Monthly malware via windows update

[Davidk101]

My wife runs a toshiba laptop with win7x64 on it. Prior to a recent event (corrupted boot software) it received and ran the monthly malware update via windows update, even tho it's long past the MS support date for the OS.
The recent event with corrupted boot software involved a specialist recovery of the entire OS (a backup of the C drive did not fix the issue, don't know why: the backup recovered OK but it still would not boot). Now, even tho the OS has all the relevant updates to end-of-support, the monthly malware scan isn't received via windows update.
I infer that this is because the OS has been re-set to "receive updates for windows only" - see screenshot. The updates date in the image is the date of the recovery action.

How can I re-configure to again receive the monthly malware release via windows update??

 

[Bree]

My wife runs a toshiba laptop with win7x64 on it. Prior to a recent event (corrupted boot software) it received and ran the monthly malware update via windows update, even tho it's long past the MS support date for the OS.
The recent event with corrupted boot software involved a specialist recovery of the entire OS (a backup of the C drive did not fix the issue, don't know why: the backup recovered OK but it still would not boot). Now, even tho the OS has all the relevant updates to end-of-support, the monthly malware scan isn't received via windows update.
I infer that this is because the OS has been re-set to "receive updates for windows only" - see screenshot. The updates date in the image is the date of the recovery action.

How can I re-configure to again receive the monthly malware release via windows update??

No, you should still get the Malicious Software Removal Tool. That is counted as being 'for Windows'.




Have you tried clicking on 'Check for updates' since you did the reset?

You could also click on 'Change settings' and see if 'Choose how Windows installs updates' has been set to 'never check'.

 

[Davidk101]

Bree,
Hi, thanks for replying so promptly.
Answering your Q's:
1. Yep, I found the issue after reviewing the results of a 'check for updates' - a monthly habit I got into. I was expecting the malware removal tool to be there - and it wasn't.
So, I went looking for a setting: checked change settings item and got the related page (screenshot, attached). It was set for auto update, so I changed it to what it shows now, but 2 further check for updates since has not changed the result; no malware removal tool listed. I could not find anything else, so I called here.

2. see reply for 1.

The page also lists a link for find out more about other updates - so I clicked it, but all that got me was the Bing search engine within the browser - waiting, going nowhere. I was expecting it would link into a MS page that told me how to do it, but that did not happen either.

 

[Bree]

So, I went looking for a setting: checked change settings item and got the related page (screenshot, attached). It was set for auto update, so I changed it to what it shows now, but 2 further check for updates since has not changed the result; no malware removal tool listed.

Ah, so if it was set for auto update you may have already had the Malicious Software Removal Tool installed without you realising. On this screen....



Click 'View update history' and see if the latest one, v5.99 is listed there, like this....



If so, you won't see a new MSRT issued until next month's Patch Tuesday, the 2nd Tuesday of the month.

 

[Davidk101]

Hi Bree,
No, there wasn't one, and despite the repeated check for updates since, still isn't. see screenshot.

My usual method is to check for the monthly updates on the 3rd day after patch tuesday each month (why 3rd day? been burnt a few times by applying updates too soon, so now I wait a few days). In the past 2 years there's been only 1 update each month: the malware removal tool. After the rebuild on 18 Feb, the March patch tuesday came, no tool listed, so I checked the history: it was per the screenshot. And thus we are having this conversation . .

Today I did think that it might be related to having previously run the tool manually, so I found downloaded and ran the march tool (KB890830-x64-5.99.exe) separately: no infections, and very specifically no change in the update history in the screenshot after the scan.

Really perplexed by this: if it's part of windows, why won't the PC (otherwise running fine) detect the tool and flag it in the updates page????

 

[torchwood]

Hi

Dont panic that KB along with KB947821 are run once updates, ie non-permenant. They do NOT install as such
not sure if it will appear as being run in MSE logs, KB947821 shows up in the CBS folder

 

[Davidk101]

Torchwood,
Thanks for that info: each of those malware tools is about 35Mb, and over time that would build up to a substantial memory usage.
I have a 2nd laptop - hp g6-2002 - also running win7 x64, and it's had no problems: the regular monthly malware tool is detected and once downloaded it runs fine. The update history on that machine shows malware monthly updates going back a long time. So, if they are run once, don't install, can I assume that the history of any specific tool is just an entry only, the tool itself not retained after running without issues?? the long-term memory use of that had begun to concern me.

Which doesn't answer why, on the re-installed Toshiba machine, the updates pages don't detect the malware tool even when specifically commanded to search for updates. It's like a setting somewhere has that turned off, and while I can't find it, it seems the forum doesn't know either.

 

[Bree]

...Which doesn't answer why, on the re-installed Toshiba machine, the updates pages don't detect the malware tool even when specifically commanded to search for updates. It's like a setting somewhere has that turned off, and while I can't find it, it seems the forum doesn't know either.

It's a long shot, but there's a policy that can block receiving the MSRT through Windows Update. Though I can't think of a reason it may have got applied just by re-installing.

Open Regedit and look in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT for the DWord DontOfferThroughWUAU. If this exists and is set to 1 then you won't see the MSRT appear when you check for updates.

 

[Davidk101]

Hi Bree,
I looked, and there isn't a policy for WSRT . . . screenshot.

More thinks on this???