Malicious Software Removal Tool in Win10 Home won't run

Hi Rob,

After I got back home I put this together to help illustrate the time line involved with the log posting from the OP that I think may tell a story, based on what we know now after collaborating on our experiments. Without elaborating any further on my end at this point do you see a possible pattern here that may explain the unexpected behavior?

Granted, the info supplied so far from the OP is most likely not complete in entirety however from what I have seen so far .... Anyway, this is a .jpg that is narrow enough to fit here but is tall, I've noticed in the past that when such is placed in a reply on this site the entire image is reduced in size. If so you can either right-click >open in new tab or window then zoom or copy and paste to your favorite image app and zoom in to be able to read it. I'd be interested to hear your thoughts on this theory, (I think that you will get my drift?).

-Richard

Ah, I'd never bothered to look that closely since I'd only clicked the selection to Run the KB890830 download and never actually saved or examined its contents.

So now the only question remaining is whether the two methods of execution actually operate differently for RikDatta, since one attempts to execute the existing copy directly while the other runs it automatically after exploding the download package.

Both are most often aborting according to RikDatta, but we don't know for certain if one is being blocked from running entirely, since we can't see that in the logs as nothing will be added in that case.

At this point though, I'd be more interested to learn if there's anything in the Event Viewer, most likely the Application log indicating errors such as an appcrash.  Once we know that we can try to find an actual cause and worry about the differing starting methods later.

Rob

I'm not sure exactly what you mean when you say that the manual download has a different name so therefore it is different and would not interact with MRT.exe located in system 32.

From auto update: KB890830.

From the manual download page: Windows-KB890830-x64-V5.49.exe

This is a manual download of KB890830 that was already (installed if you will) by auto update. Initiating Windows-KB890830-x64-V5.49.exe just installs the update again. Being that it is always KB890830 the version number must be paid attention to. This is why after the OP installed the old one after the new one had been installed by auto update auto update then reinstalled the new one again.

I have to run now guys, Good luck!

-Richard

I've done both types including the download many times, mostly to test the past questions relating to preliminary infection results, so nothing you and I've discussed seems abnormal to me.

Only the aborting operation for the OP seems out of place and I'd had little true opinion until I did this testing myself today.  All my previous comments had been based on discussions in the thread itself, so only in the last few hours did I learn what I posted recently.

I'm using the right-click - Run command instead of Cortana, but there's really no difference for our purposes here.

Rob

When I ran the manual scan (I did not manually download it) I just typed MRT in the Cortana search box then selected  MRT run command from the results then selected Yes to Do you want to allow this app to make changes to your device. I chose the full scan (multiple drives) it then ran for about 2 hours and 45 minutes then completed (with results). (This is the only manual scan I have ever done with the MSRT and it was done for the purpose of being involved in this thread).