-2

In the early hours of February 24th GMT, Windows' automatic updates installed an update on my Windows 7 machine that included a definition update to the Malicious Software Removal Tool.

The Malicious Software Removal Tool (or KB890830) is a Windows malware-protection offering that updates and runs once a month, and proceeds to remove any threats it finds without user confirmation.

From the update details:

Windows Malicious Software Removal Tool x64 - February 2017 (KB890830)

Download size: 7.9 MB

You may need to restart your computer for this update to take effect.

Update type: Important

After the download, this tool runs one time to check your computer for infection by specific, prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps remove any infection that is found. If an infection is found, the tool will display a status report the next time that you start your computer. A new version of the tool will be offered every month. If you want to manually run the tool on your computer, you can download a copy from the Microsoft Download Center, or you can run an online version from microsoft.com. This tool is not a replacement for an antivirus product. To help protect your computer, you should use an antivirus product.

As it happens, the February update to MSRT's definitions list flagged tools that I had run for years with no problems - namely, the KMSPico activator for Microsoft Office - as being malicious, and removed them from my system without confirmation. In addition to this invasive approach to perceived threats, the tool doesn't appear in Windows Update's Installed Updates dialogue, effectively denying users the right to pass on what is both an invasive and inadequate tool, and it also reverted my UAC settings to the highest level.

What follows is a short guide to undo any adverse effects of the forced update, as well as to disable MSRT entirely, giving you the option of relying on time-tested, dedicated anti-malware and anti-virus offerings. I'm hoping this will hopefully be useful to anyone else adversely affected by the latest update to MSRT's definitions list.

  • 4
    So, wait. It removes piracy tools, that potentially might be malicious, so rather than checking if the tool is bad, you're removing something that's specifically designed to check for the latest and greatest flavours of malware? Especially where use of such tools might have you a greater risk of malware in the first place? – Journeyman Geek Feb 25 '17 at 2:37
  • We are always glad to help, but you already knew that: you have been on Super User for over 2½ years, and Stack Overflow for more than five years. As a result, I'm sure you realize that is isn't really appropriate to suggest that other users disable their security software scans simply because this one deleted one of your tools that most people utilize for Microsoft licensing piracy. – Run5k Feb 25 '17 at 4:02
  • @JourneymanGeek KMSPico and Microsoft Toolkit may be piracy software, but they are only malicious to Microsoft's business model, not to its users. There are impersonations of the that tool on many websites that are trojans, but the original KMSPico is certainly not a malicious tool. – David Refoua Jun 16 '18 at 15:03
  • @Run5k As a user of this site, I might accept your argument regarding not removing MRT because it removes a privacy tool. But as OP has stated above, this update also reverted UAC and enabled it. I find it rude at best that Microsoft tries to enable something on my PC that I have disabled. – David Refoua Jun 16 '18 at 15:06
  • Well, the fact that its a piracy tool is vaguely relevant, but I'd note, the question is still here - there's no closevotes, no deletion, and an upvoted answer. Whether you want to remove it is up to you, and we accept it may be useful in some cases, but if you want to remove tools meant to improve security, folk are going to wonder why. UAC is hardly as annoying as it was in the early days too, and its meant to protect systems – Journeyman Geek Jun 18 '18 at 8:02
3

Rolling back and removing the Windows Malicious Software Removal Tool update

To begin with, open System Restore, and check whether a restore point was created before the Malicious Software Removal Tool was installed. Restore points are usually created by Windows automatically just before updates are installed, although it's possible it may not have done so.

If you do have the restore point

  1. Restore to it, and wait for Windows to restart.

  2. Open Windows Update, and click on Change Settings in the sidebar. In the dropdown that appears, select the option to "Check for updates but let me choose whether to install them". Click OK to return to Windows Update.

  3. WU should have detected that at least 1 "important update is available". This is the MSRT update that you just rolled back. Click on this, and in the screen that follows, uncheck it and any other updates labeled KB890830 that you notice. Then, right click on each update you just unchecked, and click Hide Update.

The final step should be enough to ensure that Windows doesn't attempt to force that MSRT update down your throat again. Note that you may need to do this for any future steps, which is also why I recommend you disable automatic updates as in Step 2, and carefully ensure you avoid installing any updates labelled KB890830.

You can also optionally follow the steps below to ensure MSRT is well and truly dead, but I haven't personally needed to as of yet because the restore point undid most of the damage. If, in the future, MSRT should ever rear its head again, feel free to put the final nail in its coffin by continuing on from this point.

If you don't have the restore point, or restoring to it was unsuccessful

  1. Open the Task Scheduler. In the left pane, click on Task Scheduler Library, then drill down in the directory tree to Microsoft\Windows\Removal Tools.

The Task Scheduler window showing the MTR_HB task responsible for MSRT

If MSRT is set up to run on your machine, the centre pane should show a task called MTR_HB within the Removal Tools folder, as illustrated above. As far as I've been able to tell, this is the scheduled task that initialises MSRT to be run right after it's updated. Left-click on the task, and click Disable to prevent it from running in the future.

  1. Create a text file using Notepad, and paste the following into it.

    Windows Registry Editor Version 5.00
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
    "DontOfferThroughWUAU"=dword:00000001
    
  2. Save the file with a .reg extension, then double-click on it to apply it to your system, confirming any dialogues that appear.

Congratulations. You should now be totally MSRT-free.


Keeping the Malicious Software Removal Tool while disabling its telemetry services

On some versions of Windows, namely 10, MSRT also sends telemetry data back to Microsoft via something called Heartbeart Telemetry. If you're happy with relying on MSRT's anti-virus efforts but want to prevent it from phoning home, here's how.

  1. Create a text file using Notepad, and paste the following into it.

    Windows Registry Editor Version 5.00
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
    "DontReportInfectionInformation"=dword:1
    
  2. Save the file with a ".reg" extension, then double-click on it to apply it to your system, confirming any dialogues that appear.

  3. Open the Task Scheduler. In the left pane, click on Task Scheduler Library, then drill down in the directory tree to Microsoft\Windows\Removal Tools.

The Task Scheduler window showing the MTR_HB task responsible for MSRT

  1. The centre pane will show a task called MTR_HB within the Removal Tools folder, as illustrated above. Double-click on the task.

  2. In the window that appears, navigate to the Actions tab, and double-click on the action ending in /EHB /Q. /EHB and /Q are command-line switches that serve to customise how the Task Scheduler runs a program. In this case, the /EHB switch is what tells it to run the the Malicious Software Removal Tool with Heartbeat Telemetry enabled.

  3. In the Add arguments (optional) field, remove the /EHB switch from the field entirely, taking care to leave a space between the MSRT program path and the /Q switch. Click OK, then OK again on the previous window, before exiting Task Scheduler. You should now have a version of MSRT running that's dead inside - that is, no Heartbeat. :-)

N.B. Note that due to the aggressive nature of Windows' telemetry services - read: how badly Microsoft wants you to report data back to them - this may only be a temporary solution that is done away with in future Windows updates. The only guaranteed method to ensure MSRT won't ever be sending telemetry data back to Microsoft is to use the steps in the first part of this guide to prevent updates from it entirely.

  • 1
    useful info in this answer despite the downvoted question. – Grant Bowman Jan 17 '18 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.