Windows Malicious Software Removal Tool Won't Go Away

Hi,

I've run "Windows Malicious Software Removal Tool - July 2005
(KB890830)" from windows update, rebooted numerous times, but the update
won't disappear from windows update. I'm using Windows XP SP2. I also
have a version of Windows XP SP2 running in vmware, and this copy is
fine. I've tried running regmon/filemon to figure out what windows
update checks to see if the tool has been run but I've had no luck.

If someone from MS could give me the specifics of how exactly windows
update decides if I've done the scan that would be awesome.

Thanks!

Hi, David;

First, check the .:\WINDOWS\Debug\mrt.log for entries related to the
July update. That is an indicator that the July scan has been
completed.

Next, check the Registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools \MRT and in the right
pane verify that EULA has a value of 1. Next, check the Version entry
there. For the July update you should have:
2EEAB848-93EB-46AE-A3BF-9F1A55F54833

If that Version key still shows "63C08887-00BE-4C9B-9EFC-4B9407EF0C4C"
then you have the June 05 version installed, meaning that for some
reason the July update isn't getting registered properly. You may want
to go to http://www.microsoft.com/security/ma...e/default.mspx
and either run the tool manually from there, or download it and run it
offline so you can watch the process. You can set the EULA key listed
above to "0" (zero) to force user interaction during the manual install.

HTH

--

....Sky

Tom "Sky" King
=============


David (Andareed) wrote:
> Hi,
>
> I've run "Windows Malicious Software Removal Tool - July 2005
> (KB890830)" from windows update, rebooted numerous times, but the
> update won't disappear from windows update. I'm using Windows XP SP2.
> I also have a version of Windows XP SP2 running in vmware, and this
> copy is fine. I've tried running regmon/filemon to figure out what
> windows update checks to see if the tool has been run but I've had no
> luck.

I have the correct EULA value 1 and also the correct July Ver of
2EEAB848-93EB-46AE-A3BF-9F1A55F54833 AND MY COMPUTER STILL SAYS THAT i NEED
THE UPDATE THE Malicious software tool. What am I doing wrong at this time?

"Sky King" wrote:

> Hi, David;
>
> First, check the .:\WINDOWS\Debug\mrt.log for entries related to the
> July update. That is an indicator that the July scan has been
> completed.
>
> Next, check the Registry key
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools \MRT and in the right
> pane verify that EULA has a value of 1. Next, check the Version entry
> there. For the July update you should have:
> 2EEAB848-93EB-46AE-A3BF-9F1A55F54833
>
> If that Version key still shows "63C08887-00BE-4C9B-9EFC-4B9407EF0C4C"
> then you have the June 05 version installed, meaning that for some
> reason the July update isn't getting registered properly. You may want
> to go to http://www.microsoft.com/security/ma...e/default.mspx
> and either run the tool manually from there, or download it and run it
> offline so you can watch the process. You can set the EULA key listed
> above to "0" (zero) to force user interaction during the manual install.
>
> HTH
>
> --
>
> ....Sky
>
> Tom "Sky" King
> =============
>
>
> David (Andareed) wrote:
> > Hi,
> >
> > I've run "Windows Malicious Software Removal Tool - July 2005
> > (KB890830)" from windows update, rebooted numerous times, but the
> > update won't disappear from windows update. I'm using Windows XP SP2.
> > I also have a version of Windows XP SP2 running in vmware, and this
> > copy is fine. I've tried running regmon/filemon to figure out what
> > windows update checks to see if the tool has been run but I've had no
> > luck.
>
>

At least I'm not alone.

I've run the tool many times from MU and manually. I've removed that reg
key, rerun, and it still pops up. I've verified that Version =
2EEAB848-93EB-46AE-A3BF-9F1A55F54833 and EULA = 1.

I also have a copy of XP SP2 running in vmware and this copy runs fine.
I've compared settings (via filemon/regmnon) and can't figure out what
is different.

The log just tells me that no infections were found.

I've tried cleaning the SoftwareDistribution folder and reinstalled MU
(and tried using WU).

Thanks.


Sky King wrote:
> Hi, David;
>
> First, check the .:\WINDOWS\Debug\mrt.log for entries related to the
> July update. That is an indicator that the July scan has been completed.
>
> Next, check the Registry key
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools \MRT and in the right
> pane verify that EULA has a value of 1. Next, check the Version entry
> there. For the July update you should have:
> 2EEAB848-93EB-46AE-A3BF-9F1A55F54833
>
> If that Version key still shows "63C08887-00BE-4C9B-9EFC-4B9407EF0C4C"
> then you have the June 05 version installed, meaning that for some
> reason the July update isn't getting registered properly. You may want
> to go to http://www.microsoft.com/security/ma...e/default.mspx
> and either run the tool manually from there, or download it and run it
> offline so you can watch the process. You can set the EULA key listed
> above to "0" (zero) to force user interaction during the manual install.
>
> HTH
>

John Chappelle wrote:
> I have the correct EULA value 1 and also the correct July Ver of
> 2EEAB848-93EB-46AE-A3BF-9F1A55F54833 AND MY COMPUTER STILL SAYS THAT
> i NEED THE UPDATE THE Malicious software tool. What am I doing wrong
> at this time?

Not sure. To save time I recommend you download the latest update and
install it offline.

--

....Sky

Tom "Sky" King
=============

Finally.
Now i see taht im not the only one with that problem. Ive been having the
same problem since the June 2005 malicious tool update, which did the exact
same thing than the July 2005 update. It kept popping up, and popping up, and
i even tried ionstalling it like 40 times in a row but it still didnt work. I
fixed it by ignoring it but for some reason i have a feeling that i shouldnt
do that.

"David (Andareed)" wrote:

> Hi,
>
> I've run "Windows Malicious Software Removal Tool - July 2005
> (KB890830)" from windows update, rebooted numerous times, but the update
> won't disappear from windows update. I'm using Windows XP SP2. I also
> have a version of Windows XP SP2 running in vmware, and this copy is
> fine. I've tried running regmon/filemon to figure out what windows
> update checks to see if the tool has been run but I've had no luck.
>
> If someone from MS could give me the specifics of how exactly windows
> update decides if I've done the scan that would be awesome.
>
> Thanks!
>

I found a workaround for this problem.

Add the key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MR T" to the
registry and create a DWORD value under this key called
DontOfferThroughWUAU. Set this value to 1.


Sky King wrote:
> John Chappelle wrote:
>
>> I have the correct EULA value 1 and also the correct July Ver of
>> 2EEAB848-93EB-46AE-A3BF-9F1A55F54833 AND MY COMPUTER STILL SAYS THAT
>> i NEED THE UPDATE THE Malicious software tool. What am I doing wrong
>> at this time?
>
>
> Not sure. To save time I recommend you download the latest update and
> install it offline.
>

Don't bother. The Malicious Software Removal Tool is updated every month to
include the latest threats so you *should* install it every month. It just
runs and goes away, if it doesn't find anything.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE) & Security

David (Andareed) wrote:
> I found a workaround for this problem.
>
> Add the key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MR T" to the
> registry and create a DWORD value under this key called
> DontOfferThroughWUAU. Set this value to 1.
>
>
> Sky King wrote:
> > John Chappelle wrote:
> >
> > > I have the correct EULA value 1 and also the correct July Ver of
> > > 2EEAB848-93EB-46AE-A3BF-9F1A55F54833 AND MY COMPUTER STILL SAYS THAT
> > > i NEED THE UPDATE THE Malicious software tool. What am I doing wrong
> > > at this time?
> >
> >
> > Not sure. To save time I recommend you download the latest update and
> > install it offline.