Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows Malicious Software Removal Tool Sept. 2016 won't install


  • Please log in to reply
10 replies to this topic

#1 a.h.h.10

a.h.h.10

  • Members
  • 113 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:03 PM

Posted 19 September 2016 - 06:00 PM

Hi.

 

I tried to install this month's updates today and all except one was successful - the malicious removal tool (KB890830).

 

I told Windows Update to search again, and it didn't find it.

 

I went to Microsoft's website and downloaded it to the computer. I ran it, but it seems like it didn't do anything.

 

I would like to mention that earlier this month, I received a duplicate download of the August version of the malicious removal tool and didn't realize the duplicate installed until it was too late.

 

Did anyone else experience this?

 

Any help appreciated.



BC AdBot (Login to Remove)

 


#2 lmacri

lmacri

  • Members
  • 407 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Canada
  • Local time:07:03 PM

Posted 19 September 2016 - 08:56 PM

I tried to install this month's updates today and all except one was successful - the malicious removal tool (KB890830).

 

I went to Microsoft's website and downloaded it to the computer. I ran it, but it seems like it didn't do anything.

 

Hi a.h.h.10:

 

Open the scan log for the Malicious Software Removal Tool (C:\Windows\Debug\mrt.log) in with Notepad or any other text editor and see if you can find entry for the September 2016 v5.40 of the tool.  If so, are there any error codes for the scan?  A return code of "0 (0x0)" is normal and means "no infection found".  Here's what my log looks like for this month's scan:

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.40, September 2016 (build 5.40.13000.0)
Started On Wed Sep 14 11:50:41 2016

Engine: 1.1.13000.0
Signatures: 1.227.1155.0
Run Mode: Scan Run From Windows Update

Results Summary:
----------------
No infection found.
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Wed Sep 14 11:57:40 2016

Return code: 0 (0x0)
 

------------
32-bit Vista Home Premium SP2 * Firefox v48.0.2 * NIS v22.7.1.32 * MBAM Premium v2.2.1



#3 a.h.h.10

a.h.h.10
  • Topic Starter

  • Members
  • 113 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:03 PM

Posted 21 September 2016 - 04:17 PM

 

I tried to install this month's updates today and all except one was successful - the malicious removal tool (KB890830).

 

I went to Microsoft's website and downloaded it to the computer. I ran it, but it seems like it didn't do anything.

 

Hi a.h.h.10:

 

Open the scan log for the Malicious Software Removal Tool (C:\Windows\Debug\mrt.log) in with Notepad or any other text editor and see if you can find entry for the September 2016 v5.40 of the tool.  If so, are there any error codes for the scan?  A return code of "0 (0x0)" is normal and means "no infection found".  Here's what my log looks like for this month's scan:

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.40, September 2016 (build 5.40.13000.0)
Started On Wed Sep 14 11:50:41 2016

Engine: 1.1.13000.0
Signatures: 1.227.1155.0
Run Mode: Scan Run From Windows Update

Results Summary:
----------------
No infection found.
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Wed Sep 14 11:57:40 2016

Return code: 0 (0x0)
 

------------
32-bit Vista Home Premium SP2 * Firefox v48.0.2 * NIS v22.7.1.32 * MBAM Premium v2.2.1

 

 

Sorry about responding late.

 

I checked the log. It has two reports for the August version: one on August 14 and the other September 10.



#4 a.h.h.10

a.h.h.10
  • Topic Starter

  • Members
  • 113 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:03 PM

Posted 21 September 2016 - 06:38 PM

I wanted to give an update - later today I received 2 updates from Microsoft, one of the them being this month's removal tool. It said it installed successfully, however when I check mrt.log it doesn't say anything about the new malicious removal tool.



#5 lmacri

lmacri

  • Members
  • 407 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Canada
  • Local time:07:03 PM

Posted 21 September 2016 - 08:01 PM

I wanted to give an update - later today I received 2 updates from Microsoft, one of the them being this month's removal tool. It said it installed successfully, however when I check mrt.log it doesn't say anything about the new malicious removal tool.

 

Hi a.h.h.10:

 

If your MSRT scan log at C:\Windows\Debug\mrt.log shows that the scan is successfully running once a month I don't think there's any reason to be overly concerned, but what you're experiencing would certainly be annoying.  Just monitor the situation for now and see what happens after the October 2016 Patch Tuesday updates are released on 11-Oct-2016.

 

This constant re-offering of the same Malicious Software Removal Tool (MSRT) is a common problem, and I have no idea why it happens to some users.  The only solution I've heard of is to manually download and run the latest tool from the Microsoft Download Center, which you said you already tried in your original post.  See my 18-Sep-2016 post in RobertBrown_989's thread Visata checking for updates forever (under the username Great White North) for links to other threads discussing this MSRT problem.

There's definitely something odd going on with the MSRT, and I'm still trying to figure out if it has something to do with the submission of the Heartbeat Report to Microsoft at the end of each MSRT scan.  This Heartbeat Report wasn't mentioned in my MSRT scan log at C:\Windows\Debug\mrt.log until August 2016 and I still don't know what telemetry Microsoft is collecting from my system during each scan, since all the Microsoft privacy statement (revised August 2016) says is that "During a malware check, a report will be sent to Microsoft with specific data about malware detected, errors, and other data about your device."

The MSRT only scans for a small subset of malware listed at https://support.microsoft.com/en-us/kb/890830#bookmark-usage and I question whether these monthly MSRT scans even provide much added value these days.  I'm affected by the same slow Windows Updates that you posted about in KellyB56's thread Windows Vista Update Hangs at "Checking For Updates" and I now have automatic Windows Updates permanently disabled [Windows Update | Change settings | Important updates | Never check for updates (not recommended)].  I follow Dalai's workaround at http://wu.krelay.de/en/ every month to install my Patch Tuesday updates and since I only run a manual Windows Update once a month I don't have to worry about the MSRT being re-offered multiple times throughout the month.  

If I can't find out more information about these Heartbeat Reports I might just start hiding my monthly KB890830 update to prevent MSRT scans from running.  As the How-To Geek article What is the Malicious Software Removal Tool and Do I Need It? article notes, "it’s no substitute for having a patched operating system and using a solid antivirus program."

------------
32-bit Vista Home Premium SP2 * Firefox v49.0 * NIS v22.7.1.32 * MBAM Premium v2.2.1


Edited by lmacri, 21 September 2016 - 08:14 PM.


#6 a.h.h.10

a.h.h.10
  • Topic Starter

  • Members
  • 113 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:03 PM

Posted 22 September 2016 - 11:02 AM

 

Hi a.h.h.10:

 

If your MSRT scan log at C:\Windows\Debug\mrt.log shows that the scan is successfully running once a month I don't think there's any reason to be overly concerned, but what you're experiencing would certainly be annoying.  Just monitor the situation for now and see what happens after the October 2016 Patch Tuesday updates are released on 11-Oct-2016.

 

This constant re-offering of the same Malicious Software Removal Tool (MSRT) is a common problem, and I have no idea why it happens to some users.  The only solution I've heard of is to manually download and run the latest tool from the Microsoft Download Center, which you said you already tried in your original post.  See my 18-Sep-2016 post in RobertBrown_989's thread Visata checking for updates forever (under the username Great White North) for links to other threads discussing this MSRT problem.

There's definitely something odd going on with the MSRT, and I'm still trying to figure out if it has something to do with the submission of the Heartbeat Report to Microsoft at the end of each MSRT scan.  This Heartbeat Report wasn't mentioned in my MSRT scan log at C:\Windows\Debug\mrt.log until August 2016 and I still don't know what telemetry Microsoft is collecting from my system during each scan, since all the Microsoft privacy statement (revised August 2016) says is that "During a malware check, a report will be sent to Microsoft with specific data about malware detected, errors, and other data about your device."

The MSRT only scans for a small subset of malware listed at https://support.microsoft.com/en-us/kb/890830#bookmark-usage and I question whether these monthly MSRT scans even provide much added value these days.  I'm affected by the same slow Windows Updates that you posted about in KellyB56's thread Windows Vista Update Hangs at "Checking For Updates" and I now have automatic Windows Updates permanently disabled [Windows Update | Change settings | Important updates | Never check for updates (not recommended)].  I follow Dalai's workaround at http://wu.krelay.de/en/ every month to install my Patch Tuesday updates and since I only run a manual Windows Update once a month I don't have to worry about the MSRT being re-offered multiple times throughout the month.  

If I can't find out more information about these Heartbeat Reports I might just start hiding my monthly KB890830 update to prevent MSRT scans from running.  As the How-To Geek article What is the Malicious Software Removal Tool and Do I Need It? article notes, "it’s no substitute for having a patched operating system and using a solid antivirus program."

------------
32-bit Vista Home Premium SP2 * Firefox v49.0 * NIS v22.7.1.32 * MBAM Premium v2.2.1

 

 

I do think it's very strange that it told me this month's Malicious Removal Tool successfully installed, yet did not run.

 

As for the Heartbeat Report, mine also started in August and I also checked another computer with a different OS and it has the same thing too. Also, the other computer, which runs XP, has no record of even installing this month's removal tool, even though it had been doing so until last month.



#7 opera

opera

  • Members
  • 947 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:01:03 AM

Posted 22 September 2016 - 02:24 PM

If you go to this page using XP it will tell you that you can no longer run it on XP now, it is not compatible anymore.

 

https://www.microsoft.com/en-gb/download/malicious-software-removal-tool-details.aspx

 

 

Supported Operating System

Windows 10 , Windows 10 Tech Preview , Windows 7, Windows 8, Windows 8.1, Windows Server 2008, Windows Vista


Edited by opera, 22 September 2016 - 02:25 PM.


#8 lmacri

lmacri

  • Members
  • 407 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Canada
  • Local time:07:03 PM

Posted 22 September 2016 - 02:33 PM

I do think it's very strange that it told me this month's Malicious Removal Tool successfully installed, yet did not run.

 

Hi a.h.h.10:

If you'd like to take another shot at running the September 2016 v5.40 version of the tool on your Vista machine, you can try the following:

Download the tool from the Microsoft Download Center at https://www.microsoft.com/en-us/download/malicious-software-removal-tool-details.aspx and save the latest Windows-KB890830-V5.40.exe file (32-bit) or Windows-KB890830-x64-V5.40.exe (64-bit) file to your Windows desktop.  Close your browser, and then right-click the .exe file on the desktop and and choose Run as Administrator (a double-click might also work if you are logged into Windows with a user account that has Administrator rights) to launch the tool.  When you browse to the download page it should auto-detect whether you have 32-bit or 64-bit Vista but just double-check that you are downloading the correct version.

 

Attached File  MSRT Download Page Vista Sep 2016.png   22.15KB   0 downloads

There are quite a few Vista users (especially those using IE9) reporting that the Microsoft Download Center is behaving a bit wonky these days.  If you are offered an old v5.39 version of the tool or have a problem with the download, try downloading from the MajorGeeks site at http://www.majorgeeks.com/files/details/microsoft_malicious_software_removal_tool.html - just be sure to use the appropriate 32-bit or 64-bit link to match your Vista OS.  I don't normally recommend that users download Microsoft updates from third-party download sites but the links for the MSRT on MajorGeeks download directly from https://download.microsoft.com and I confirmed that the file size and SHA-256 hash of the downloaded Windows-KB890830-V5.40.exe files from the Microsoft Download Center and MajorGeeks are identical.

If you still have problems, see if you currently have the latest v5.40.13000.0 (or some other similar v5.40.xxxx.x) of the mrt.exe file at C:\Windows\System32\mrt.exe. If you already have the latest version of the MSRT in this location you can trigger a scan manually by following the instructions in the MalwareTips tutorial How To Use Windows Malicious Software Removal Tool.
 

Also, the other computer, which runs XP, has no record of even installing this month's removal tool, even though it had been doing so until last month.

 

I'm not sure if there was a recent policy change regarding Win XP SP3 and the MSRT, but I found a few posts by Win XP SP3 users in the DSL Reports forum reporting that they didn't receive their normal MSRT update for September 2016:
       [XPHome] Windows Malicious Software Removal Tool no longer works on XP
       Did MS stop updating its Windows Malicious Software Removal Tool?

Further to opera's suggestion to browse to https://www.microsoft.com/en-us/download/malicious-software-removal-tool-details.aspx using your XP machine, I noticed that the MajorGeeks download page for the MSRT also says "Requires: Win 10 / 8 / 7 / Vista".

------------
32-bit Vista Home Premium SP2 * Firefox v49.0 * NIS v22.7.1.32 * MBAM Premium v2.2.1


Edited by lmacri, 22 September 2016 - 02:37 PM.


#9 a.h.h.10

a.h.h.10
  • Topic Starter

  • Members
  • 113 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:03 PM

Posted 23 September 2016 - 09:39 AM

 

If you go to this page using XP it will tell you that you can no longer run it on XP now, it is not compatible anymore.

 

https://www.microsoft.com/en-gb/download/malicious-software-removal-tool-details.aspx

 

 

Supported Operating System

Windows 10 , Windows 10 Tech Preview , Windows 7, Windows 8, Windows 8.1, Windows Server 2008, Windows Vista

 

 

I see that. I think that's stupid. Surely they didn't make it so hi tech that it couldn't run.

 

But I'm not gonna run it. That's just what I need - something to happen to the computer.



#10 a.h.h.10

a.h.h.10
  • Topic Starter

  • Members
  • 113 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:03 PM

Posted 23 September 2016 - 09:43 AM

 

I do think it's very strange that it told me this month's Malicious Removal Tool successfully installed, yet did not run.

 

Hi a.h.h.10:

If you'd like to take another shot at running the September 2016 v5.40 version of the tool on your Vista machine, you can try the following:

Download the tool from the Microsoft Download Center at https://www.microsoft.com/en-us/download/malicious-software-removal-tool-details.aspx and save the latest Windows-KB890830-V5.40.exe file (32-bit) or Windows-KB890830-x64-V5.40.exe (64-bit) file to your Windows desktop.  Close your browser, and then right-click the .exe file on the desktop and and choose Run as Administrator (a double-click might also work if you are logged into Windows with a user account that has Administrator rights) to launch the tool.  When you browse to the download page it should auto-detect whether you have 32-bit or 64-bit Vista but just double-check that you are downloading the correct version.

 

attachicon.gifMSRT Download Page Vista Sep 2016.png

There are quite a few Vista users (especially those using IE9) reporting that the Microsoft Download Center is behaving a bit wonky these days.  If you are offered an old v5.39 version of the tool or have a problem with the download, try downloading from the MajorGeeks site at http://www.majorgeeks.com/files/details/microsoft_malicious_software_removal_tool.html - just be sure to use the appropriate 32-bit or 64-bit link to match your Vista OS.  I don't normally recommend that users download Microsoft updates from third-party download sites but the links for the MSRT on MajorGeeks download directly from https://download.microsoft.com and I confirmed that the file size and SHA-256 hash of the downloaded Windows-KB890830-V5.40.exe files from the Microsoft Download Center and MajorGeeks are identical.

If you still have problems, see if you currently have the latest v5.40.13000.0 (or some other similar v5.40.xxxx.x) of the mrt.exe file at C:\Windows\System32\mrt.exe. If you already have the latest version of the MSRT in this location you can trigger a scan manually by following the instructions in the MalwareTips tutorial How To Use Windows Malicious Software Removal Tool.
 

Also, the other computer, which runs XP, has no record of even installing this month's removal tool, even though it had been doing so until last month.

 

I'm not sure if there was a recent policy change regarding Win XP SP3 and the MSRT, but I found a few posts by Win XP SP3 users in the DSL Reports forum reporting that they didn't receive their normal MSRT update for September 2016:
       [XPHome] Windows Malicious Software Removal Tool no longer works on XP
       Did MS stop updating its Windows Malicious Software Removal Tool?

Further to opera's suggestion to browse to https://www.microsoft.com/en-us/download/malicious-software-removal-tool-details.aspx using your XP machine, I noticed that the MajorGeeks download page for the MSRT also says "Requires: Win 10 / 8 / 7 / Vista".

------------
32-bit Vista Home Premium SP2 * Firefox v49.0 * NIS v22.7.1.32 * MBAM Premium v2.2.1

 

 

What I did was check mrt.exe to see which verson I have and it said it was v5.40.13000.0, so I used command prompt and a scan successfully ran.

 

There's also a log for it now. Heartbeat was not able to report to Microsoft because I had the Internet unplugged at the time. So that's one way to stop Heartbeat from reporting if you really don't want Microsoft to know.

 

Thank you for all your help, Imacri.



#11 lmacri

lmacri

  • Members
  • 407 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Canada
  • Local time:07:03 PM

Posted 23 September 2016 - 01:26 PM

What I did was check mrt.exe to see which verson I have and it said it was v5.40.13000.0, so I used command prompt and a scan successfully ran.

 

There's also a log for it now. Heartbeat was not able to report to Microsoft because I had the Internet unplugged at the time. So that's one way to stop Heartbeat from reporting if you really don't want Microsoft to know.

 

Hi a.h.h.10:

 

Thanks for the feedback about the Heartbeat Report.  The Microsoft Support article at https://support.microsoft.com/en-us/kb/891716 notes that users can create a new registry entry under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT to "disable the infection-reporting component" of the MSRT but I don't like poking around inside my Windows registry unless it's absolutely necessary.

 

Your user profile indicates that you use McAfee and Malwarebytes for your security software.  I don't know why Microsoft has suddenly stopped supporting the MSRT for Win XP, but the free Malwarebytes Anti-Malware (MBAM) is an excellent on-demand scanner.  I don't think your Win XP security will be compromised if you can't run monthly MSRT scans as long as you have an antivirus protecting you in real-time and run the occasional MBAM scan to check for any malware that might have slipped past your AV.

 

Good luck with your October 2016 Patch Tuesday updates on 11-Oct-2016. I think I've finally got the hang of Dalai's workaround at http://wu.krelay.de/en/ but the second Tuesday of the month has become a bit of an (unwanted) adventure for Vista users. :(

------------
32-bit Vista Home Premium SP2 * Firefox v49.0 * NIS v22.7.1.32 * MBAM Premium v2.2.1


Edited by lmacri, 23 September 2016 - 01:47 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users