malicious software update

[Ed Mc]

I'm using WindowsXP. The auto update feature
wants to install some kinda "malicious software"
removal tool. What is this for if I have adequate
protection already in place. Is it really
necessary? Thanks for replies.

[David H. Lipman]

From: "Ed Mc" <namvtn@noway.com>

| I'm using WindowsXP. The auto update feature
| wants to install some kinda "malicious software"
| removal tool. What is this for if I have adequate
| protection already in place. Is it really
| necessary? Thanks for replies.

The Malicious Software Removal Tool (MRT) is an "On Demand" ant virus scanner (covers some
Trojans and RootKits as well) and is updated monthly. It also can be executed manually
after you download it.

The utility is...
%windir%\system32\MRT.exe

Command line switches...

/? or /HELP = displays the command line switches
/Q = quiet
/N = detect only
/F = force extended scan
/F:Y = force extended scan and automatically clean infected files

The following is the resultant log file...

%windir%\Debug\mrt.log

As an "On Demand" scanner it affords no defense against getting infected but acts to allow
their subsequent removal/detection. While it is not the sharpest tool in the toolbox it is
however and excellent supplement to a fully installed anti virus application. I have not
seen an False Positives associated to the MRT and I have seen no negative consequences to
its use.



--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Ron Lopshire]

David H. Lipman wrote:

> From: "Ed Mc" <namvtn@noway.com>
>
> | I'm using WindowsXP. The auto update feature
> | wants to install some kinda "malicious software"
> | removal tool. What is this for if I have adequate
> | protection already in place. Is it really
> | necessary? Thanks for replies.
>
> The Malicious Software Removal Tool (MRT) is an "On Demand" ant virus scanner (covers some
> Trojans and RootKits as well) and is updated monthly. It also can be executed manually
> after you download it.
>
> The utility is...
> %windir%\system32\MRT.exe
>
> Command line switches...
>
> /? or /HELP = displays the command line switches
> /Q = quiet
> /N = detect only
> /F = force extended scan
> /F:Y = force extended scan and automatically clean infected files
>
> The following is the resultant log file...
>
> %windir%\Debug\mrt.log
>
> As an "On Demand" scanner it affords no defense against getting infected but acts to allow
> their subsequent removal/detection. While it is not the sharpest tool in the toolbox it is
> however and excellent supplement to a fully installed anti virus application. I have not
> seen an False Positives associated to the MRT and I have seen no negative consequences to
> its use.

In addition to Dave's remarks, the MSRT runs automatically each month on
Patch Tuesday if you have your /supported/ Windows box set for Automatic
Updates (not recommended). You will get a warning only if it finds
something.

http://www.microsoft.com/security/ma...e/default.mspx

As Dave suggests, download the MSRT manually, and run a quick scan at
least once manually. It will show you what it does each month when you
let MU download and run it, and you can get a display of the current
list of its signatures (89 as of April 2007).

Ron

[Ed Mc]

Ron Lopshire wrote:
> David H. Lipman wrote:
>
>> From: "Ed Mc" <namvtn@noway.com>
>>
>> | I'm using WindowsXP. The auto update feature
>> | wants to install some kinda "malicious software"
>> | removal tool. What is this for if I have adequate
>> | protection already in place. Is it really
>> | necessary? Thanks for replies.
>>
>> The Malicious Software Removal Tool (MRT) is an "On Demand" ant virus scanner (covers some
>> Trojans and RootKits as well) and is updated monthly. It also can be executed manually
>> after you download it.
>>
>> The utility is...
>> %windir%\system32\MRT.exe
>>
>> Command line switches...
>>
>> /? or /HELP = displays the command line switches
>> /Q = quiet
>> /N = detect only
>> /F = force extended scan
>> /F:Y = force extended scan and automatically clean infected files
>>
>> The following is the resultant log file...
>>
>> %windir%\Debug\mrt.log
>>
>> As an "On Demand" scanner it affords no defense against getting infected but acts to allow
>> their subsequent removal/detection. While it is not the sharpest tool in the toolbox it is
>> however and excellent supplement to a fully installed anti virus application. I have not
>> seen an False Positives associated to the MRT and I have seen no negative consequences to
>> its use.
>
> In addition to Dave's remarks, the MSRT runs automatically each month on
> Patch Tuesday if you have your /supported/ Windows box set for Automatic
> Updates (not recommended). You will get a warning only if it finds
> something.
>
> http://www.microsoft.com/security/ma...e/default.mspx
>
> As Dave suggests, download the MSRT manually, and run a quick scan at
> least once manually. It will show you what it does each month when you
> let MU download and run it, and you can get a display of the current
> list of its signatures (89 as of April 2007).
>
> Ron
Thank you all for the replies. Based on your info
I'll go ahead with it. Thanks.

[JD]

Ed Mc wrote:
> I'm using WindowsXP. The auto update feature wants to install some
> kinda "malicious software" removal tool. What is this for if I have
> adequate protection already in place. Is it really necessary? Thanks for
> replies.

http://www.microsoft.com/security/ma...e/default.mspx

I don't run it. I'm interested what others in this newsgroup say about it.

--
JD..

[Dustin Cook]

Ed Mc <namvtn@noway.com> wrote in news:B5udnVqhWomUe9jbnZ2dnUVZ_t-
mnZ2d@comcast.com:

> I'm using WindowsXP. The auto update feature
> wants to install some kinda "malicious software"
> removal tool. What is this for if I have adequate
> protection already in place. Is it really
> necessary? Thanks for replies.


Hi Ed.

I don't personally make use of the Malicious Software removal tool, but I
haven't heard anything bad about it. It doesn't scan for very much, but
it's useful as an addition to the protective software you already use.


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[slate_leeper]

On Sat, 12 May 2007 09:06:41 -0700, Ed Mc <namvtn@noway.com> wrote:

> I'm using WindowsXP. The auto update feature
>wants to install some kinda "malicious software"
>removal tool. What is this for if I have adequate
>protection already in place. Is it really
>necessary? Thanks for replies.

I had Google do this to itself! I clicked on "page 2" for the next
list of results from a query, and got that response. Same response for
"next" or "last" or any other page. I thought it was hilarious!

-dan z-



--
Protect your civil rights!
Let the politicians know how you feel.
Join or donate to the NRA today!
http://membership.nrahq.org/default....ignid=XR014887

[AMUN]

"Ed Mc" <namvtn@noway.com> wrote in message
news:B5udnVqhWomUe9jbnZ2dnUVZ_t-mnZ2d@comcast.com...
> I'm using WindowsXP. The auto update feature wants to install some
> kinda "malicious software" removal tool. What is this for if I have
> adequate protection already in place. Is it really necessary? Thanks for
> replies.

To answer your question that app is not going to do any harm.

But like a few others here, I don't even recommend allowing windows to
auto-update.
I'm just waiting for the day I start hearing on the news that some
enterprising hacker finds a hole in that and starts auto uploading viruses
to everyone's machines

Better to just get into the habit of checking every several days, and then
doing the manual update to see what they are trying to force on you.
I'm still blocking their "critical update" that will put IE 7 on my machine.

[David H. Lipman]

From: "AMUN" <spamblocker@bell.net>


|
| To answer your question that app is not going to do any harm.
|
| But like a few others here, I don't even recommend allowing windows to
| auto-update.
| I'm just waiting for the day I start hearing on the news that some
| enterprising hacker finds a hole in that and starts auto uploading viruses
| to everyone's machines
|
| Better to just get into the habit of checking every several days, and then
| doing the manual update to see what they are trying to force on you.
| I'm still blocking their "critical update" that will put IE 7 on my machine.
|

Contrary to that assertion...

I DO recommend using Auto-Updates.
It is an important way to protect oneself against exploitations that are used in the wild.
Most notable are the WMF and ANI Exploits.

The caveat...
An update that behaves "badly". This happens from time-to-time.
However all updates can be Rolled-Back.

The fact is the average person will NOT check for old and vulnerable versions of software or
check the Windows Update Web Site on a periodic basis. The avg. person doesn't even think
about such things at all.

Check your own PC and see if you left something out that needs to be updated.
http://secunia.com/software_inspector


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[AMUN]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:Gg52i.67070$Ae.39897@trnddc07...
> From: "AMUN" <spamblocker@bell.net>
>
>
> |
> | To answer your question that app is not going to do any harm.
> |
> | But like a few others here, I don't even recommend allowing windows to
> | auto-update.
> | I'm just waiting for the day I start hearing on the news that some
> | enterprising hacker finds a hole in that and starts auto uploading
> viruses
> | to everyone's machines
> |
> | Better to just get into the habit of checking every several days, and
> then
> | doing the manual update to see what they are trying to force on you.
> | I'm still blocking their "critical update" that will put IE 7 on my
> machine.
> |
>
> Contrary to that assertion...
>
> I DO recommend using Auto-Updates.
> It is an important way to protect oneself against exploitations that are
> used in the wild.
> Most notable are the WMF and ANI Exploits.
>
> The caveat...
> An update that behaves "badly". This happens from time-to-time.
> However all updates can be Rolled-Back.
>
> The fact is the average person will NOT check for old and vulnerable
> versions of software or
> check the Windows Update Web Site on a periodic basis. The avg. person
> doesn't even think
> about such things at all.
>
> Check your own PC and see if you left something out that needs to be
> updated.
> http://secunia.com/software_inspector
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>


Agreed!
But "The Average Person" will not be here reading this thread.
Nor will they be reading any others here, as they won't even know what
"spyware" is.