Rolling back and removing the Windows Malicious Software Removal Tool update
To begin with, open System Restore, and check whether a restore point was created before the Malicious Software Removal Tool was installed. Restore points are usually created by Windows automatically just before updates are installed, although it's possible it may not have done so.
If you do have the restore point
Restore to it, and wait for Windows to restart.
Open Windows Update, and click on Change Settings in the sidebar. In the dropdown that appears, select the option to "Check for updates but let me choose whether to install them". Click OK to return to Windows Update.
WU should have detected that at least 1 "important update is available". This is the MSRT update that you just rolled back. Click on this, and in the screen that follows, uncheck it and any other updates labeled KB890830 that you notice. Then, right click on each update you just unchecked, and click Hide Update.
The final step should be enough to ensure that Windows doesn't attempt to force that MSRT update down your throat again. Note that you may need to do this for any future steps, which is also why I recommend you disable automatic updates as in Step 2, and carefully ensure you avoid installing any updates labelled KB890830.
You can also optionally follow the steps below to ensure MSRT is well and truly dead, but I haven't personally needed to as of yet because the restore point undid most of the damage. If, in the future, MSRT should ever rear its head again, feel free to put the final nail in its coffin by continuing on from this point.
If you don't have the restore point, or restoring to it was unsuccessful
- Open the Task Scheduler. In the left pane, click on Task Scheduler Library, then drill down in the directory tree to
Microsoft\Windows\Removal Tools.
If MSRT is set up to run on your machine, the centre pane should show a task called MTR_HB within the Removal Tools folder, as illustrated above. As far as I've been able to tell, this is the scheduled task that initialises MSRT to be run right after it's updated. Left-click on the task, and click Disable to prevent it from running in the future.
Create a text file using Notepad, and paste the following into it.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
"DontOfferThroughWUAU"=dword:00000001
Save the file with a .reg extension, then double-click on it to apply it to your system, confirming any dialogues that appear.
Congratulations. You should now be totally MSRT-free.
Keeping the Malicious Software Removal Tool while disabling its telemetry services
On some versions of Windows, namely 10, MSRT also sends telemetry data back to Microsoft via something called Heartbeart Telemetry. If you're happy with relying on MSRT's anti-virus efforts but want to prevent it from phoning home, here's how.
Create a text file using Notepad, and paste the following into it.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
"DontReportInfectionInformation"=dword:1
Save the file with a ".reg" extension, then double-click on it to apply it to your system, confirming any dialogues that appear.
Open the Task Scheduler. In the left pane, click on Task Scheduler Library, then drill down in the directory tree to Microsoft\Windows\Removal Tools.
The centre pane will show a task called MTR_HB within the Removal Tools folder, as illustrated above. Double-click on the task.
In the window that appears, navigate to the Actions tab, and double-click on the action ending in /EHB /Q. /EHB and /Q are command-line switches that serve to customise how the Task Scheduler runs a program. In this case, the /EHB switch is what tells it to run the the Malicious Software Removal Tool with Heartbeat Telemetry enabled.
In the Add arguments (optional) field, remove the /EHB switch from the field entirely, taking care to leave a space between the MSRT program path and the /Q switch. Click OK, then OK again on the previous window, before exiting Task Scheduler. You should now have a version of MSRT running that's dead inside - that is, no Heartbeat. :-)
N.B. Note that due to the aggressive nature of Windows' telemetry services - read: how badly Microsoft wants you to report data back to them - this may only be a temporary solution that is done away with in future Windows updates. The only guaranteed method to ensure MSRT won't ever be sending telemetry data back to Microsoft is to use the steps in the first part of this guide to prevent updates from it entirely.
