Windows MSRT for W7….how often to run it ?

Topic

New Reply

I always download the monthly Windows Malicious Software Removal Tool…and then inevitably forget to manually run it (or does it run in the background anyway ?) How important is it…and is it reliable compared with simply running Windows defender, or a typical free antivirus or Spybot or Malwarebytes ?

I’m running it today and it seems to have found a lot of detections….yet a few hours before I ran all of the above scans and they all found nothing. So are the MSRT findings likely to be just false positives ?

Reply | Quote

Replies

MSRT does a quick scan during/after installing through WU. It is a one-time event, unless you run it manually. It does not run in the background.

If you have Win10, Windows Defender runs in the background unless you have other third-party anti virus software that turns it off. It doesn’t run in the background in Win7/8.1

The free versions of Spybot and Malwarebytes are not a replacement for anti virus software. You need to run some kind of anti virus software, free of paid, that runs in the background.

Reply | Quote

If I recall, MSRT had problems this month with false positives.

1 user thanked author for this post.

walker

Reply | Quote

Windows MSRT 64 bit for W7 November, 2017, KB 890830 is unchecked this month. Is it safe to check and install?

Reply | Quote

You may find the following 3 posts helpful. The first one basically asks the same question you did. The other 2 are answers from both, PKCano, and MrBrian.

https://www.askwoody.com/forums/topic/ms-defcon-3-yep-its-time-to-get-patched/#post-148644

https://www.askwoody.com/forums/topic/ms-defcon-3-yep-its-time-to-get-patched/#post-148645

https://www.askwoody.com/forums/topic/ms-defcon-3-yep-its-time-to-get-patched/#post-148646

Reply | Quote

twbartender,

Thank you for your reply.  I wanted to search this site before posting my question, but I could not find a search box.  Is it possible to search this site?

Reply | Quote

You can use this  link to SEARCH this site

 

Reply | Quote

Thank you.

Reply | Quote

Different anonymous here.

I have long thought, without knowing for certain, that MSRT was Microsoft’s long ago solution for systems that selected to use a different Antivirus solution after disabling the included Security Essentials or Defender. By offering this scan once a month, these systems were checked using the ‘Official Book of Definitions According to Microsoft’. And that it was simply redundant for systems already protected by a version of that book. Well, that plus telemetry anyway.

With that possibly faulty assumption in mind, I am curious about more reports of MSRT for November being checked or not checked when offered. Is not checked the universal condition? Or are there users here who have chosen to disable MSE/Defender, and have MSRT offered as a CHECKED important update?

My curiosity is whether this is yet another condition verified while compiling the current offerings list.

Reply | Quote

I’ve run MSRT this month via WU with no problems at all. I d/l’ed it and ran it from Windows Update all by itself, as I’ve been doing for a few months now, ever since it had problems several months ago. At the time, the only “fix” was to download and run it by itself, so I got in the habit of doing it like that. After running it to its completion, I then reboot my machine, in case it finds anything it can’t eradicate without a reboot. Turns out it didn’t find anything this month, as I had no notices of any kind after rebooting. It didn’t seem to take any longer than normal, as it might if it were to find an abnormally large number of false positives.

This month, we’ve found MSRT unchecked by default. What we need is for someone here with connections to MS via TechNet or other means to find out exactly why it was unchecked this month. (No, this doesn’t mean that Woody should put a call in to MS to ask them). All there is currently on this site is speculation as to why, but no really concrete answers that MS has provided.

I’ve encountered in the past with Win XP that when a download from Windows Update is unchecked, it only means that they want you to download and install it by itself with NO OTHER UPDATES DOWNLOADED OR INSTALLED AT THE SAME TIME AS THE UNCHECKED ONE. Because of this experience, I downloaded and ran MSRT this month as described above in this post.

Please bear in mind, though, that there are any number of reasons that MS leaves an item unchecked in the WU downloads list, so it’s a generally good idea to not d/l and install the unchecked item until you know exactly why it’s unchecked.

Reply | Quote

It appears there has been one new detection added to MSRT this month, based on Covered Malware Families in the 890830 Support Page.

The backdoor added is updated from December 2016, and involves spear-phishing emails containing

“a malicious Microsoft Word document with an Adobe Flash exploit (a zero-day exploit at the time this threat was initially discovered)”

The updated Backdoor information is dated November 27, 2017.

Reply | Quote

Anonymous #149061 again.

Thank you Bob99 , you have reminded me of another aspect that I had failed to put into words. The fact that sometimes there is an exclusive nature to particular updates. For instance when the service stack will not appear until ALL other updates have been addressed and or disposed of in some manner.

Are there any instances where the MSRT becomes checked after installing the NOV SMQR and restarting? Or did anyone attempt both on first run, only to have a failure?

Reply | Quote

The only times I’ve seen an unchecked item become checked are when you’ve either: 1. Installed a prerequisite item that’s also in the list of updates from Windows Update, or 2. Installed everything else on the list, leaving only the item that was unchecked in the first place on the list, and rebooting after having installed everything else.

Explanation for situation #1: Say there are several updates listed by Windows Update (WU), among them 1234567 and 1234568. If 1234567 is a prerequisite for 1234568, then 1234568 will remain unchecked until 1234567 has been successfully installed and you’ve rebooted, if that’s required after installing 1234567. After successful installation of 1234567, update 1234568 should then be checked within Windows Update (WU) for installation.

I hope this helps.

Reply | Quote