 Question About Windows Malicious Software Removal Tool Update, What is this exactly and how does it work? |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.  |
 May 24 2007, 02:54 PM
Post
#16
|
|
|
Distinguished Member  Group: Members Posts: 634 Joined: 11-February 07 Member No.: 111,188  |
->Scan ERROR: resource process://pid:1244 (code 0x0000054F (1359)) vsmon.exe ->Scan ERROR: resource process://pid:2060 (code 0x0000054F (1359)) zlclient.exe ->Scan ERROR: resource process://pid:1244 (code 0x0000054F (1359)) vsmon.exe 1. In bold shows what Process Explorer says each thing is. So it's a ZoneAlarm thing. My guess is that you don't use ZA free? And maybe something changed with the newest MSRT that causes ZA to make these errors? 2. I saw when I did a search of my hard drive that MRT.exe is in System 32 folder -- Last revised May 11, but accessed today, I think when I ran the MSRT tool you had me download to my desktop (Windows-KB890830-V1.29.exe). Why is there an MRT.exe in my System32 folder already? Is that just from when the tool was originally downloaded as part of Windows Update and then this is also what is "updated" each month when you download the MSRT update as part of the critical Windows Updates? 3. Re: EULA -- I did not have one for the MSRT program, but there was one you had to agree to for the Process Explorer program. But when you open the PE program again after closing it, the EULA does not come up. If PE is a stand-alone program that doesn't install, then how does it know you've already agreed to the EULA the first time you ran the program? Where is that stored? On your computer somewhere? 4. I posted another topic asking about process that seem to show as using System Resources right when I open Task Manager, but then the CPU % goes back to zero a split second later. Can you take a look at my thread here? http://www.bleepingcomputer.com/forums/topic93356.html Someone posted that I can "use Process Explorer to see what's going on beneath the processes (but it'll be a trick since it's so brief)" -- but I'm uncertain how to do this and what I'd be looking for. Any thoughts/suggestions? Thanks!  -------------------- My stats: Windows XP Home SP2; Firefox 2.0.0.16; IE 6.5 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 7.5 A/V Free - AVG 7.5 Antispyware Free - AVG Anti-Rootkit Free (all soon to be replaced with AVG 8.0 Free); SuperAntispyware Free 4.15.1000; Spybot 1.4 (Immunised from a few months ago, but no longer doing updates - soon to be uninstalled); AdAware SE Free 1.06r1 (haven't downloaded definitions in awhile though)
|
 |
 
|
|
May 24 2007, 04:45 PM
Post
#17
|
|
 Bleepin' Janitor Group: Global Moderator Posts: 12,548 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513 |
QUOTE ...it's a ZoneAlarm thing. My guess is that you don't use ZA free? That's correct. You may have to speak to the ZA folks about the error so they can investigate.QUOTE Why is there an MRT.exe in my System32 folder already? When you run the tool a copy (most current version) is placed in your system32 folder. The other folder it creates is only temp and is removed after the tool has finished running. Its all normal.QUOTE If PE is a stand-alone program that doesn't install, then how does it know you've already agreed to the EULA the first time you ran the program? Where is that stored? On your computer somewhere? It doesn't know. A copy of the EULA will be placed in the same folder as PE after extracting the files. Its up to you to read it. Most people are too lazy to do so.
-------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?"
Microsoft MVP - Windows Security 2007-2008  |
|
|
|
|
May 24 2007, 05:11 PM
Post
#18
|
|
|
Distinguished Member Group: Members Posts: 634 Joined: 11-February 07 Member No.: 111,188 |
Thanks. I guess that's solved, sort of... I'll post over there and see what they have to say...
-------------------- My stats: Windows XP Home SP2; Firefox 2.0.0.16; IE 6.5 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 7.5 A/V Free - AVG 7.5 Antispyware Free - AVG Anti-Rootkit Free (all soon to be replaced with AVG 8.0 Free); SuperAntispyware Free 4.15.1000; Spybot 1.4 (Immunised from a few months ago, but no longer doing updates - soon to be uninstalled); AdAware SE Free 1.06r1 (haven't downloaded definitions in awhile though)
|
|
|
|
|
May 25 2007, 11:31 AM
Post
#19
|
|
|
Distinguished Member Group: Members Posts: 634 Joined: 11-February 07 Member No.: 111,188 |
QUOTE(quietman7 @ May 24 2007, 09:49 AM)  QUOTE So should I just keep tapping F8 as soon as my computer starts to reboot Yes.This doesn't work for me, I don't think... Note that I have two logons on my computer, so it goes to the logon screen where you pick which account you want to logon. However, there is something the screen says at the botton right when the computer starts to boot up, maybe F10 or something or other? It's so fast, I can't read it... Thoughts? Thanks!
-------------------- My stats: Windows XP Home SP2; Firefox 2.0.0.16; IE 6.5 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 7.5 A/V Free - AVG 7.5 Antispyware Free - AVG Anti-Rootkit Free (all soon to be replaced with AVG 8.0 Free); SuperAntispyware Free 4.15.1000; Spybot 1.4 (Immunised from a few months ago, but no longer doing updates - soon to be uninstalled); AdAware SE Free 1.06r1 (haven't downloaded definitions in awhile though)
|
|
|
|
|
May 25 2007, 11:52 AM
Post
#20
|
|
|
Bleepin' Janitor Group: Global Moderator Posts: 12,548 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513 |
Then check the owners manual that came with your pc or with the manufacturer. F8 is the standard key in most cases but its possible the manufacturer provided different directions. Sometimes when you boot up the manufacturer will actually tell you on the screen what to press.
-------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?"
Microsoft MVP - Windows Security 2007-2008 |
|
|
|
|
May 25 2007, 03:43 PM
Post
#21
|
|
|
Distinguished Member Group: Members Posts: 634 Joined: 11-February 07 Member No.: 111,188 |
QUOTE(quietman7 @ May 25 2007, 09:52 AM) Then check the owners manual that came with your pc or with the manufacturer. F8 is the standard key in most cases but its possible the manufacturer provided different directions. Sometimes when you boot up the manufacturer will actually tell you on the screen what to press. Okay, F8 worked... wasn't pressing it soon enough... So I did an Ad-Aware and SpyBot scan in safe mode -- no issues. I did most of an AVG Free scan, but it was taking SO LONG that I had to stop it because I needed to do stuff on my computer. It was taking about four times as long as running the scan normally. Is this normal and just a result of scanning in safe mode, or is something up? Looking forward to hearing back -- thanks! -------------------- My stats: Windows XP Home SP2; Firefox 2.0.0.16; IE 6.5 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 7.5 A/V Free - AVG 7.5 Antispyware Free - AVG Anti-Rootkit Free (all soon to be replaced with AVG 8.0 Free); SuperAntispyware Free 4.15.1000; Spybot 1.4 (Immunised from a few months ago, but no longer doing updates - soon to be uninstalled); AdAware SE Free 1.06r1 (haven't downloaded definitions in awhile though)
|
|
|
|
|
May 25 2007, 04:14 PM
Post
#22
|
|
|
Bleepin' Janitor Group: Global Moderator Posts: 12,548 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513 |
How long was the scan going before you stopped it? A comprehensive scan of your system can take hours. It also depends on the size of your hard drive and number of files. I use NOD32 and it can take hours so I let it run overnight.
-------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?"
Microsoft MVP - Windows Security 2007-2008 |
|
|
|
|
May 25 2007, 04:41 PM
Post
#23
|
|
|
Distinguished Member Group: Members Posts: 634 Joined: 11-February 07 Member No.: 111,188 |
QUOTE(quietman7 @ May 25 2007, 02:14 PM) How long was the scan going before you stopped it? A comprehensive scan of your system can take hours. It also depends on the size of your hard drive and number of files. I use NOD32 and it can take hours so I let it run overnight. Scan in Safe Mode done today: 5/25/2007 12:43:25 PM (total: 1:33:41.10 hrs) Objects Scanned: 43183 Note: The cursor moves slow and stuttery while in Safe Mode So I stopped it after 1 hour and 33 minutes Scan done in normal mode yesterday: 5/24/2007 8:11:27 AM (total: 32:49.3 Min) Objects Scanned: 52970 This was a complete scan. As you can see my Safe Mode scan had taken 3x the amount of time and still had about 10,000 to go... So does this go a lot slower in Safe Mode normally? -------------------- My stats: Windows XP Home SP2; Firefox 2.0.0.16; IE 6.5 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 7.5 A/V Free - AVG 7.5 Antispyware Free - AVG Anti-Rootkit Free (all soon to be replaced with AVG 8.0 Free); SuperAntispyware Free 4.15.1000; Spybot 1.4 (Immunised from a few months ago, but no longer doing updates - soon to be uninstalled); AdAware SE Free 1.06r1 (haven't downloaded definitions in awhile though)
|
|
|
|
|
May 25 2007, 04:54 PM
Post
#24
|
|
|
Bleepin' Janitor Group: Global Moderator Posts: 12,548 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513 |
Scanning is normally faster in safe mode. As long as the scan is not freezing or hanging up on a specific file, I would not be too concerned. Just let it continue until complete the next time you start.
-------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?"
Microsoft MVP - Windows Security 2007-2008 |
|
|
|
|
May 25 2007, 05:06 PM
Post
#25
|
|
|
Distinguished Member Group: Members Posts: 634 Joined: 11-February 07 Member No.: 111,188 |
QUOTE(quietman7 @ May 25 2007, 02:54 PM) Scanning is normally faster in safe mode. As long as the scan is not freezing or hanging up on a specific file, I would not be too concerned. Just let it continue until complete the next time you start. If that's the case, then why would it be so extremely slow for me in Safe Mode? I'm running a scan in normal mode again now, just for comparisons sake... -------------------- My stats: Windows XP Home SP2; Firefox 2.0.0.16; IE 6.5 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 7.5 A/V Free - AVG 7.5 Antispyware Free - AVG Anti-Rootkit Free (all soon to be replaced with AVG 8.0 Free); SuperAntispyware Free 4.15.1000; Spybot 1.4 (Immunised from a few months ago, but no longer doing updates - soon to be uninstalled); AdAware SE Free 1.06r1 (haven't downloaded definitions in awhile though)
|
|
|
|
|
Jul 12 2007, 09:21 AM
Post
#26
|
|
|
New Member Group: Members Posts: 5 Joined: 12-July 07 Member No.: 143,173 |
QUOTE(bloomcounty @ May 17 2007, 09:06 AM) Ah... Thanks for the links and posts. I found my log, and it looks like it's been run once a month (I assume after I download the newest version with my Windows Updates). I did not find the .exe, so it looks like it does indeed run once, append to the log, and then delete itself. So is there any reason NOT to download this each month as part of my Windows Critical Updates? Has anyone ever had any issues with it? I'm thinking I should just continue to do so, since I guess it's "working" and it hasn't caused me any issues (yet)... Any final thoughts? Thanks! Bloomcounty... Did you ever 'straigten out' the problem with the KB890830 showing the Scan errors? I ran the KB890830 last night and even though "No Exceptions Found," I did notice a "scan error:resource process://PID 3436 (code0x0000054F1359." Many of my friends are stating the same thing - they are seeing the 'scan errors,' and wonder what is happening. Could it be that the KB890830 is picking up things that it should not be picking up? I wonder what I should do about the 'scan error' I received? I looked in my "pro express" and didn't see a 3436. I was told the '1359' referred to: ERROR_INTERNAL_ERROR 1359 An internal error occurred. Any information you can share. I am quite concerned about this because this is a fairly new laptop (WinXPsp2; AdAware; Norton Security; IE6), and wonder if this 'scan error' is really serious (as I am sure others are wondering also). Thanks, Alice |
|
|
|
|
Jul 12 2007, 09:07 PM
Post
#27
|
|
|
Distinguished Member Group: Members Posts: 634 Joined: 11-February 07 Member No.: 111,188 |
Haven't. The first errors said it was ZA related stuff, never got around to posting about it on the ZA board. I didn't check last month to see if anything popped up again. Where's the log located again? Tell me and I'll check and post what it said last month...
-------------------- My stats: Windows XP Home SP2; Firefox 2.0.0.16; IE 6.5 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 7.5 A/V Free - AVG 7.5 Antispyware Free - AVG Anti-Rootkit Free (all soon to be replaced with AVG 8.0 Free); SuperAntispyware Free 4.15.1000; Spybot 1.4 (Immunised from a few months ago, but no longer doing updates - soon to be uninstalled); AdAware SE Free 1.06r1 (haven't downloaded definitions in awhile though)
|
|
|
|
|
Jul 17 2007, 01:59 PM
Post
#28
|
|
|
Distinguished Member Group: Members Posts: 634 Joined: 11-February 07 Member No.: 111,188 |
Got the same/similar errors this month. I'm assuming it's because of ZA like before. I'm off to post over there about it...
Microsoft Windows Malicious Software Removal Tool v1.31, July 2007 Started On Tue Jul 17 11:20:28 2007 ->Scan ERROR: resource process://pid:1240 (code 0x0000054F (1359)) ->Scan ERROR: resource process://pid:2092 (code 0x0000054F (1359)) ->Scan ERROR: resource process://pid:1240 (code 0x0000054F (1359)) Results Summary: ---------------- No infection found. Return code: 0 Microsoft Windows Malicious Software Removal Tool Finished On Tue Jul 17 11:21:05 2007 -------------------- My stats: Windows XP Home SP2; Firefox 2.0.0.16; IE 6.5 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 7.5 A/V Free - AVG 7.5 Antispyware Free - AVG Anti-Rootkit Free (all soon to be replaced with AVG 8.0 Free); SuperAntispyware Free 4.15.1000; Spybot 1.4 (Immunised from a few months ago, but no longer doing updates - soon to be uninstalled); AdAware SE Free 1.06r1 (haven't downloaded definitions in awhile though)
|
|
|
|
|
Jul 17 2007, 04:35 PM
Post
#29
|
|
|
New Member Group: Members Posts: 5 Joined: 12-July 07 Member No.: 143,173 |
QUOTE(bloomcounty @ Jul 12 2007, 09:07 PM) Haven't. The first errors said it was ZA related stuff, never got around to posting about it on the ZA board. I didn't check last month to see if anything popped up again. Where's the log located again? Tell me and I'll check and post what it said last month... I am not using ZA or AVG on this laptop. I am using NIS 2005 and AdAware. Te message Igot this time was: >can error:resource process://PID 3436 (code0x0000054F 1359) I didn't see PID 3436 in Process Explorer. |
|
|
|
|
Jul 17 2007, 04:44 PM
Post
#30
|
|
|
Distinguished Member Group: Members Posts: 634 Joined: 11-February 07 Member No.: 111,188 |
Don't know... It's the same error I get, but I get three of them. I didn't check this month to see if the PID's matched ZA again though... I'd rather not download the whole tool to scan again to check though. I can verify next month if it shows as ZA for me...
Any thoughts from any experts around here on this...? -------------------- My stats: Windows XP Home SP2; Firefox 2.0.0.16; IE 6.5 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 7.5 A/V Free - AVG 7.5 Antispyware Free - AVG Anti-Rootkit Free (all soon to be replaced with AVG 8.0 Free); SuperAntispyware Free 4.15.1000; Spybot 1.4 (Immunised from a few months ago, but no longer doing updates - soon to be uninstalled); AdAware SE Free 1.06r1 (haven't downloaded definitions in awhile though)
|
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 7th September 2008 - 02:08 AM |
© 2003-2008 All Rights Reserved Bleeping Computer LLC.