is yes. It just
finished, with a list of malware that are not there, and there were
288 items in the list. (The url I cited a couple minutes ago
pointed out one month where it only looked for 2 items of malware, but
maybe it meant 2 new items, plus everything it had looked for
earlier.)

Also, I'm running it now. I set it for Quick Scan and just before it
stopped it was up to almost 100K files and 26 minutes. I'm glad to
say it found no problems.

But what gets me is
2) that it spends so much time on remapper.exe.

Whether I should or not, I put all the programs I can in c:\programs
and the scanning goes so fast that I only was able to notice Anywhere
and remapper.exe being scanned. It went pretty fast through the first
one, but remapper it pauses at for about 4 seconds. Then 10 minutes
later, again 4 seconds at that program, and I haven't been watching
all the time. Why does it scan it more than once?

OTOH, with automatic running of MSRT (msr.exe);
In the normal stealth mode of operation, if MSRT finds an
infection, it does not warn you immediately. Instead, it displays a
warning the next time Windows starts up and an Administrator logs on.
If the machine is reguarly used by a restricted user, this warning may
not display for a long time.

That stinks!!

There are many advantages to running MSRT manually:

You can opt to run a full scan rather than the default quick scan
You can run the program more than once a month, including any time
a PC seems to be acting strangely
You can manually insure that the latest version of MSRT is, in
fact, installed
You get definite notification of an infection

The last point stems from two issues. In the normal stealth mode of
operation, if MSRT finds an infection, it does not warn you
immediately. Instead, it displays a warning the next time Windows
starts up and an Administrator logs on. If the machine is reguarly
used by a restricted user, this warning may not display for a long
time. There are many advantages to running MSRT manually:

You can opt to run a full scan rather than the default quick scan
You can run the program more than once a month, including any time
a PC seems to be acting strangely
You can manually insure that the latest version of MSRT is, in
fact, installed
You get definite notification of an infection

The last point stems from two issues. In the normal stealth mode of
operation, if MSRT finds an infection, it does not warn you
immediately. Instead, it displays a warning the next time Windows
starts up and an Administrator logs on. If the machine is reguarly
used by a restricted user, this warning may not display for a long
time.

From the same url.