Newsletter Archives

• Which patches to patch?

  Posted on August 19, 2016 at 04:58 CDT by woody • Comment in the Forums

  Good question from GT:

  You’ve written that even when on Defcon-2, we should still download the malicious software removal tool; however, it won’t download to my Win7 system..

  Also, I’ve previously downloaded the 52MB security update to IE 11 but I nevertheless see it again, checked.

  I’m ready to abandon IE in favor of Firefox; but Norton Identity Safe doesn’t work with FF despite showing it as an enabled add-on. I’m reluctant to use Chrome for privacy reasons.

  Please advise if ever you have a spare moment.

  Yep, we’re at MS-DEFCON 2, which means I don’t think there’s any reason to install the current round of patches.

  The neat thing about the MSRT and Windows Defender updates is that you don’t need to run them. Don’t even need to think about them. They take care of themselves.

  Not sure why IE 11 is showing you the update again, but it probably didn’t get installed the last time. Stop using IE, and don’t worry about it. You need to update it sooner or later, but there’s no sense even thinking about it right now.

  Move to Firefox. Dump Norton. I understand why you don’t want to use Chrome – it’s a valid concern. Firefox is great. If Norton doesn’t work with Firefox, give Norton the heave-ho. It’s an expensive, problem-prone package that has very few benefits. You may have problems uninstalling it. If you do, drop back here.

  I recommend the free (absolutely free) Microsoft Security Essentials, and I’ve recommended it for many years. Antivirus has become less and less relevant. MSE might not be the highest scoring package, but it works fine for just about everybody. If you’re carrying nuclear detonation codes, it’s another story, but for most people, MSE does the job, does it well, and doesn’t beg you for money.

  Windows Patches/Security Malicious Software Removal Tool

• Does the Malicious Software Removal Tool install itself automatically?

  Posted on April 19, 2016 at 15:46 CDT by woody • Comment in the Forums

  It looks like I’m wrong – and I’d appreciate your comments and observations. This from CH:

  I see that you post a lot of replies saying that MSRT installs automatically regardless of the settings and the same about the Defender/MSE definitions.

  While this may be the case about the definitions in most instances, although I am not so convinced that they still install with the service disabled and we agree that this is not the best practice, in the case of MSRT I think that this one comes as a regular update, even if it is just a scanner.

  I still have to test if it installs automatically which I think it doesn’t (on Windows 7), but certainly comes as a separate patch which needs to be checked in the client before installing.

  This discussion is in the context of any setting other than Automatically install updates obviously.

  Although what I mentioned is primarily about Windows 7, I think the same applies to Windows 10 if the Group Policy is set to something else than the default Automatic.

  Setting the Wireless connection to metered may behave differently though and maybe this is what makes you think that MSRT installs automatically.

  Windows Patches/Security Malicious Software Removal Tool, Windows Defender

• Running the Malicious Software Removal Tool while keeping it from phoning home

  Posted on April 3, 2009 at 06:10 CDT by woody • Comment in the Forums

  With the Conficker scare finally behind us (see! I toldja so!), I got an interesing message from an old friend who ran Microsoft’s Malicious Software Removal Tool, but figured out how to keep the MSRT from phoning home during the run.

  Here’s what he says:

  The Malicious Software Removal Tool EULA tries to get you to give permission for MSRT to “phone home”, in order to give MS a feel for how many infections, and on which versions of Windows, are out there in the wild. Sadly, MS has SUCH a bad track record about saying one thing and doing quite another– reporting home with ALL software names (not just the apps being updates nor just MS’s apps– ALL software and version #s on your PC get reported) and version numbers during a software patch, for example– that MS can’t be trusted to be telling the truth in their EULA.

  The EULA also warns that the MSRT won’t work after 60 days, and that sharing/redistributing/copying the file is prohibited.

  Interestingly, deeply buried in one of the support the website, there’s a way for PC nerds to block MSRT’s phone-home. It involves entering two new keys in the Windows registry: definitely not something for a n00b to do. Strangely, MSRT has a lot of command-line switches like “find but don’t fix malware”, but MS didn’t bother to make “don’t phone home” one of those command-line switches.

  Anway, I didn’t connect my Wi-Fi, thus eliminating the possibility that MSRT could phone home. I then ran MSRT twice, first using “rapid scan” and then “complete scan”. It took 5 minutes to do a simple scan, and found nothing. It took 8 hours to do a complete scan of 1 terabyte of data in 14 partitions, during which it discovered and “partly uninstalled” three viruses. During the procedure, Avira’s resident shield twice popped up to deal with those viruses. One “virus”, by the way, was a fragment of the driveby malware that sat on AskWoody.com early last year, and which I’d stored in email and in a text file. Avira routinely finds the fragment in the text file, but had never before spotted the code in my email.

  Clearly, MSRT found and somehow “revealed” these viruses in such a way that Avira could find and delete’em.

  MSRT appeared to complete normally, and –again– was fully prevented from phoning home by the simple expediency of shutting off the WiFi during that Windows session.

  MSRT created several randomly named, easily deleted folders with hidden files, branching off the root directories, on at least two of my partitions.

  Just one note from me: Microsoft is allowing Web sites to distribute the MSRT. If you look at Knowledge Base article 890830, MS says, “Per the terms of this tool’s license terms, the tool can be redistributed. However, make sure that you are redistributing the latest version of the tool.”

  Windows Patches/Security block, distribution, KB 890830, Malicious Software Removal Tool, MSRT, phone home

• Malicious Software Removal Tool is always OK

  Posted on March 14, 2009 at 09:19 CDT by woody • Comment in the Forums

  Reader DS wrote to ask if it’s OK to install Microsoft’s latest Windows Malicious Software Removal Tool.

  Far as I’m concerned, Microsoft has never messed up an MSRT. You should install it as soon as one is offered.

  Same goes for Windows Defender updates, and for updates to the Outlook Junk Mail Filter. All three are OK, all the time.

  Windows Patches/Security Malicious Software Removal Tool, Outlook Junk Mail Filter, Windows Defender