BleepingComputer.com: Malicious Software Removal Tool Does Not Run

I am running Windows XP Media Center Edition with SP3 on a Dell Dimension E510.

I already addressed this issue with Microsoft PC Safety, Microsoft Windows Update Support, and Microsoft XP Support. Using Microsoft EasyAssist they took control of the PC. They ran numerous checks for malware using several tools and came up clean. They checked the system using Dial a Fix. The system is so clean that there is no adware or extraneous temp files anywhere. The Microsoft folks spent many hours working systematically with me to try to isolate the cause over the past two months, yet the final answer is always the same:

"It was my pleasure to work with you on your service request 1092165374. Unfortunately, we were unable to resolve your issue. However, I hope that you were satisfied with the service provided to you. I will archive the service request as Not-Resolved."

I was advised today that the issue was being escalated, but would take a month or longer to address.

What they have found is that Microsoft Malicious Software Removal Tool (KB890830) is only partially installing. The process goes far enough that Windows Update will show a green check for Installation Successful. Indications for a casual user are that the everything is fine. But the Windows Update shield indicating that updates are ready for installation returns, sometimes in an hour, sometimes the next day.

Third party software was suspected, so we disabled all virus checking, etc. Even did a Safe Mode startup. No change. The Miocrosoft folks did a manual download and install. No change.

Symptoms that MSRT is not running (besides the recurring shield):

1. The file C:\windows\debug\mrt.log is not created by the Malicious Software Removal Tool with a current entry.
2. Examining the registry:
Subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\MRT
Entry name: Version
Value: C5E3D402-61D9-4DDF-A8F5-0685FA165CE8 should indicate February 2009. In its place is an entry indicating May 2006.
Reference: http://support.microsoft.com/?kbid=891716

As I implied earlier, the issue is not that I might have malicious software on this PC; we have run enough checks with several tools to assure me that is not the cause.

The issue is that MSRT gives the impression that it is installing when it is not, and the recurring shield is annoying. I know that I can hide the update in Windows Update, but that does not address the cause.

Any ideas on how to proceed would be great.

Thank you.

This post has been edited by Cinquefoil: 06 March 2009 - 11:53 AM

Hi Cinquefoil, and welcome to BleepingComputer.

If this has been such a pain why not use another malware application like Malwarbytes which works very well.

This post has been edited by dc3: 06 March 2009 - 12:17 PM

dc3, on Mar 6 2009, 12:15 PM, said:

Thank you for the welcome. While this is my first post requesting assistance, I've browsed BleepingComputer for years seeking to interpret error messages and learn about startup programs. My respect for those who post here is the reason I came here first when I could not find an answer on my own or through Microsoft.

As for using an alternative malware application, I haven't really given that much thought, as the tools I use have served me well. I suppose the primary reasons that I want MSRT to work correctly are that I like the concept of it being updated monthly to address the most likely threats from an XP perspective, that it needs no maintenance attention, and after it runs it leaves nothing active in the background to interfere with other programs. I also believe that MS certainly has a self-preservation incentive to make the tool run well!

I mentioned Malwarebytes because it is highly recommended here and is used by our HJT team, I have it on my computer as well. The only downside if you wish to view it that way is that you need to update it before running scans. It isn't active and doesn't interfere with other applications.

Today there is no single application which is going to completely protect you as I'm sure you are aware. I use Avast for my AV, Ashampoo's free firewall, and regularly run scans with Malwarebytes, SUPERAntiSpyware, and AdAware.

In the All Other Applications forum we have a sub-forum titled Freeware Replacements For Common Commercial Apps which has links to these applications. This link will take you there.

Arachibutyrophobia,

I appreciate the option of using another tool to identify malware, but for now I want to focus on finding someone who understands the workings of Microsoft's Malicious Software Removal Tool. It may seem like self torture, but I really want to find out the cause and fix it. Thank you again.

Cinquefoil, on Mar 6 2009, 11:12 AM, said:

I understand that you want to use this program and want to find out why it is not working and how to fix it, but if it only updates monthly, it hardly seems worth using. New malware comes out daily and if what you use to find it has not been updated for weeks, you are going to have a lot of it go undetected.

Please do not misunderstand, I am not trying to talk you out of using the program or into using something else, just wanted to point out that the program you are trying so hard to use will leave you vulnerable.

I wish you good luck in your quest to find a fix for the problem.

I think this is an ownership issue on the MRT.EXE in the \Windows\System32 directory. I had the same issue as you described, I then turned off simple file sharing and then changed ownership. Now MRT.EXE works fine! Good Luck

This post has been edited by LighthouseCO: 10 November 2011 - 07:24 PM

Thank you... after so much time it's great to learn an original solution. Very much appreciate it.