Microsoft Releases Malicious Software Removal Tool

DaHat writes "Hot on the heels of their release last week of Microsoft AntiSpyware, Microsoft today released their very own Malicious Software Removal Tool with the claim that it will detect and remove infections from specific pieces of malware, including those in the families of Berbew, Doomjuice, Gaobot, Msblast, Mydoom, Nachi, Sassier, and Zindos from your Windows 2000, XP or 2003 machine. Microsoft also promises to release an updated version of the tool on the second Tuesday of each month."

Comments

obPost

[ackthpt]

Microsoft Windows XP successfully uninstalled

Dag! It works!

Re:obPost

[mynickwastaken]

Common guys. This thread need to be called just:

Microsoft Releases Malicious Software

I think would be enough!

Re:obPost

[FyRE666]

Not only that but did you see this part?

will detect and remove infections from specific pieces of malware, including those in the families of Berbew, Doomjuice, Gaobot, Msblast, Mydoom, Nachi, Sassier...

It removes Sassier too! It's a lot like Sasser, but with more attitude...

Re:obPost

[Ismilar]

Actually, I first thought "Microsoft Releases Malicious Software Removal Tool" meant that Microsoft released a software removal tool that is malicious (as opposed to a tool to remove malicious software)! Of course, that wouldn't really be front page news... :)

Re:obPost

[Anonymous Coward]

In what way is "ackthpt" one of the common guys?

Re:obPost

[Anonymous Coward]

Wait. I don't get it. The software removal tool is malicious?

Uh...

Re:obPost

[tq_at_sju]

did somebody say.............Sassy........

Re:obPost

[Johan Palmqvist]

I had the same thought. :)

Re:obPost

[donbrock]

> Microsoft Windows XP successfully uninstalled
>
>Dag! It works!

Funny, but if I had posted that, someone would have modded it as troll or flamebait.

Re:obPost

[Anonymous Coward]

I read the article on Wednesday. It was listed as..

Microsoft Releases Malicious Software
Removal Tool (xxx)

No posts about "Microsoft Releases Malicious Software", but quite a few about "Removal Tool"

Re:obPost

[EvilTwinSkippy]

It would be new, because I was always under the impression that Microsoft's products aren't released.

They escape.

We've been waiting a long time for this...

[Lindsay Lohan]

Microsoft today released their very own Malicious Software Removal Tool

Finally, an IE un-installer.

Re:We've been waiting a long time for this...

[Anonymous Coward]

A Lindsay Lohan fan? Man, I can't believe I'm replying to one. Anyway, however trollish the parent is, it's worth noting just how ugly IE has gotten. While we're at it, why not uninstall the media player which phones home once in a while...yeah, both WMP and Real. How about XP Registration?

The worst thing about this MSRT, though, is my concern for older computers. If this thing is going to do a thorough job, older machines might not be able to handle a full gentoo compile to replace the OS. Maybe it'll come bundled with Ubuntu Warty.

Re:We've been waiting a long time for this...

[stonedyak]

More like:

Scan complete. The following malicious programs were detected:
- Mozilla Firefox
- Mozilla Thunderbird
- OpenOffice.org

Remove these programs? [Yes] [No]

<User clicks [No]>

Programs successfully removed. Have a nice day!

Re:We've been waiting a long time for this...

[rob_squared]

No, silly! They're obviously introducing a new version of fdisk.

Cant stand compition?

[bird603568]

Will it remove firefox also?

Re:Cant stand compition?

[ackthpt]

Will it remove firefox also?

That's sched'd for a future release, to cast aspersions on the non-standard apps you have on your system.

todo list:
remove any known worm/virus scan disk for 'BSoD' references or slashdot cookie, if found, format drive sneakily install microsoft DRM verify windows registration key and log ip address corrupt iTunes (1 chance in 10, so it's less suspicious) report all applications back to microsoft next time connecting to net under request [Get latest update?] ... Profit!!!

Re:Cant stand compition?

[Man in Spandex]

Just like Funzo ripping malibu stacy's heads off?
*one on each pencil while dancin!*

So I guess in this case we'll see Bonzi Buddy's head being ripped off by Clippy?!?

Re:Cant stand compition?

[Anonymous Coward]

Nope, I still have all my Mozillas.

Webbaesd?

[someonewhois]

Somehow a webbased scanner sounds too easy to exploit. Ie. infinite loop bye bye CPU. Oh well. They'll just have to update the tool to kill itself in certain conditions or something.

Re:Webbaesd?

[AlphaSys]

Did it ever cross your mind that that they actually might take something like that into consideration beforehand?

That's pretty good... issuing the advisory before even discovering a vulnerability, let alone an exploit. Man, are we gald you're here to speed up the process.

Where were you when the tsunami victims-to-be needed you?

Re:Webbaesd?

[someonewhois]

And then "thinking" about it means it's flawless? No. Even if they thought of it (yes, I definitely think it crossed their minds, I'm not just a Microsoft basher in general), I'm just saying that it's a pretty big issue should a vulnerability come out, and that it's a pretty different way of doing it.

Re:Webbaesd?

[Tezkah]

From the page:

Note: If you have difficulty running the tool from this page, it may be due to your browser's security settings. If you have any problems, try downloading the tool directly from the Microsoft.com Download Center and then running it manually.

Didn't even need to start up IE.

Re:Webbaesd?

[Anonymous Coward]

Ie. infinite loop bye bye CPU
LOL! i know, dont feed the trolls.. but im not sure if the parent is serious.
please educate yourself, this hoax is so 90's.

Anyone else read that as...

[tim_retout]

The operating system was bad enough, but now they've brought out a deliberately malicious uninstaller?

"Wait, it's got a knife... get back, back I tell you!"

Re:Anyone else read that as...

[lucabrasi999]

but now they've brought out a deliberately malicious uninstaller?

They wanted to call it the iUninstaller, but Apple had already copyrighted the term.

re: anyone else read that as...

[ed.han]

note, btw, that this will likely have disclaimers where you agree to waive any liability of the site's operators, third-parties, etc. so if the tool is corrupted by exploit [large number] of the month in some way, you're likely SOL if you use it.

ed

Re:Anyone else read that as...

[Chris Burke]

Yeah, it took me an extra second to parse as well. The funny part is that the editors could have gotten rid of one funny and twenty redundant posts simply by adding one word to the title and saying: "Microsoft Releases Tool to Remove Malicious Software"

No, wait, the funny part is I thought "editing", much less "clarifying confusing sentence structure", was something the editors here did.

Re:Anyone else read that as...

[OldManAndTheC]

They wanted to call it the iUninstaller

Say, that sounds like a good name for a euthanasia device...

Are you SURE you want to uninstall all life functions?
Memory will be permanently lost. Undo is not available for this operation.

Press OK to continue (that is, things are NOT OK)
Press Cancel to stop (that is, do NOT cancel life)

Re:Anyone else read that as...

[Anonymous Coward]

You missed it, didn't you? :-) If they had made the meaning very clear, they would not have gotten so many hits and posts. You gotta "follow the money" to see what makes these guys tick... more hits = more bucks.

I just installed it, and will be rebooting

[drinkypoo]

...bbias :P

Re:I just installed it, and will be rebooting

[Anonymous Coward]

Oh no you won't.

Re:I just installed it, and will be rebooting

[drinkypoo]

I have rebooted. My initial impression is that there is no immediately obvious way to run the removal program. KB890830 points out the web version of the Malicious Software Removal Tool and says that "When you download the tool from Windows Update or from Automatic Updates, the tool always runs in quiet mode." The KB also has a url to download the tool. Whee.

Re:I just installed it, and will be rebooting

[Nefarious Wheel]

Does it remove LOP? Please tell me it removes Lop...

Re:I just installed it, and will be rebooting

[Anonymous Coward]

Im in the same boat as you. Furthermore, Im used to working with MS products, and I still cant figure out how the tool is supposed to be used. Sure, the KB article mentions the command line switches, but whats the damn executable? KB890830 doesnt even mention it, or how to access it.

Re:I just installed it, and will be rebooting

[the angry liberal]

I have rebooted. My initial impression is that there is no immediately obvious way to run the removal program. KB890830 points out the web version of the Malicious Software Removal Tool and says that "When you download the tool from Windows Update or from Automatic Updates, the tool always runs in quiet mode." The KB also has a url to download the tool. Whee.

So one person out of maybe 10k slashdotters runs out to DL this, can't figure out how to use it, then gets modded as "Informative". This should be +5 Funny, if anything.

Click the green Go button, silly.

Re:I just installed it, and will be rebooting

[Anonymous Coward]

"When you download the tool from Windows Update or from Automatic Updates, the tool always runs in quiet mode."
Hmm... sounds alot like the software it's supposed to get rid of..

Re:I just installed it, and will be rebooting

[Tony Hoyle]

There is no go button.

There is no *anything* In fact I'm beginning to have doubts this tool actually exists. You'd think they'd put an icon in program files or something.

It's not in add/remove programs either so once it's in your system (presumably) running in the background you're stuck with it. For this reason I recommend *not* downloading this app as I don't trust MS to not remove firefox or something.

Re:I just installed it, and will be rebooting

[Anonymous Coward]

He's not alone. There really doesn't seem to be any way to run it except to start IE and go to the URL linked in the story.

Re:I just installed it, and will be rebooting

[Cray]

It looks like it creates a program called mrt.exe ( This is according to the Microsoft KB Article Deployment of the Microsoft Windows Malicious Software Removal Tool in an enterprise environment ). I've looked at the C:\Windows\Debug\mrt.log file which indicates that it ran, and have searched my drive for the mrt.exe file to no avail. It must run, look for spyware on your machine, and then remove itself.

You can extract the mrt.exe file from the release by running :

Windows-KB890830-ENU.exe /x

And you can get the release from the link in the story.

Then you've got access to it and its command line parameters.

Re:I just installed it, and will be rebooting

[drinkypoo]

From its behavior it seems that it's a "run once" kind of thing, maybe it will run silently every time you run windows update from now on. Brilliant, if so. The downloadable version prints a status dialog when it runs unless you suppress it with /q

Re:I just installed it, and will be rebooting

[Tony Hoyle]

good call.. I found the mrt.log

no mrt.exe anywhere.

An anti-spyware that deletes itself? Wierd...

Re:I just installed it, and will be rebooting

[Anonymous Coward]

"Note that the tool is not actually installed on a computer. Therefore, no entry is created for it in the Programs folder or in Add/Remove Programs."

Re:I just installed it, and will be rebooting

[dronkert]

It must run, look for spyware on your machine, and then remove itself.

Brilliant.

Confused.

[Blapto]

A software removal tool that's malicious? From Microsoft?

Re:Confused.

[Anonymous Coward]

The tool is malicious? OR it only retains the beneficial spyware? I'm truly confused.

Re:Confused.

[tomhudson]

detect and remove infections from specific pieces of malware

This way your malware can work better, since its not cross-infected by other malware. I guess.

Comment removed

[account_deleted]

Comment removed based on user account deletion

So this tool....

[badboy_tw2002]

Gets rid of all the software you _did_ want? It is after all malicious! ...

I tried....

Coolwebsearch

[Anonymous Coward]

Yeah,

But will it get this one (which is a misnomer per my understanding).

I read this as

[WormholeFiend]

"Microsoft releases malicious software", and I was like so what, tell me something I don't know...

I know the vendors will moan

[Timesprout]

and some already are but lets face it, to currently reach the masses this sort of stuff needs to be pushed out through windows update.

Re:I know the vendors will moan

[Handbrewer]

We got to admit that for oil to reach the masses we have to push it through Standard Oil.

Your analogy is flawed. A convicted monopoly cannot be excused for such behavior. The best thing they could do was to fix their flawed software and thus choke that market by actually *gasp* improving their software security.

Re:I know the vendors will moan

[bonch]

Exactly. People have been wanting something like this for a long time, and now that it's out, expect some Slashdotters and the like to bitch that it exists. It seems no matter what Microsoft does, they're "shoving down our throats" or "adding cruft." There would be complaints if Microsoft did nothing.

Re:I know the vendors will moan

[Wordsmith]

I have nothing against MS giving this stuff away, or even selling it if someone will pay. If another tool does a better job, use the other tool.

Monopolies are usually a problem because they hold all the cards, all the resources. It's impossible to compete. But there's nothing about MS's monopoly that prevents Adaware from existing. MS Antispiware, and now this tool, are both out. So if Adaware wants to continue existing, it had better to a better job or offer a better deal. If it doesn't, than what's the harm (to users) in it dieing out?

And to some extent, I'd say MS is OBLIGATED to help us fight malware, although I'd rather they fixed the fundamental design problems that make it so easy to wind up on your system. But that takes quite a bit of work, and even if they're working on it, it'll be a slow process. If my roof on my new house was leaking, and the contractor told me he didn't know any way to fix it that would take less than a year, I'd make damn sure he gave me free buckets to last me for a year's worth of rainstorms.

Re:I know the vendors will moan

[Anonymous Coward]

1. Standard oil wasn't a govt. based monopoly. Anyone who wanted could try to compete. They all simply failed.

2. Many adware and spyware programs are trojans. MS should provide tools to remove these if they think it's in their best interest.

Re:I know the vendors will moan

[adeydas]

If they do that, they won't be able to cash in on these new softwares. Just wait till it gets out of Beta and you will see what MS marketing is.

Re:I know the vendors will moan

[superyooser]

MS has the same view.

Microsoft will release an updated version of this tool on the second Tuesday of each month. New versions will be made available through this Web page, Windows Update, and the Microsoft Download Center.

Windows XP users may get the latest version through Windows Update. To have the newest versions automatically delivered and installed as soon as they are released, set the Automatic Updates feature to Automatic.

Re:I know the vendors will moan

[Anonymous Coward]

MS is shoving this down our throats. Most XP users will not even know that Automatic Updates has downloaded a program. The useage of the word "tool" is interesting. Why not call it the "Malicious Software Removal Program"? Because, people are scared shitless about downloading programs to their computer - but a tool, well that is okay.

Clicking on the link brings up a brief description. It does not mention that it is a program, nor how to activate it or deactivate it. There is no direct way to not install this tool if one uses Express Install via the Windows Update website besides clicking on Home in the Windows Update website or the Windows Update menu item in IE, and selecting Custom Install.

MS isn't going to do so well at this...

[mobiux]

If they are going to stick to the once a month update schedule.

People expect thier anti-virus and anti-spyware software to be updated at least weekly, if not daily if there is an outbreak.

God forbid people start relying on only them for security and system utilities.

Re:MS isn't going to do so well at this...

[DaHat]

The reason that they are only going to be doing it once a month has little to do with home users and more to do with corporate ones. Most IT people I know do not have time to search out threats to their network each day and make sure everything is up to date and properly patched... instead, they do so on a schedule. In order to facilitate that, Microsoft has done the same thing. Notice that new security bulletins came out today? Mark your calendar for a month from now and you'll see a similar thing.

Yes, such a system is potentially flawed where if a major exploit is found in the wild and is running loose, taking out systems right and left, the day after Microsoft issues their advisories/patches, things could be bad. However in such a case I have little doubt they would make a special exception for those big ones.

Re:MS isn't going to do so well at this...

[telstar]

"If they are going to stick to the once a month update schedule."

• Silly consumer ... That's what the PAID version will be....

Re:MS isn't going to do so well at this...

[EvilAlien]

This isn't an AV app, its a REMOVAL TOOL. They've been very clear about its purpose, and that users should continue to use an up-to-date AV product:

This tool will help to remove specific, prevalent malicious software from infected systems. Because computers can appear to function normally when infected, Microsoft advises you to run this tool even if your computer seems to be fine. In addition to using this tool, you should use an up-to-date antivirus product to help protect your computer from other malicious software. For more information, see Protect Your PC.
(ganked from Microsoft® Windows® Malicious Software Removal Tool (KB890830))

Their AntiSpyware Beta app updates daily by default. This malware remover is the more grown up very of the cleaners they deployed via autoupdate last year.

Re:MS isn't going to do so well at this...

[mog007]

Just about all software that caters to a business has an auto-run and auto-update feature, just to ease the pains of the local IT guys.

Even the built in copy of defrag on Windows 98 has an option to be added to the task manager.

Re:MS isn't going to do so well at this...

[DaHat]

A responsible IT person is not going to just push out every single patch that Microsoft releases to their users. If that were the case, everyone would be running SP2 now, instead of lots of companies still evaluating it for their uses.

Auto-update only works when you are too stupid to turn it off, or have a great deal of trust for the maker of it.

Re:MS isn't going to do so well at this...

[dmaxwell]

This thing sounds more like Stinger than a general antivirus tool. Stinger is a free download from McAfee that will remove 50+ known infections from a machine. Stinger is not a resident scanner or email watchguard. It just removes the infections in it's rather small database. This works fairly well since certain things make the rounds over and over again.

Re:MS isn't going to do so well at this...

[the angry liberal]

Just about all software that caters to a business has an auto-run and auto-update feature, just to ease the pains of the local IT guys.

Even the built in copy of defrag on Windows 98 has an option to be added to the task manager.

See: cron / task manager

I hate to disagree, but hardly any of the business tools I've used on the Win32 or Linux/BSD side have any automation built into them. Typically, I'd use the cron or task scheduler to launch apps with the needed CMD line to produce the results I need. Just because there isn't a 1-click button to do everything for you, doesn't really mean the program is bad or missing a feature.

Re:MS isn't going to do so well at this...

[shokk]

That's cute, but I would fire your ass for pushing some half baked crap like that. Most tools these days have a "Corporate Edition" that allows centralized management to give you a status of each system. If you're not using something with built-in automation you:

a) don't have any true oversight on what the status of the system operations are when it comes time to report
b) don't have any way of pushing installs, updates, or removals of the program or definitions or configs to the machines
c) are wasting a LOT of time doing sneakernet
d) isn't centralized so that people BESIDES YOURSELF can check in on the system
e) all of the above!

Re:MS isn't going to do so well at this...

[the angry liberal]

That's cute, but I would fire your ass for pushing some half baked crap like that. Most tools these days have a "Corporate Edition" that allows centralized management to give you a status of each system. If you're not using something with built-in automation you:

a) don't have any true oversight on what the status of the system operations are when it comes time to report
b) don't have any way of pushing installs, updates, or removals of the program or definitions or configs to the machines
c) are wasting a LOT of time doing sneakernet
d) isn't centralized so that people BESIDES YOURSELF can check in on the system
e) all of the above!

You know, you are so right. I'll add that to my list of reasons why we shouldn't move all our employees over to Linux workstations instead of Windows.

All kidding aside, you are aware I wasn't talking of a fortune 500 deployment. Mind you, you can simply propogate out package and send to the scheduler just the same.

As for your a-e list, you should take a chill pill. If you won't allow software that requires external tools to assist in managing, then you should probably just do away with Apache, Sendmail, and the gambit of other Unix tools which don't have the button you apparently need.

I have serious doubts you are in a position to fire anyone, anywhere.. ;)

Re:MS isn't going to do so well at this...

[Anonymous Coward]

What about removing the CORPORATE spyware employers put on to monitor employees??
This is going to break a few things!

Re:MS isn't going to do so well at this...

[shokk]

I certainly wouldn't do without my Apache, sendmail, etc, because UNIX is much more manageable from the commandline for centralization.

Windows is pretty crippled when it comes to this sort of management so you depend on GUIs and funky agents to get things centralized. Maybe when MSH comes out it will make it easier to remotely manage tons of workstations, but I have doubts.

Of course, dealing with SOX compliance really brings out how many of these things are truly out of your control.

In breaking news...

[Dingeaux]

New tool fails to remove biggest piece of malicious software, who remains head of Microsoft...

Re:In breaking news...

[ColdWetDog]

No, that's hardware. Software isn't so squishy.

Slow

[amembleton]

Microsoft also promises to release an updated version of the tool on the second Tuesday of each month.

Is that not a bit slow? Malicious Software could have nearly a month to spread before Microsoft get round to realeasing an update. Mind you, they might release them more often than that, it could be just a minimum.

Re:Slow

[jd]

No, there's no risk that malicious software will outpace it... provided Microsoft sticks to it's once-a-month patch plan.

If its Microsoft, its Mal....

[JCOTTON]

Microsoft Releases "Malicious Software" Removal Tool or Microsoft Releases "Malicious" Software Removal Tool

updates

[SpongeBobLinuxPants]

Microsoft also promises to release an updated version of the tool on the second Tuesday of each month.

Does that mean we may have to wait up to 1 month for a fix for the newest exploit? Meanwhile a whole bunch of computers could be infected within 30 days...

what a process!

[ack154]

So I installed this via Windows Update a little while ago today... Here's what I had to do just now to scan:

1. Install via Windows Update
2. Go to tool website
3. Go to website again in IE, cause it doesn't like firefox
4. Temporarily allow popups from SP2
5. Go to website again to allow the popup for the scan tool to open
6. Accept the license agreement
7. Go to website again after I accepted agreement
8. Open the tool and have IE block the ActiveX control
9. Allow the ActiveX control
10. Go to website AGAIN to install the ActiveX control
11. Allow it to scan and tell me nothing is infected...

I sure hope it wasn't this difficult for anyone else. Did I miss something? I thought it was going to be a program on my PC to run and scan, but I can't find it.

Re:what a process!

[Rolan]

Uhm....I'm not sure what you're talking about. I installed it from Windows Update and had no issues.

Yes, you have to use IE for the Active X. You had ActiveX blocked? Have you ever run Windows Update before? You went back somewhere and had it scan? There's no UI (at least that anyone else has found) for this program....

Yes, I think you missed something.

Re:what a process!

[PitaBred]

I ran into the same thing, only I haven't cared enough to run through that crap to test it. If they install a program, shouldn't there be a menu entry or something? Or at least tell me what it installed?

Re:what a process!

[ackthpt]

Did I miss something?

You appear to have left out the following key steps:

Draw pentagram

Light candles

Sacrifice a goat

...

Prophet!!!

Re:what a process!

[ack154]

I installed it from Windows Update, but it did nothing. At all (except that my updates completed). The tool did absolutely nothing. ActiveX controls are "blocked" by IE in SP2 - the little yellow information bar appeared at the top saying I may need to install blah blah blah. So I allowed that and then had to go back and it actually prompted to install the control.

Um... I've run WU plenty of times... I went to the link in the article where it says "check my pc for infection" ... that's where the popup came from and torture ensued from there.

Re:what a process!

[Rolan]

Well, so I looked around a bit more and there's definately some confusion here... Is downloading it from Windows Update sufficient? Does one have to go back to the website (that neither windows update nor the installation) make any mention of?

Seems that it's Microsoft is missing something....

Re:what a process!

[Anonymous Coward]

Yeah, try the version where you don't act like you have never used Windows before:

1. Go to 'Windows Update' in either the Start Menu or Start->All Programs.
2. Click Express or Custom Install
3. Click Download (or whatever it says).
4. Click yes or ok a coupla times.

Total time that required my input: about 10 sec.

Or just enable the Auto Update thingy and you would have only had 2 steps. Click balloon in corner, click ok a coupla times.

Re:what a process!

[Rolan]

Yeah, there's definately some confusion on what exactly is supposed to be done with it. BTW, didn't mean that last post to sound like a flame or anything.

Re:what a process!

[Rolan]

Add an extra warning by the Windows AntiSpyware program if you have it...

Re:what a process!

[ack154]

Let me explain this again so you can read it:

THE WINDOWS UPDATE COMPLETED - The tool installed via Windows Update. IT DID NOTHING AT ALL AND I DO NOT SEE AN ICON TO RUN IT ANYWHERE FROM MY PC.

Ok... so now that you can actually understand what I'm saying... does it almost make more sense now?

Re:what a process!

[BoldAC]

You can also just download it from here:
http://www.microsoft.com/downloads/details.aspx?Fa milyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displa ylang=en

Re:what a process!

[tomhudson]

It downloads fine under firefox. Just doesn't do much afterwards (maybe it doesn't consider SuSE to be malicious software :-)

Re:what a process!

[Malc]

They obviously have Windows XP Service Pack 2 on their machine. It makes it harder to use ActiveX controls. Without going back and reading the post again, I suspect they also tried to use the online version of the tool rather than the one installed via WindowsUpdate.

Re:what a process!

[sethadam1]

Or you could do this:

1. Visit page in Firefox.
2. Click link to download (since I have no ActiveX).
3. Click download button.

That was all I had to do.

Re:what a process!

[yamla]

I must admit, I'm with ack154 on this one. I followed those steps (obviously without prompting from you) and cannot find the tool anywhere on my computer. Checking Windows update shows that I have no more critical updates to install.

Is the program actually loaded onto my computer or not? I can't find any way to actually run the darn thing.

Re:what a process!

[Nixoloco]

If you don't want to use IE/ActiveX, you can download the tool directly from http://www.microsoft.com/downloads/details.aspx?Fa milyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displa ylang=en

Re:what a process!

[Deviate_X]

You can install and run this: Microsoft Baseline Security Analyzer instead of doing what you did. It also tests your system against security best practices for windows systems.

Re:what a process!

[KiltedKnight]

Not for nothing, but anyone who's even mildly security conscious would block ActiveX controls from any site other than their own intranet (ie, whatever's within your firewall).

ActiveXploitations is one of the biggest security holes on any Windows system, and IE has it so firmly embedded, that unless you turn it off, or at the bare minimum disallow any unsigned controls, it's the easiest way for someone to slip malware or spyware into your computer.

Re:what a process!

[airblaine]

I did the same thing, but IE keeps popping up with addware even though the tool said it removed the program causing it. I use netscape and had to rename iexplore.exe to an un-executable file. That's the only workaround I could come up with. I hate MS. Just have it so kids can play their games. + free aol account and can't port it to linux...

Re:what a process!

[x40sw0n]

first of all google cwshredder; run this program as well as spybot search and destroy (http://security.kolla.de)... then, if you are serious about running linux to talk to AOL, try this site:http://www.yolinux.com/TUTORIALS/LinuxTutoria lAOL.html (I think it is using red hat packages, but most common distros can work with that) good luck... oh and you might want to look at using Tiny Personal Firewall or something like that... X-

Re:what a process!

[Anonymous Coward]

Set microsoft.com to a Trusted Zone, and it should work just fine.

Re:what a process!

[x40sw0n]

Judging by the verbage on the website (and ancillary KB articles) it appears that it is supposed to be automatic... both in its update and running procedures. It appears to run transparently via command line/(service??? can you guys running this check to see if there is a new service running??) It can be told to log output to a file however, so yeah. It looks pretty F$cking lame to me all told. X- [obey the sig...]

Re:what a process!

[Minwee]

I think that's only if you are trying to scan a SCSI drive.

Re:what a process!

[Anonymous Coward]

According to the documentation, this tool is not installed on your machine, it just does a malware scan then goes away. If your machine is clean, then you get nothing. It will be part of the monthly automatic update process now.

god no

[ResQuad]

I tried this a few days ago (beta). It tried to eat ont of our developers scripts. Then in ate VNC (several different versions). The real time scan is annoying as all hell.

Unless you love, dont use it. Your safer with... anything else (especially common sense)

Re:god no

[Anonymous Coward]

Unless you love, dont use it.

Guess nobody on slashdot will be using it.

And what did you just say about my safer?

Re:god no

[Anonymous Coward]

this story is about the malicious software removal tool, not microsoft's antispyware beta.

Well....

[KingKire64]

It took long enough. But on the bright side, maybe they really are ramping up support for thier product. I know alot of you are going to rip MS but hey they didnt have to do this, its not like they are losing thier desktop OS to anyone. If thier PR campaign ends up working well for thier users, i say good show.

Re:Well....

[dolo666]

If thier PR campaign ends up working well for thier users, i say good show.

I don't think it will. I think what will end up happening is that MS will begin dividing types of spyware and saying that some of it is ok, when in reality it's all garbage. DRM anyone?

Re:Well....

[Anonymous Coward]

It seems weird, if you ask me. It makes sense for other companies to release spyware and virus removing software for Microsoft's OS - because they aren't Microsoft. They're essentially "patching" the problems with Microsoft's OS.

But for Microsoft to be doing this comes across as a little odd, because rather than releasing products to help deal with holes in their software - why don't they just fix the holes in their software itself?

Re:Well....

[buckhead_buddy]

The Anonymous Coward said: "But for Microsoft to be doing this comes across as a little odd, because rather than releasing products to help deal with holes in their software - why don't they just fix the holes in their software itself?"

I think that's a question that will be overlooked by a lot of Microsoft fans. You'll see Paul Thurrott's Windows Felchers praise the widespread release of this wonderful tool (acquired from a third party) rather than answer the harder questions of why not make the OS more secure.

This probably just scratches the surface but fundamental security fixes seem to me to come at an expense of:

• Incompatabilities with software
• Inability to share data from one application with another (or gather data for MS in general).
• More difficulties in programming for beginners and custom app writers. (Real security standards are challenging).
• Greater liability if the problem is perceived as an add-on rather than a flaw in the original code.

Hey it Deleted my Netscape....

[Evil W1zard]

And all other software made by vendors that have sued MS.... It also comes with a custom icon that portrays Bill Gates as Baby Jesus.

Re:Hey it Deleted my Netscape....

[rcamans]

Just ask Billy Gates and he will tel you he is far more popular, famous, and powerfull than Jesus, baby or not.

Re:Hey it Deleted my Netscape....

[KiltedKnight]

You'd probably not be surprised to know that at one time, the IE installer did remove Netscape from your computer if it found it... without asking your permission to do so.

Windows Update is also how the Behemoth slips in changes to the whole system that cause third party and open source software to stop working... they just never really tell you EVERYTHING they did, only the stuff to say, "We just patched IE6 for you."

Re:Hey it Deleted my Netscape....

[Evil W1zard]

I just remember when they found the backwards message that said "Netscape Engineers are weenies" in dvwssr.dll and some other dll's hehe.

Nobody's saying it

[Profane MuthaFucka]

Microsoft is using their OS dominance to crush another market for their bottom line. When this tool gains 95% market share because it's packaged with the OS, who will be able to sell a virus scanner?

Re:Nobody's saying it

[cosinezero]

Oh god. First it's "They don't do anything to fix all the viruses!" Now it's "Fixing the viruses will squash all the anti-virus companies". I 3 /.

Re:Nobody's saying it

[twiddlingbits]

Do you trust MS tools to scan your PC and actually do a GOOD job of it? I think Ad-Aware and others will still be around for those of us who think that is like letting the fox guard the chicken coop. If they start to get stomped, they can always sue. I haven't seen if the tool actually lets the other tools run and if they discover things it does not,and vice versa. I did hear it doesn't tell ya what it removed, and THAT is NOT good.

Re:Nobody's saying it

[oconnorcjo]

Microsoft is using their OS dominance to crush another market for their bottom line. When this tool gains 95% market share because it's packaged with the OS, who will be able to sell a virus scanner?

Actually I don't think there SHOULD be a market for AntiVirus software. Normally I would agree with you. I think IE and WMP are examples that could be talked about in regard to embrace/extend and stifling competition.

However, no other OS in history has had to have an Antivirus industry EXCEPT Microsoft!

The idea of an entire industry built on the fact that Microsoft can't clean up after thier shit and so third party companies make a fortune doing just that is pretty sad. I actually like the idea that MS is starting to think "maybe we should wipe our own asses" is a good thing.

Re:Nobody's saying it

[bhsx]

I did hear it doesn't tell ya what it removed, and THAT is NOT good.
You heard wrong. It also doesn't stop you from using any other spyware tool. How you got modded insightful is beyond me. (note: I'm not trying to insult you, that's more a smack at the mods than anything else)

Re:Nobody's saying it

[twiddlingbits]

If that's the case, then it's just another tool on the market. Now if MS starts "integrating" it into the OS that's another issue. I'm really not too keen to download it and find out, could be I can't remove it! I like my Ad-Aware just fine, so why switch.

Re:Nobody's saying it

[Anonymous Coward]

There are plenty of ways to hack into any OS. MS has this problem because they are the dominant OS. There was just an article yesterday bitching about Linux security, or lack thereof.

Re:Nobody's saying it

[Profane MuthaFucka]

Right, it's a spyware scanner. Big deal.

Re:Nobody's saying it

[koko775]

Do you trust MS tools to scan your PC and actually do a GOOD job of it?
Um, yes?

Seriously, MS knows their OS best and it's awfully stupid of you to put them down now that they're finally realizing they need to guard their OS better. That said, the fact that the OS needs to be guarded is something that should be changed, but then again SP2 has made great strides towards that too. In fact, Microsoft has greatly improved security, architecture, and usability in the past few years. The only "evil" thing about them, I think, is their business practices and closed source (if closed-source can be considered evil).

Meh. This message will most likely be modded down or ignored. It's slashdot, after all.

Re:Nobody's saying it

[Jarlsberg]

However, no other OS in history has had to have an Antivirus industry EXCEPT Microsoft!

While I agree with you're saying, I call bogus on this. Even the Amiga had an antivirus "industry" growing (if anything about the Amiga could be called an industry).

Re:Nobody's saying it

[twiddlingbits]

The "greatly improved Security" of IE just had another critical flaw discovered yesterday. However MS did BUY this technology so maybe it will be OK until they mess it up in a few releases.

The best marketing model ever!

[mynickwastaken]

I heard that they will soon release and sell an AV Software (most likely built with RAV technology).

1. Leave some security holes in your OS and Apps
2. Make some Antivirus Software
3. Sell it
4. Profit

And they will claim that they charge for the Antivirus just to not kill other AV companies.

Obligatory Slashbot joke:

[koreaman]

At least it's better than the usual "Microsoft releases malicious software"

So far so good with both

[EvilAlien]

I'm fairly impressed with my tests of the AntiSpyware product. Its pretty slick, seems much more well-rounded than Adware Pro as a comparison. The depth is there too, its not just a mindless GUI app. The configurability and insight into the various bits of registry fiddling that spyware gets up to is cool... and good for a mostly-Windows Ignorant like me.

The malware removal tool is pretty simple. It installs, scans, gives you a clean bill of health or tells you what a dirty infected whore your PC is.

The auto-update features in both applications is nice to see too... Grandma and Grandpa Internet need something to spoonfeed them like this, and if Microsoft keeps them free then grrreat. Now if only we could get them to fix IE so it isn't such a steaming pile...

Re:So far so good with both

[Ark42]

You saw that MS has removed definitions from the antispyware program already, right? WeatherBug complained and MS removed it within a few days from the list of detectable things.

Re:So far so good with both

[needacoolnickname]

Does the removal tool tell you what it is removing and give you an option not to remove it?

Re:So far so good with both

[Tony Hoyle]

I installed it... and... nothing.

It's the most invisible app I've ever seen. No menu option, no icon, no windows...

Assuming it actually exists (!) I assume that means I have no spyware (??)

Re:So far so good with both

[Anonymous Coward]

Slick?

Have you tried using it with a non-default font size? It is completely broken, important buttons disappear off the window, cannot be resized properly, etc... Bad, Bad UI Designer!

Re:So far so good with both

[Anonymous Coward]

Agreed - I installed it via windows update, but where is it?!?!?!

Re:So far so good with both

[slavemowgli]

Huh? Maybe we checked different anti-spyware products there, but the one I got ran for two hours for a "smart" (as opposed to "full") system check - something that Ad-aware does in two minutes -, and then reported almost 5000 false positives.

Yes, that's not a typo. 5000.

It also seems to offer precious little if any configurability, the user interface is sometimes unintuitive: for example, clicking on one of the buttons in the upper right corner while a scan is running will abort that scan without either asking or a means to resume it, so if you accidentally do so after the thing ran for an hour, you're out of luck - you'll just have to invest that hour again (or use something else).

All in all, I'm not impressed in the slightest, and since it didn't find anything that Ad-aware and Spybot S&D hadn't already squashed, I didn't have any second thoughts uninstalling it again - and I'll also keep recommending Ad-aware to computer novices like my parents and so on.

Re:So far so good with both

[Tony Hoyle]

I installed it using Windows Update.

It apparently install a file called mrt.exe, which creates mrt.log in c:\windows\debug. It then deletes itself I think, as I have no mrt.exe anywhere.

There's no UI at all on the one that is being distributed at the moment.

Buckets

[Skiron]

Why don't they just fix the damn crappy software, instead of putting buckets under the leaks??

Re:Buckets

[The-Bus]

Simple question, simple answer.

One is infinitely easier and cheaper to do.

Re:Buckets

[Anonymous Coward]

Maybe it's tough to fix, but easy to patch.

I don't know any working programmers who never released a workaround patch for a problem and did the right fix later after taking the time to figure it out.

Re:Buckets

[ticklemeozmo]

Why don't they just fix the damn crappy software, instead of putting buckets under the leaks??

The same reason why doctors don't cure any diseases anymore. The money is in prevention not the cure. Naturally its all about making the annoyed John and Jane feel better that Microsoft FIXED the problem (regardless if they started it). Can't know how good you feel if you've never felt bad...

Re:Buckets

[Skiron]

It's not a patch is it? It's rip-off software that competitor companies issued becauseMS never fix stuff.

Re:Buckets

[Anonymous Coward]

Oh, Yeah. People made a ton of money in the recent Firefox bugs, too. Huh?

Re:Buckets

[linguae]

Why don't they just fix the damn crappy software, instead of putting buckets under the leaks??

Because it would cut Microsoft's profits, that's why. Fixing Windows's security issues would practically mean rebuilding the entire operating system minus the NT kernel. To get rid of many of the security issues would mean writing a new shell (without Internet Exploder), getting rid of old, insecure backwards compatibility cruft and replacing them with new APIs, and enforcing the user-administrator model that all Unix-based operating systems have (and that Windows is supposed to have, but Microsoft doesn't enforce it, and many developers still develop toward single-user, DOS-based Windows, rather than multi-user, NT-based Windows.) To get rid of or change Internet Explorer and its other software integrated into the OS (Windows Media Player, Outlook Express, MS Office) would mean giving up its monopoly, too. Microsoft isn't changing its OS soon; if it does this, Windows will be more secure, but many users would have to deal with lesser backwards compatibility and dealing with a new way of working with Windows. They might start thinking, "Why should I buy Windows XtremelySecure Edition when I might as well get a Mac or use Linux?"

Put it like this; it is in Microsoft's best interest to continue "putting buckets under the leaks" rather than outright replacing the levee with a much stronger one.

Re:Buckets

[devbone]

"So certain are you..." - Yoda Wow, thats pretty informed. When did you get access to the source code for the NT micro kernel. Ok so at some point in time, it may happen that some other OS such as Linux, or the MacOS may gain enough desktop market share that the bad people of planet earth will want to break in and steal my personal information. Then they take over my computer so they can store their 2TB porn collection and run DoS attacks on Redhat.com or apple.com. Security holes are a fact of software. We don't know about all of the holes in other OS's becuase it is not profitable for the bad guys to dig deeply for them. What cache is ther in touting that you managed to get Fedora to crap its pants. Do it to Window$ and now your a god and general.

This is news???

[cbrichar]

> Microsoft today released their very own Malicious Software Removal Tool...

Ahhh, finally introduced a quick OS uninstall program, did they?

The Most EVIL Malware Ever!

[Foofoobar]

Yes but can it remove the most evil malware of all... Windows! Inquiring minds want to know.

start the clock and place your bets

[EZCheese]

How long before the tool itself needs a "critical update" because of a security hole?

Didn't work

[Spackler]

The machine was still running Windows when it completed.

Requires root privileges

[AlphaSys]

I suppose somebody's gonna whine that it promotes insecurity because you need admin rights to run it.

Re:Requires root privileges

[jd]

To be "correct" from a security standpoint, it would need to be a mini OS that could "run" Windows as one application and the scanning part as a second. That way, nothing in Windows could tamper with the scanner (it wouldn't be able to see it), but the scanner could delete any malware it found.

Re:Requires root privileges

[mlk]

Nah, Virus could have infected your BIOS. You should run it on a separate computer, at lest three miles away, with no physical connection.

Re:Requires root privileges

[jd]

But didn't you know? There are viruses that can spread telepathically between computers! You need to bury both machines in separate mountains, making sure there is 30' of tin-foil around each. :)

P.S. Mornington Crescent. I win. :)

cool off guys...

[sunami]

At least read the stuff about what the software does before you critize it. Saying that it does nothing? It's only made (so far) to protect you from 8 families of malware, so an anti-virus program will probably do everything thier stuff does.

A Better Abbreviation

[buckhead_buddy]

Please start the trend of abbreviating the reference to this tool as the Microsoft Software Removal Tool.

That way when we can offer a GPL'd, Linux-based, Microsoft Software Removal Tool for free there may be more people looking at the correct way to secure their Personal Computing systems.

Re:A Better Abbreviation

[Anonymous Coward]

Apple Mac == Gay.

Mac is for fags.

duh!

[SynapticPlasticity]

I was starting to like those viagra popups.

its all good

[minus_273]

after all cigarette makers release niccotine patches and gum

Just an antivirus

[winfx]

Malicious Software Removal Tool ?

How is that different than any antivirus, with just 10 virus signatures ?

It is just unbelielivable, what marketing dep of MS can think, to hide the facts and sell crap

Re:Just an antivirus

[Vegeta99]

You have to pay for the tool?

Uh oh. I got it for free. PLEASE DON'T CALL THE BSA!!!

The bad news

[Cro Magnon]

The virus makers will release the updated virii the 2nd Wednesday of the month.

release the hounds!

[trb]

Microsoft also promises to release an updated version of the tool on the second Tuesday of each month.

Malicious software writers promise to release an updated version of their work on the day after the second Tuesday of each month (which may or may not be the second Wednesday).

Re:release the hounds!

[photon317]

They may as well plan their updates for the first Tuesday of each month, as Microsoft will be incapable of responding to the new threat in time to roll the fix into the upcoming patch a week away anyways.

Re:release the hounds!

[smoker2]

Malicious software writers promise to release an updated version of their work on the day after the second Tuesday of each month (which may or may not be the second Wednesday).

Err, as far as I can tell, the day after the 2nd Tuesday of _any_ month is in fact a Wednesday, and yes, yes, I do believe it will be the _second_ Wednesday !

Re:release the hounds!

[trb]

Err, as far as I can tell, the day after the 2nd Tuesday of _any_ month is in fact a Wednesday, and yes, yes, I do believe it will be the _second_ Wednesday !

Off topic, I know, but I'm being provoked, and it has pedagogical interest. Might even keep a bug out of someone's code some day. Uhm, get out your calendar, and set the way-back machine to June, 2005. The day after the second Tuesday is, d'oh! From this I can deduce that you do not live in a community with monthly street-cleaning and alternate side of the street parking. Just doing my part to help the script kiddies coordinate their project management work flow. We now return you to your regularly scheduled programming.

......June 2005
Su Mo Tu We Th Fr Sa
..........1 .2 .3 .4
.5 .6 .7 .8 .9 10 11
12 13 14 15 16 17 18
19 20 21 22 23 24 25
26 27 28 29 30

A what now?

[sammy baby]

"What's this? It says it's a malicious software remover."

"I dunno. Try running it?"

"Okay." (click-click.)

"PLEASE WAIT."

"What's it doing?"

"Dunno... oh, here."

"PROGRAM COMPLETE. FIFTEEN PROGRAMS REMOVED. HAVE FUN FIGURING OUT WHICH ONES, BITCHES."

"Dammit."

mal.icio.us ?

[mec]

The guy who started del.icio.us said that he bought the icio.us domain because it had lots of subdomain possibilities.

mal.icio.us is currently empty, but it would be cool to see something there!

Re:mal.icio.us ?

[Zocalo]

But it might be considered somewhat capr.icio.us and not very jud.icio.us to create mal.icio.us just after Microsoft tries to get of to an ausp.icio.us start in its attempts to help us remove susp.icio.us software that is pern.icio.us in its efforts to remain on our PCs though.

Yup. You're right. Lot's of subdomain possibilities there!

Re:mal.icio.us ?

[Lispy]

That's out.rag.icio.us!

Re:mal.icio.us ?

[rsteele19]

Yeah, great. And every time I try to go visit it, I end up putting the dots in the wrong places, like deli.cio.us, or de.lic.io.us. And forget about trying to tell someone verbally how to find it...

"Yeah, go check out this site, it's called delicious."
"Delicious.com?"
"No, d-e-l-dot-i-c-i-o... argh, just frickin' Google it. Oh wait, it's not in Google...

Sometimes I think the Lojbanists have a point

[koreaman]

When sentences that ambiguous slib through the cracks.

(I am not a Lojbanist, but every once in a while it does seem like a good idea.)

Came through Automatic Updates

[David Horn]

I saw it get installed today via Automatic Updates, but I'm stumped if I know where it installed to.

Does it run in the background (not in scheduled tasks) or have I missed something obvious?

Re:Came through Automatic Updates

[Bender Unit 22]

Good question, I have been looking for it as well. I guess it is around somewhere.

Re:Came through Automatic Updates

[MrP-(at work)]

i ran the windowsupdate one on a pc at work and it did the same, it runs in /quiet mode i guess running it manually loads a little program that says it found nothing, and if you click details it lists the viruses that werent found.. its a really fast scan so i assume the quiet mode scanned, found nothing, and exited had it found something im not sure if it would prompt you or just remove the virus and ask you to reboot kind of scary having automatic cleaning from windowsupdate.. just hope it never mistakes a program for a virus when it isn't.. but in a way it might be good for the n00bz who if they see a prompt asking to clean a virus they might just cancel it.. if it does it by itself every 2nd tuesday of each month it might slow the spread of those worms

Malicious Software Gone...

[Anonymous Coward]

Now can it do anything to get rid of this shit-brown color?

Re:Evil!

[Anonymous Coward]

Well,.. at least they are upfront about it

Fix the underlying problems now

[Xabraxas]

Thanks for the bandaid MS. Can you work on the root of the problem now or would that interfere too much with your business plan?

Re:Fix the underlying problems now

[brkello]

The underlying problem is that computers have network connections...if you get rid of those, all the problems go away.

Re:Fix the underlying problems now

[Xabraxas]

Sure, so it has nothing to do with things like ActiveX.

umm.. try reading..

[QuantumG]

Note: If you have difficulty running the tool from this page, it may be due to your browser's security settings. If you have any problems, try downloading the tool directly from the Microsoft.com Download Center and then running it manually.

Which I just did, from Mozilla. 256kb download, woah, that'll break the bank.

Re:umm.. try reading..

[ack154]

Well that is great and all... but that is what's known as an "alternative" to the other process. I was testing the other process. If I wanted to go download it, I would have. It's not like everyone will be like "hey, I wonder if it's a pain in IE... maybe I should just download it."

Re:umm.. try reading..

[QuantumG]

they shouldn't be running IE anyway!

Hmm

[nahnkari]

Looks like a new line of business for M$$

Re:Hmm

[slavemowgli]

It probably would if they weren't the government's pet. :P

Shouldn't they spend time fixing the bugs...

[evdp]

that allow the exlpoits to be installed in the first place, rather than developing a tool to remove the exploits... oh wait they just purchased the software from someone else...

How about a new release of IE that supports CSS properly? I'm tired of having to work around IE's broken box model and such.

If I had three wishes, the first one would be that linux was the gaming platform of choice then I wouldn't have ANY windows boxes...

Re:Shouldn't they spend time fixing the bugs...

[lime1304]

Frankly, there wouldn't be as many issues with Windoze if sys admins weren't so lax in applying the patches MS develops. Yeah, once a month patch availability is ridiculous, but also ridiculous is rampant worm propogation a month after a patch has been made available. Lazy sys admins blame MS because it's an easy out. Note how many of them don't really want to migrate to a *nix platform because typically they lack the skills to properly administrate *nix platforms. That is MS's fault, the mills that create paper MCSE's...a direct result of MS's attempt to certify people without any skill but can answer test questions as competent create situations where we have sys admins who can't do their jobs.

In the interest of security

[bigtangringo]

I'm unable to run the tool as I like my security enough to avoid Internet Explorer.

Note to self:

[colenski]

On second wednesday of every month:

1. Release rejiggerd version of MyDoom
2. ??????
3. Profit!

Line 'em up

[Swamii]

A summary of the next 100 Slashdot posts:

1. Finally, a Windows XP uninstaller!
2. Finally, an IE uninstaller!
3. Jokes about the malicious/software wordplay -- is it a malicious tool to remove software or a malicious software removal tool? har har har
4. Does it run on Linux?
5. Imagine a beowulf cluster of these.
6. In Soviet Russia, software tools malice YOU!
7. In Korea, only old people run malicious tools.
8. Tin foil cap-sporting nerds complaining about WinVNC rumors.
9. ???
10. Profit!
11. Declare bankruptcy.
12. Bitch about MS.
13. Spell MS with a dollar sign.
14. Tin foil cap-sporting nerds complaining about how this is a MS chokehold attempt on the market.
15. Anonymous posters claiming they had sex with your mother.
16. Mindless slashbotting.
17. 53 offtopic posts.
18. /. owners modding down anything disagreeing with the Slashbot secular, pro-Linux, uniformity.
19. Some posts by the GNAA and/or Roland Piquepalle (one and the same)
20. One really long list of post summaries, to get modded down by angry Slashbots.

<accepting no karma bonus for this crap>

Re:Line 'em up

[colenski]

haha beat you on points 9) and 10) by 1 post! eat it!

Re:Line 'em up

[Foofoobar]

Truth hurts don't it. You missed one though.

21. Curry eating MS certified morons who don't know how to program without a GUI

That about sums it up now :)

Re:Line 'em up

[Swamii]

I guess I'll have to remember to include you in the list next time. By the way, I'm Jewish, and I don't like the smell of curry, let alone the taste.

Re:Line 'em up

[Swamii]

:eats it, and asks for 2nds:

Re:Line 'em up

[Foofoobar]

Who said I was talking about you? :)

Oh, I guess the 'Microsoft certified moron who doesn't know how to program without a GUI' part must have hit a little too close to home huh?

Well... you can still get that degree in journalism and make yourself twice as useless. :)

Re:Line 'em up

[AceCaseOR]

Hey! What's wrong with curry? A nice Curry tuna sandwich spread on some good Black-Bean-and-Salsa bread. Mmmm... now that's some good eatin'.

Re:Line 'em up

[Foofoobar]

Wow... call me wierd but that does sound good.

Re:Line 'em up

[Anonymous Coward]

13. Spell MS with a dollar sign.

You missed out 13b - post obPennyArcade response to 13.

Re:Line 'em up

[mlk]

What does being Jewish have to do with liking curry?

I'm British and hate it! :D

Re:Line 'em up

[Swamii]

How fitting are your replies, dear Foofoobar. Like any old fashioned Slashbotter, by reading something that hit too close to home, you get all worked up and feel the need to insult the poster.

You make false assumptions (that I'm apparently a computer programmer, Indian, AND working for Microsoft no less! hahah) Oh I love this! Perhaps you will fulfill #15 for me, right here and now! Do it, foobar, do it!

Re:Line 'em up

[Foofoobar]

BHB

Re:Line 'em up

[Xerp]

Excuse me.

I, for one, welcome our new Malicious Software Removing Overloads.

Oh. Wait. Sorry. I meant Overlords, really I did.

Re:Line 'em up

[lubricated]

> /. owners modding down anything disagreeing with the Slashbot secular, pro-Linux, uniformity.

You of course for got

21. People premptively defending Microsoft claiming linux is just as bad.

22. Someone posts "I know I'm going to get moderated down for this" and what follows is incoherent MS worship. Moderators mod to +5

Re:Line 'em up

[Davorama]

> 18. /. owners modding down anything disagreeing with the Slashbot secular, pro-Linux, uniformity.

19 should have been "Tin foil cap-sporting nerds complaining about linux biased moderation by /. owners."

Oh well.

Re:Line 'em up

[Swamii]

Next time I'll remember to put you in there.

Re:Doesn't Do Anything

[Gr33nNight]

Good, that means you arnt infected with anything :)

MS

[Anonymous Coward]

MS. Malicious Software. I think that acronym will stick...

AC Releases Malicious Colour Removal Tool

[Anonymous Coward]

http://shit.slashdot.org/article.pl?sid=05/01/11/2 133247

Sure Webbaesd

[frovingslosh]

Of course webbased. It tests your system security. If your system can be scanned from across the web then you know an awful lot about the security of the system.

But really, what in the world could be wrong with a web based scanning system? You trust Bill Gates, don't you? You don't think he would do anything unethical while scanning your computer across the web, do you? You don't think there's a reason that the headline of this Slashdot article used the word Malicious as the first adjective to refer to this software, do you?

Nothing new here...

[astrodud]

Microsoft releases another malicious piece of software.

oh no!

[UncleScrooge]

It's included in automatic updates!, I knew I should have turned those off!

Hmmmm...

[8tim8]

Wow, this will work great on my Windows ME system!

from your Windows 2000, XP or 2003 machine.

Or maybe not.

Nobody's Saying this in reply, either

[DrHogie]

So you're saying that Microsoft should never write software for something that already exists? I'm sorry, but this is something that is VERY MUCH needed for Joe Average. Joe Average doesn't mess with Norton, or Trend, or AVG, or any of that. Joe Average does mess with Windows Updates. Get this and run it from WU, and the number of virii and malware gets dropped considerably*.

*This assumes that the software from MS works properly and does a good job at removing said software.

Re:Nobody's Saying this in reply, either

[Profane MuthaFucka]

So you're saying that Microsoft should never write software for something that already exists?

Actually, no.

Fantastic

[Turn-X Alphonse]

It'll start removing "unsigned software" because it's not safe right? I remember that article and hence why I'm switching to Mandrake in a couple of weeks time.

Thanks for pushing me away from Windows, MS! I'll remember to pay you back some day.

I can't believe it

[grcumb]

I was about to take the slashdot editors to task for their ambiguous use of 'Malicious' in the title. I suspected that it was a not-so-clever bash at Microsoft.

Then I realised: that's the name Microsoft gave to it. Man, we knew couldn't write good software, but now they seem intent on proving they can't write proper English either.

Quick, someone, explain the concept of the adjective to the MS Marketing dept.

Re:I can't believe it

[grcumb]

And someone else explain 'irony' to those slashdot readers who don't get the joke. 8^)

Misread headling

[mrcrowbar]

Am I the only one who read the headline as "Microsoft Releases Malicious Software"?

Wow. A menu.

[HarveyBirdman]

I'll have a 12, a 14 and a 17.

Do I get eggroll with that?

Re:Wow. A menu.

[Swamii]

My dear Father Harvey whose countering of a Google Haiku so long ago was so very brilliant -- of course you get an eggroll. :gives giant eggroll Harvey:

Beware of the Default settings!

[Darth23]

has spyware on a user's computer today while I was in a staff meeting, and a tech at the Helpdesk started the new Microsoft "anti-spyware" to scan for problems.

When I got to the PC it had finished scanning.

After rebooting, several pop-ups appeared, including one that was recommending changing the user's Hope Page to www.msn.com.

Keep in mind that this is supposed to be an ANTI spyware app. We use a specific intranet page for the Home Page for all the users here, so the page was NOT, as this app suggested, a 'possible indication of an unauthorized change ib the Onternet explorer settings' or some such nonsense.

I suppose that since Bill Gates didn't actually grant us permission to use our own home page, I can inderstand why a MS product might see it as 'unauthorized'. It also, of course, wanted to make the default search engine search.msn.com.

I feel really sorry for the home users out there who computers are attacked by adware and spyware, and end up going to Microsoft to be rescued.

I also can already see the next round of anti-trust lawsuits getting fired up.

Re:Beware of the Default settings!

[MrP-(at work)]

wrong thread.. this isnt about microsoft antispyware, its about their malware removal tool that came out today (removes viruses)

I love Microsoft

[MLopat]

Microsoft has to be one of the greatest companies in the world. People create problems; they produce solutions. People have potential; Microsoft has the passion.

...and other grammatical anomalies

[mblase]

When I read that headline, I thought it meant Microsoft released a malicious tool for removing (non-MS) software. I don't know if that's a result of my own prejudices or just the kind of thing I've come to expect from Slashdot headlines....

Re:...and other grammatical anomalies

[lawpoop]

Actually, this might be seriously unfunny in the near future. If MS takes a hardline against open source or GPL licensed stuff, or make they claim that any particular app in using infringing code, a lot of slashdotters might be saying "I told you so".

Re:...and other grammatical anomalies

[Anonymous Coward]

I misunderstood the headline in the same way. In my case it's definitely because it's the kind of thing I've come to expect from the Software Industry in general and MS in particular. Let's face it, with the kind of buggy products and one-sided EULAs that are distributed, the software industry is more malicious than the car mechanics used to be (preceived as).

Re:...and other grammatical anomalies

[TheLoneIguana]

Hmmm..

MS=Microsoft
and
MS=Malicious Software

Coincidence?

Re:...and other grammatical anomalies

[the angry liberal]

Actually, this might be seriously unfunny in the near future. If MS takes a hardline against open source or GPL licensed stuff, or make they claim that any particular app in using infringing code, a lot of slashdotters might be saying "I told you so".

So you *REALLY* think this?

When does the short bus get here?

Re:...and other grammatical anomalies

[lawpoop]

Well, I read on another thread that the Malicious Software Detection Program thinks VNC is heinous. And remember, the only remote access app you are allowed to use on WinXP is Remote Desktop.

Re:...and other grammatical anomalies

[DaHat]

The difference between VNC and RDS is quite simple... you can easily change the source code of one and make it into your own malicious application.

Years ago, when I first was introduced to VNC I flew through the source code to create a modified server binary that would not show up in the system tray, did not disable the hosts background picture, and selected from a list of names that would be displayed to the OS. I admit it, this modified version had only evil purposes in mind... installing it on a friends PC... and secretly playing around with WinAmp when he was on the other side of the room... or even having a browser window pop up to goatporn.com.

The possibilities were endless, and remember, this was long before spyware and adware were the known threats they are today (even by the savvy of us back then). Sure enough, Microsoft Antispyware picks up even my modified version. I would call that a good thing for the innocent bystander who wants nothing but to keep their system running clean and efficiently... and a bad thing for those evil doers who want to steal credit card numbers or play jokes on the user.

Re:...and other grammatical anomalies

[keeboo]

Yeah, at first I understood that too...
It must be very obvious, since English is not my first language.

Re:...and other grammatical anomalies

[jc42]

Actually, this might be seriously unfunny in the near future.

Actually, it has been seriously unfunny for several years.

If you dig around for the earliest reviews of Windows Media Player, you'll find a number of reports that, after installing and testing it on their machine, the reviewers found that most or all of their other audio software was no longer working and had to be reinstalled. They also noted that, if they accidentally ran any of the pieces of WMP, the same thing would happen. And WMP couldn't be fully uninstalled.

I have a number of friends that are developing audio and/or video software. They have been getting more and more depressed about the situation on Windows. It seems that, if you want your softwsare to be usable, you have to "license" it (i.e., sign over all rights) to Microsoft. Then they'll add it to WMP's list of Good Guys, and when WMP triggers its search-and-destroy routine, your app will be spared.

This is really what DRM is all about. The intent is that you will only have the right to run approved software. If you have some silly idea that you can write and market your own software, well, just forget that. Hackers like you can't be trusted, y'know.

Re:...and other grammatical anomalies

[AJWM]

I thought that was default behaviour of any Windows install....

Hating Microsoft

[xecutech]

I wish they would just concentrate on fixing their current software, instead of trying to take over every other niche market.

Malicious software removal tool?

[Lurker McLurker]

fdisk!

MSRT

[tOaOMiB]

They really have to working on their naming scheme. Who's going to get something described as "malicious", even if it is a useful software-removal tool.
If they were smart, they'd rename it MS Removal Tool, which wool fool hordes of /.ers to check it out.

XP Activation cracks.

[salvorHardin]

I wonder if cracks for their software would be considered malicious. I can just imagine hundreds of people running this, and then finding out that Office doesn't work anymore and they only have another 28 days in which to activate Windows XP before it'll only boot in safe mode. Don't have a cracked machine to try it on, unfortunately, but I think maybe MS missed their chance by allowing everyone to bypass windows validation before downloading the anti-spyware. Perhaps this is another chance to rid the world of a few 1,000 pirates. Or perhaps I should get more sleep and/or consider Occam's Razor a little more..

MOD PARENT UP!

[Anonymous Coward]

Very good. Wish I had some mod point right about now.

Is this how they fight Firefox?

[GweeDo]

As microsoft pushes more and more of their crap like this to using ActiveX will it be used as a way to hinder the usage of Firefox? For me I don't really care if I have to load 1-2 webpages in IE, but for some "average" users this could be a real bother.

Re:Is this how they fight Firefox?

[MrP-(at work)]

i downloaded it without needing activex.. theres 3 ways to get it, windowsupdate (requires IE), the activex (requires IE) button, or the download link (works in any browser)

Re:Is this how they fight Firefox?

[Tumbleweed]

I was able to install it via Windows Update, but for the life of me, I can't figure out where to START it from. It didn't seem to install anything in my Start menu tree. WTF?

Re:Is this how they fight Firefox?

[MrP-(at work)]

It starts in quiet mode, scans, then exits.. If you werent prompted or asked to reboot it probably didn't find anything.. Not the best program for windowsupdate, next time download and run it manually so you can see what its doing

Re:Is this how they fight Firefox?

[GweeDo]

But you then have to RUN it from IE :) So you can download it anyway you like. But the end result is your butt in IE.

Re:Is this how they fight Firefox?

[AKnightCowboy]

But you then have to RUN it from IE :) So you can download it anyway you like. But the end result is your butt in IE.

But using IE is how you get infected with those trojans in the first place. How terribly ironic.

Re:Is this how they fight Firefox?

[MrP-(at work)]

huh? go to http://www.microsoft.com/security/malwareremove/de fault.mspx click the "Download the Tool" link, then click the download button it will ask you to save Windows-KB890830-ENU.exe.. save it somewhere, then run it.. this can be done in firefox/opera/ie/anything, and running that exe doesnt require IE, it's its own stand-alone program

Re:Is this how they fight Firefox?

[Tumbleweed]

Okay, so it only runs once, or does it run every time at reboot, or what?

This is very odd.

Re:Is this how they fight Firefox?

[MrP-(at work)]

i think it runs once.. or every second tuesday of each month if you have automatic updates on and set to install automatically

Good

[Cloud K]

Will this finally mean there's a realiable way to get rid of Realplayer?

On that note, there is some software out there that lets you play Realmedia files without installing that evil tripe onto your Windoze box. Behold Real Alternative

Sassier

[ackthpt]

It removes Sassier too! It's a lot like Sasser, but with more attitude...

It's either as you say, or the french version.

Rednecks may wish to rename it freedomer and feel proud to have it infest their PC as they do their bit for the war on terror.

Re:Sassier

[Anonymous Coward]

Hello mister liberal elitist jackass.

Re:Sassier

[Master of Transhuman]

Goodbye Mr. neocon fascist asshole...

Oh, and have a nice day...

Firefox

[MattJakel]

The first time you run it, you'll notice that Firefox has disappeared from your system! (added to the list of malicious software by Peter Torr!)

Dee is for Disambiguation

[Invulnerable Bede]

I'm far-from-native speaker, so please disambiguate this for me:

Is it
malicious (software removal tool)
or
(malicious software) removal tool

I mean... given the context and all...

I don't like it - how to get rid of it?

[thewils]

Is there a Malicious Malicious Software Removal Tool Removal Tool?

Re:I don't like it - how to get rid of it?

[salvorHardin]

You can get it here. But be careful. Any spyware attempting to install itself on your machine will fail, and subsequently report you to the Department of Microsoft HomeLAN security as an unamerican, cancerous commie who stifles innovation.

Re:I don't like it - how to get rid of it?

[thewils]

Damn right I'm unamerican. Dunno about the rest though.

Re:I don't like it - how to get rid of it?

[salvorHardin]

Am unamerican also...

Re:MSAV

[Anonymous Coward]

Why would antivirus vendors care? This will be just like Microsoft's first antivirus software (MSAV from DOS 6.22), it will be decent or even fairly good for a while, and then it will start sucking more and more due to a lack of updates

Hmm

[Greyfox]

Microsoft Software Removal Tool

All joking aside, would Microsoft's marketing of a spyware removal tool constitute acknowledgement of critical design flaws in their product which they have no intention of fixing? (He asks as he fires up his LawSuitOMatic...)

Good for GIANT

[Anonymous Coward]

It's great that GIANT can produce some great software. Why couldn't Microsoft have done the same? Why did they have to buy such software instead of having developed it themselves under their trusted computing initiative or focuses on security? What's the point of waiting for help from Microsoft if they have to wait around and buy a third party that produces something of exceptional quality? Under new management, will Microsoft even be able to continue the quality of such development? It's obvious they could not produce a product of this level themselves, software they've bought from others has been pretty good but so far what they've come up with themselves isn't the end all be all, how do they expect to solve anything? I just don't get it.

Not true

[phsdv]

Half of /. readers are below average

Not true

Only half of /. readers are below median, not necesary below average. Look up you statistics, please. Your statement is only correct if we are distributed according to a gausian distribution, and of course, that will never the case ;-)

MS flunks basic hyphenation

[Phong]

It's apparently a result of MS flunking out of their English-syntax classes. The title of their page clearly states that their software is "Malicious" (and it's refreshing to see them freely admit that). It also claims to be a tool that removes software, though the title doesn't tell you what kind. Judging from the text of the rest of the page, the title should have been this:

Malicious-Software Removal Tool

A dropped hyphen often makes a big difference in the meaning of a sentence.

And yet

[bonch]

And yet, when Microsoft does nothing, people like you complain that "Microsoft is doing nothing because their 95% market share of OS dominance allows them not to care."

If people want to use Norton, they'll still use Norton. Nobody's holding a gun to people's heads.

Re:And yet

[Profane MuthaFucka]

And yet, when Microsoft does nothing, people like you complain that "Microsoft is doing nothing because their 95% market share of OS dominance allows them not to care."

No, I don't. The argument makes no sense.

Re:And yet

[Anonymous Coward]

YHBT. YHL. HAND.

Love,
bonch (aka rd_syringe aka Overly Critical Guy)

Are McAfee & Norton the Real Targets?

[jamsho]

Microsoft up to its old tricks. No way for an OS provider to behave.

Has to be said though, McAfee and Norton largely exist only thanks to the failings of Redmond's OS.

he he he...

[Saeed al-Sahaf]

OH NO! One the heal of the finest spyware removal tool, Microsloth comes out with YET ANOTHER top notch tool. And what do all the Slashdot Talking Heads have to say? Oh, nothing....

second tuesday

[nothings]

Microsoft also promises to release an updated version of the tool on the second Tuesday of each month.

No doubt we will start seeing malicious software under Windows begin spreading on the second Tuesday of each month (or perhaps the first Wednesday after the second Tuesday of each month if the sources want to be on the safe side).

What about legit software?

[SunFan]

I wouldn't be suprised at all to start seeing complaints about legit software being removed. If Microsoft decides they don't like a competitor, it's "Death by Windows Update" for them.

Taking Criticism Seriously

[richyoung]

I think these two releases indicate that MS realize that they're taking a drubbing WRT the "monoculture promotes disease" argument any /.er is well familiar with, namely "You should not use $microsoft_product because it is so successful that many security flaws have been found." It seems that their corporate response is going to be "We take security seriously and we produce this (apparently kickass) software to allow users to use our software without the security concerns they may have historically had."

(Now, I know that these two releases don't actually make all of the security issues all go away. I'm not saying that MS products are suddenly, magically secure. I'm just saying their record might rapidly get a lot better, enough to weaken our assertion that FOSS is safer/more secure in the eyes of the end user.)

I'm rooting for FOSS, but you have to admit that this approach (and the software behind it) makes the argument for switching away from Windows a little tougher for the average end-user. What if MS starts beating the FOSS community in response time for fixes?

The FOSS community has long claimed that peer review of code prevents many security flaws before they happen. But many flaws (certainly the high-profile ones) are found after release, whether the code is open or not. If Microsoft uses their corporate advantage in resources and organization to beat us (or appear to beat us) on security response, it undermines one of the fundamental justifications for FOSS.

no different than the other MS Software removal!

[Lost Penguin]

Why is this software removal tool more malicious than other MS software?
Does MS admit it's malicious?

<g>

info on wormblog

[nazarijo]

i posted a brief description on wormblog earlier today. conclusions: decent start at a tool, not comprehensive and in no way a replacement for continually running AV software.

almost great

[gannymeade73]

i have only one problem with this program. MS with their utter disdain for the free exchainge of information, has bundled all P2P based programs into the "malicious files" title. even when you opt to "always ignore threat" it will still find a way to nix the files when you're not looking. once it does remove a file, there is no way to undo the damage. other than that, it seams to be a great program. very thorough. perhaps a bit too thorough.

Too obvious

[eomnimedia]

Excellent spyware removal software can be found here.

how to run in check-only mode?

[Bill Dog]

From the page to manually download it, there's a link to this KB article on enterprise deployment, that shows an example script calling the tool with a "/q" parameter. Are there others? I have no desire to run anything that automatically deletes things. I prefer tools to have a mode where it tells you what it would do, and then you can decide whether to trust it and let it.

Also note from that same article, at the very end, how to disable its reporting your infection status back to MS.

Re:how to run in check-only mode?

[Anonymous Coward]

have you found a way to run it?

I installed it, reboot and I'll be damned if i can find to way to actually start the fucking thing, no icon no link, i have no idea how to start it

__Removal__??

[KiloByte]

Are you sure it's "spyware removal"? All what MS has done before were "spyware catchers"...

easier solution - allow disabling of integration

[micromuncher]

Microsoft has spent a lot of effort integrating everything to the point that its almost impossible to turn something off.

This may seem off topic, but how many users would have been spared malware if Outlook allowed you to disable HTML rendering? How many spammers would be at a loss because just by downloading your mail, you can ping a mining image?

IE is a totally fubar because anyone can insert a bit of interception that's darn near impossible for the average user to get rid of.

How about NOT defaulting to advertising / HTML inside of Media Player?

But also people should lay blame where blame is due... the real evil are people who piggyback spyware with useful apps. I stopped using REAL because of this... almost stopped using LimeWire...

Anyway I digress.

M$ should stop integrating everything with IE because its the source of most evil.

Adjectives bite /. editor in the ass

[Kenrod]

Microsoft Releases Malicious Software Removal Tool

Or even:
MS Releases Tool For Removing Malicious Software

See? Not so hard.

Not all that usefull

[fsck!]

The infestation I'm working on now already knows about the address to MS' removal tool and redirects you to their "portal."

I feel like ranting about their attempt to dethrone AdAware. MS' tool detects 6 threats, half of which are VNC. The "unclassifed BHO" comes back on the next reboot. AdAware can't clean it either, but at least Lavasoft isn't tagging legitimate software as malicious.

they missed the mark

[Bill Dog]

But not supporting all the unprotected, unpatched Win95-WinME systems out there that mom and dad and grandma run, they've missed the mark. Except for XP Home, people who run W2K and XP pro and 2003 server all want to know what's going on. I want to know exactly what files it thinks are bad and wants to remove, and why, and then be prompted whether to go ahead or not, not just a tool with a dum-dum-only mode.

my english not too good

[Anonymous Coward]

I'm sorry, can someone please clarify?

should this read:

Microsoft Releases (Malicious Software Removal Tool)
or
Microsoft Releases Malicious (Software Removal Tool)?

I just can't tell anymore.

Very ominous title.

[Anonymous Coward]

"Microsoft Releases Malicious Software Removal Tool"

Eventually someone will discover that this fancy smansy new software contains some sort of local maybe even network super exploit. When that happens the title of this story will take on a whole new meaning.

It reports legitimate software as well

[J-Georg]

It reports RealVNC, TightVNC and eDonkey2000 as spyware, including Donkey's temporary files.

bloggy blog

[Anonymous Coward]

I have returned...

Install in a virtual machine

[Anonymous Coward]

Dang! If I was back in the office, I'd reload a known XP VM, install this sucka and know exactly what happens.

If I remember to do this next week, and nobody else does it sooner, you'll get a report.

Already posted?

[GFPerez]

Maybe I'm wrong, but wasn't this news posted less than a week ago?

What about Alexa in IE out of box?

[Anonymous Coward]

Will they make exceptions for crap that make deals
with the big company? Diving into the 'pay to
correct OS screwups' business seems to be an
enormous confilict of interest as well...

Another name for...

[Wolface]

Antivirus?

Is Microsoft trying to slip an antivirus under the name of "Malicious Software Removal Tool" or is it just me?

The solution to antitrust?

Where's the bootable version?

[madefaction]

Fat lot of good this software will do for a pc that can't even boot into windows. They need a version that you can burn onto a cd and boot from.

The "monoculture" arguement is an excuse.

[CFD339]

The fact is, the code wasn't designed to be secure. I realize its not hip and cool to like Lotus Notes, but compare it Exchange for a minute:

Notes has roughly 50% of the installed and in use corproate email market in the us, more like 60% in Europe -- though seat counts are nearly impossible to validate for Microsoft at this point.

That means, just as many targets. However, since 1991 when most of the world first saw Notes, it had built in public/private key encryption and authentication certificates and was inherenly designed for security. Mearly stamping a name on a document (a "Note" technically) prevents anyone else from seeing it. Period. In all the years since, there have only been a few denial of service attacks, and as far as I know, only 1 reported incident of potential data loss. Today, the current version can open and use the data files from the original version.

For years, Notes (and rightly so) had a horrible user interface by comparison, yet it still did well in the market. Why? It has been secure, stable, and operating system agnostic from day one.

so much for the 'monoculture' arguement. The truth is, hacking windows is low hanging fruit and makes for a fun target because the software was never designed to be secure.

Malicious?

[Anonymous Coward]

Does 'malicious' describe the software Microsoft released?

2nd Tuesday ?

[angst_ridden_hipster]

They'll release updates on the 2nd Tuesday of each month?

I guess that means that the 2nd Monday (or thereabouts) would be the ideal time to unleash any malware that you want to inflict on the world.

At least you get a month of free reign, before you have to mutate.

Am I The Only One...?

[TekMonkey]

Am I the only one who has noticed that Microsoft seems to be lacking in the program-naming department? First they introduced Microsoft Anti-Spyware, now they've introudced Microsoft Windows Malicious Software Removal Tool. Come on Microsoft, get creative!

Did you read the EULA with it?

[lamerfreak]

... the part where it states it reports home to MS?

Apparently it reports information about what sort of infections it finds, but... they link to a bulletin containing information about the update, and you can find this page: http://support.microsoft.com/kb/891716 has information on a registry key you can add to disable this 'functionality'.

Why no direct d/l link?

[KMSelf]

That's something I don't get. Microsoft posts a link not to a download, but to a download launch page. And that doesn't have a download link but a 'Download' button. This something for a utility which updates monthly. Not that I run MSFT's cr*p, but getting paid to clean up after 'em's a sidelight, and being able to wget updates is helpful.

Not sure if Microsoft's planning on moving the link, but the following URLs should work at present:

• long form
• Or TInyURL: http://tinyurl.com/4o3mk

Anti-spyware Remover - what the,,,?

[tenzig_112]

So, which is it?
Does it remove spyware or anti-spyware?

???

Technically,

[Eradicator2k3]

...don't any releases from Microsoft qualify as a "Malicious Software Installation Tool". Look, they're even sending a subliminal message with their product's name: Malicious Software = MS. Coincidence? I think not.

"Malicious" Software Removal Tool

[SuperKendall]

Finally, some Microsoft software gets an apt name.

Must be truth in advertising laws taking effect...

Or perhaps it's a ruse for the software to get on the inside of the malicious gang that has taken over your computer before it whacks them.

and every second Wednesday...

[Kasperitus]

Microsoft also promises to release an updated version of the tool on the second Tuesday of each month
and every second Wednesday of each month they'll release a security patch to fix the update released the day before.

and every second Wednesday...

[Kasperitus]

Microsoft also promises to release an updated version of the tool on the second Tuesday of each month

and every second Wednesday of each month they'll release a security patch to fix the update released the day before.

(fixed the formatting)

parse error

[theonetruekeebler]

I read this as

Microsoft Releases Malicious (Software Removal Tool)

instead of

Microsoft Releases (Malicious Software) Removal Tool

And I just figured they were being evil again.

Re:Fucked Up FUD wad...

[Anonymous Coward]

You're a fucking liar, you did not download this but are simply trying to spread more FUD and the obligate /. MS bashing.

Riiiight!

[Anonymous Coward]

They created the problem with bad design decisions...

Now they are gonna fix it with yet another piece of crappy software!

Damnit! How about just not creating the problem in the first place?

Ob-Phil-Hartman

[Otto]

Sprechen sie sassy?

Alexa

[HermanAB]

Does it remove Mocrosoft's own Alexa spyware?

Six Scanners and Counting

[superyooser]

Anybody else experiencing scanning fatigue?

1. Avast Antivirus
2. Ad-aware
3. Spybot S & D
4. HijackThis
5. MS AntiSpyware (Giant)
6. MS Windows Malicious Software Removal Tool

It would be helpful to have a meta-scanner to run all of these at once.

How well does it handle CoolWeb?

[BigFootApe]

To be more specific, how many variants does it handle?

As far as I'm concerned, CoolWeb is the most notorious and noxious piece of malware today -- way worse than Gator was a few years ago.

hrm..conundrum

[ronsta]

i ran it and it restarted and said 'operating system not found' [snicker]

stinger was here..

[jean-guy69]

it could be something more than a non-event if stinger wasn't available for a long time and didn't remove more malware..

MS and security? No thanks.

[Anonymous Coward]

Before you even download and try this MS product, ask yourself: "Would you trust an MS product for your security needs?"

Think about it...Why hadn't they released this and the AV product they're working on, in the first place? Why had they left it until the situation fell to crap for Windows users?

Why? Because its about public image, that's why.

Security to MS isn't about securing Windows systems. It never was...Its not about solving issues, its about doing "just enough" to keep the customers satisfied.

Have a look at some of their "band aid" solutions to security issues:

(1) Disable services/functions. (Disable ActiveX? Yeah good one...What if the user needs it for something to function?)
(2) Slap features like NX to reduce the likelyhood of buffer overflows. It still doesn't solve your problems...Its delaying the inevitable.
(3) The number of unpatched security issues of IE compared to third-pary solutions. So much so, that in 2004, even US Govt recommendations are telling everyone NOT to use IE.
(4) The extremely long "turn around time" from being informed of an issue to releasing a patch. (Mr Gates himself claimed MS has the capability to do (4) in 48hours...In reality, its always a minimum of 1 month!).

Security to MS is a PR problem and products like these are merely just to keep users happy. It doesn't matter if it doesn't work well, as long as customers think they're protected.

I'm not surprised that its delivering heaps of false-positives and killing competiting products.

The following is from a Simpsons episode that sums it up quite nicely...

Bart: Hey, why is it destroying other toys?
Lisa: They must have programmed it to eliminate the competition.
Bart: You mean like Microsoft?
Lisa: Exactly.

Personally, I rather trust a company who's sole existence is about security products than a company who does things because its lessening their public image of looking bad.

The ambiguities of English

[DunbarTheInept]

Due to the fact that English grammer is a mixture of three different languages, there are multiple ambiguous ways to order the words and parse the words. There are sometimes great statements that have a completely different meaning than intended.

I read this headline with the wrong association the first several times I saw it.
Instead of:
(Microsoft Releases) (Malicious Software) (Removal Tool)
I read it as:
(Microsoft Releases) (Malicious) (Software Removal Tool)
i.e. a software removal tool that is malicious.

*bzzzt*

[uhlume]

...Somebody may have flunked basic English grammar, but it wasn't "MS". "Malicious software" is not properly a compound word, nor does it belong to any other category of construct requiring hyphenation. Hyphenation in this case is not only unrequired, but would in fact be awkward -- and, arguably, ungrammatical.

Disabling reporting

[jjgm]

This tool reports to MS when it cleans. The reporting is anonymous, it says in the EULA.

Those of you who detest automatic vendor notifications can disable this function. I just followed a tortuous string of buried references from MS to find out how, so to save you all the hassle, here's the thing:

Using regedit, create registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT \DontReportInfectionInformation as a DWORD, and set the value to 1.

Bad Code

[ShagratTheTitleless]

Any word on whether it can remove Internet Explorer. It's harder to get rid of than Cool Web Search.

online version too

[Anonymous Coward]

They offer an online scanning version too. I guess us Firefox users are out of luck though... It seems to only work with IE. Happily, those of us using Firefox probably don't need it.

... and it removes it all

[Juan Rey]

malicious and not so malicious software ;-)

In Europe we've had it for a long time

[jchuillier]

It's called the European commission and it's forcing MS to give us XP without Media Player

How clever ...

[Grismar]

Tell the whole world you will be releasing updates every 2nd Tuesday of the month and take a guess what day malware writers will pick to release their little pets?

Is it just me...

[Rexdude]

Or did anyone else also read it as 'MS releases malicious, software removal tool?' Hey Pop, come look at the amount of free space we got suddenly!

They should make a linux version of it

[NaveWeiss]

so I can run it under Knoppix.
(Hmm.. actually, a DOS version of it would do too)

Interesting. Indeed a pest rm tool may be a pest!

[zijus]

Interesting posts. They confirmed what first thing which came to my mind: Oh! One more pest!

Seriously. No later than yesterday I ran VNC viewer (without install) on a win box. The "pest patrol" software reported VNC as a pest. The machine was slow to death, crimped with soooo many anti-anti-plus-plus-ad-on-little-nice tools.

I don't use pest removers. I look at what starts up, which services, use safe-ish Internet browser, use my brain and I have no pests.
Zijus.

Why do I need a MS M S Remov. Tool?

[nixtanatos]

I use Firefox, I don't install suspicious softwares in the PC; I scan with AdAware and Spybot and doesn't find nothing.

I don't use IE since Firefox 1.0 were released and since this date my machine runs WITHOUT spywares.

I use this program, seems good, but, I don't use IE, then I don't need spyware removal tool.

[]s

---

http://www.getfirefox.com/

regfile

[Anonymous Coward]

open notepad and copy/paste the below (remember to remove the spaces slashdot adds) then save as dri.reg, double click on it and answer yes to the prompt

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\ Microsoft\MR T]
"DontReportInfectionInformation"=dword:0000000 1

to enable reporting copy below to a new file "rdri.reg" and double click on it

REGEDIT4
[- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT ]

So wait,

[Calamormine]

will it work in Linux?

Re: wrong about the monopoly

[rjkimble]

The problem with Microsoft is that they don't release the details of the underlying operating system. They therefore have a significant advantage over the other anti-malware developers. Were they not a monopoly, this would present no problem. However, because they are a monopoly, your analysis is flawed.

That's my interpretation of things at any rate. IANAL and all that.

Au contraire

[Phong]

Allow me to quote from the Wikipedia page you referenced:

• Hyphenation is also common with adjective-noun compound modifiers, but arguably less generally.

So, the phrase doesn't need to be a compound word to be hyphenated--it forms a compound modifer, and thus needs to be hyphenated to convey the proper meaning.

1. Malicious Software Removal Tool, The software-removal tool is malicious.
2. Malicious-Software Removal Tool, The tool removes malicious software.

Hyphens

[pdc]

The importance of using hyphens in adjectival phrases used attributively:

Microsoft Releases Malicious-Software Removal Tool

Microsoft Releases Malicious Software-Removal Tool

Mods: The truth about bonch/rd_syringe/OverlyCrGuy

[Anonymous Coward]

Moderators: Please note that "bonch" is a known fanatical psycophant whose obnoxious offtopic rants are legend here on Slashdot. It doesn't matter what the topic is, he'll find a way to scrape in some pointless Microsoft shilling. While nobody expects us to love Microsoft in any way, his particularly tepid style of calling anyone he replies to "troll" or "liar" because he happens to disagree with whatever they're saying is well documented and should not be rewarded. If anything, bonch is the type of person that should not be part of the open source/free software community. He is an anathema to all that is good about free software.

I'm posting this so that you (the moderator) have some context to consider bonch and not mod him up whenever he posts his filler preformatted rants about installing Windows or whatever that unfortunately get him karma every single time and allow him to continue posting his trademark toxic crap (read on) day in and day out. You may consider this a troll - I consider it community service. And I ain't kidding.

If you're a /. subscriber, I invite you to look through some of his posting history. I guarantee that you'll be hard pressed to find someone that is more "out there" than bonch. You'll also probably notice he's got quite an AC following. Don't just read his posts, make sure you go through the replies.

For example, in this recent post bonch not only calls the OP a troll but attempts to "tell it like it is" while making some vague argument about "MS". Yes, if you're confused, you're not alone. The reply (modded +0) proceeds to simply destroy his bogus argument. You will notice he did not reply. This is what some people call "drive-by advocacy". A sort of I'll just leave you with my thoughts here and move on to the next flamebait kind of deal. In fact, he almost never replies because he knows that his fanatical arguments simply do not hold up to any sort of discussion. It's not that he's chosen the wrong cause - he's just going at it in a completely wrong way.

More? Just read though this post and the subsequent replies. I guess this stands on its own.

More? Bad spelling in astounding conspiracy theories, more offtopic FUD and uninformed "I'm right, look at me" rants, promptly proven wrong. Worse even, bonch wants to be Bill Gates, apparently (that first one is a winner). I mean, really. You think?

FUD, FUD, FUD, FUD, offtopic FUD, and more FUD. This guy is like the Monty Python SPAM skit, but with FUD and more FUD instead of canned meat. Amazed yet? Don't forget that KDE and Gnome make you dumb, and it's all a Slashdot conspiracy. How low do you want to go? Maybe as low as this?

The infamous Slashdot Front Page Troll? Nuclear fireballs? It goes on and on and on and on and on and on and on (troll?). Like the energizer bunny. Or take these two, which stretch the definition of weird.

It's up to you. We can get rid of this guy and make Slashdot a better place. I don't know about you, but I'd rather take the trolls and crapflooders over people like "bonch" any day. And I sure as hell don't want to be categorized along with him. This is not how you advocate free software, period.

Mods: The truth about bonch/rd_syringe/OverlyCrGuy

[Anonymous Coward]

Moderators: Please note that "bonch" is a known fanatical psycophant whose obnoxious offtopic rants are legend here on Slashdot. It doesn't matter what the topic is, he'll find a way to scrape in some pointless Microsoft shilling. While nobody expects us to love Microsoft in any way, his particularly tepid style of calling anyone he replies to "troll" or "liar" because he happens to disagree with whatever they're saying is well documented and should not be rewarded. If anything, bonch is the type of person that should not be part of the open source/free software community. He is an anathema to all that is good about free software.

I'm posting this so that you (the moderator) have some context to consider bonch and not mod him up whenever he posts his filler preformatted rants about installing Windows or whatever that unfortunately get him karma every single time and allow him to continue posting his trademark toxic crap (read on) day in and day out. You may consider this a troll - I consider it community service. And I ain't kidding.

If you're a /. subscriber, I invite you to look through some of his posting history. I guarantee that you'll be hard pressed to find someone that is more "out there" than bonch. You'll also probably notice he's got quite an AC following. Don't just read his posts, make sure you go through the replies.

For example, in this recent post bonch not only calls the OP a troll but attempts to "tell it like it is" while making some vague argument about "MS". Yes, if you're confused, you're not alone. The reply (modded +0) proceeds to simply destroy his bogus argument. You will notice he did not reply. This is what some people call "drive-by advocacy". A sort of I'll just leave you with my thoughts here and move on to the next flamebait kind of deal. In fact, he almost never replies because he knows that his fanatical arguments simply do not hold up to any sort of discussion. It's not that he's chosen the wrong cause - he's just going at it in a completely wrong way.

More? Just read though this post and the subsequent replies. I guess this stands on its own.

More? Bad spelling in astounding conspiracy theories, more offtopic FUD and uninformed "I'm right, look at me" rants, promptly proven wrong. Worse even, bonch wants to be Bill Gates, apparently (that first one is a winner). I mean, really. You think?

FUD, FUD, FUD, FUD, offtopic FUD, and more FUD. This guy is like the Monty Python SPAM skit, but with FUD and more FUD instead of canned meat. Amazed yet? Don't forget that KDE and Gnome make you dumb, and it's all a Slashdot conspiracy. How low do you want to go? Maybe as low as this?

The infamous Slashdot Front Page Troll? Nuclear fireballs? It goes on and on and on and on and on and on and on (troll?). Like the energizer bunny. Or take these two, which stretch the definition of weird.

It's up to you. We can get rid of this guy and make Slashdot a better place. I don't know about you, but I'd rather take the trolls and crapflooders over people like "bonch" any day. And I sure as hell don't want to be categorized along with him. This is not how you advocate free software, period.

Microsoft Antivirus and Malicious software removal

[SmartITGuy]

Microsoft should not be allowed by law to SELL any network security, antivirus, anti-spyware, anti-adware, products!!!! It is their poor programming (bugs and vulnerabilities) that caused the NEED for everyone to have to buy all this extra software. If they are allowed to SELL any of these products, where is the incentive for them to make RELIABLE, and SECURE operating systems, if they can clean house (financially) by selling the tools to fix the errors and vulnerabilities in their software??? They should NOT be allowed to profit from their major blunders. Anything that ALLOWS them that, is pure corruption of the software industry.