KB890830 Windows Malicious Software Removal Tool 5.48 - May 2017

I also got both an MSRT update a bit ago for all 3 editions.

Just was adding to what I said a bit earlier.

I just finished an ~11-hour full scan on ~11.5M files (I just let it run in the background for the day), and I used the option that enabled the desktop readout of the interface, and as it was running it stated I had "14 infected files" by the end of the scan--but when it concluded the scan it said that I had 0 threats... Interesting behavior--anyone else seen it? I'm thinking false positives that a newer database reconciles--or maybe the MRT was "just kidding" me... j/k

Or, does the program "fix" the "infected files" as it finds them? That would fit the end report.

My system received the second MSRT update on 05/22/17 without notification. I was puzzled as to why and it just dawned on me that on that date I'd left the system on all night to run several malware removal programs. Normally, the system is powered off during the non-active hours and the update must have happened then. No harm, no foul.

waltc said:

I just finished an ~11-hour full scan on ~11.5M files (I just let it run in the background for the day), and I used the option that enabled the desktop readout of the interface, and as it was running it stated I had "14 infected files" by the end of the scan--but when it concluded the scan it said that I had 0 threats... Interesting behavior--anyone else seen it? I'm thinking false positives that a newer database reconciles--or maybe the MRT was "just kidding" me... j/k

Or, does the program "fix" the "infected files" as it finds them? That would fit the end report.

Yes, I have seen similar behaviour. I had to manually download the May update of this KB890830 MSRT. The Update Catalogue does NOT seem to work, I had to use another link from the KB article. Anyway, as I had no confidence that it had actually run, as part of the install (as it usually does from WU), I ran it manually, using the "mrt /F /N" switches. After 10 hours or so, it found 556 infected files, but was still running against my external J backups drive. I left it for a few more hours, and when I cam back to it, the MSRT GUI had dissapeared (I assume it had crashed, too many files perhaps)?

Anyway, I decided to do a quick scan, using "mrt /N" (To NOT fix anything, as I did not trust its inconsistent behaviour, and did NOT want a false positive to remove any important system files). The first run showed "4 infected files" then at the end listed "NOT INFECTED" for all the tested malwares. Out of curiosity, I ran the same thing again, and this time it said "7 files infected". Again, I got a nice green shield and tick at the end, showing "NOT INFECTED". I have to say, I do not trust this inconsistency. There is NO proper log file for this activity (only the delta and program update log in the windows debug folder).