KB890830: Windows Malicious Software Removal Tool

How it runs behind the scenes and why it returns every month

On Patch Tuesday, Windows Update downloads KB890830 as a self-contained executable, not as a servicing package. Windows extracts the scanner into a temporary folder, runs it once, and removes the folder afterwards. The list of malware families is built into that month's executable, which is why a new release is needed to cover new families: nothing updates it in between.

Because the tool never stays installed, there is no permanent KB890830 entry in the installed-updates list, and every new release is a separate item in Windows Update history under the same KB number. That is why the entry comes back each month with a different version. The scan only looks for specific widespread families that may already be running on the PC. It has no real-time protection, so it complements Microsoft Defender Antivirus (KB2267602 / KB4052623) or a third-party antivirus and never replaces them.

If it finds an infection, it removes it and reports it to Microsoft. Otherwise it finishes silently, with no window or prompt.

Read the scan log or run MSRT by hand

Every monthly run records the tool version, start time, return code, and whether any infection was found. You can read the latest scan summary in PowerShell:

# Read the latest MSRT scan summary and return code> Get-Content "$env:windir\debug\mrt.log" -Tail 30

If you want to open the interactive scanner yourself, press Win + R, type mrt, and press Enter (if the local copy of mrt.exe is more than 215 days old, it prompts you to download a newer release). You can also run a quiet detect-only scan from an elevated terminal:

# Quiet detect-only scan (/Q = quiet, /N = detect only, /F = extended scan, /F:Y = extended + clean)> Start-Process mrt.exe -ArgumentList "/Q","/N" -Wait

Because MSRT is a standalone executable rather than a CBS servicing package, Get-HotFix does not list it. Query the Windows Update client history instead:

# List recent KB890830 runs in Windows Update history (ResultCode 2 = Succeeded)> $s = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher()> $s.QueryHistory(0, $s.GetTotalHistoryCount()) | Where-Object Title -match "KB890830" | Select-Object -First 6 Date, ResultCode, Title

Recent monthly releases & added families

Each monthly release adds or updates signatures for specific widespread malware families (some months have no new release):

For administrators (WSUS, switches & policy)

• Why it may be missing in WSUS: In WSUS and Configuration Manager, KB890830 is classified under Update Rollups (not Security Updates or Definition Updates). Enable Update Rollups in your SUP/WSUS synchronization classifications if you deploy MSRT on-premises.
• Supported platforms: Runs on supported versions of Windows 11, Windows 10, and Windows Server; Windows Server 2008 and 2008 R2 are no longer supported.
• Command-line switches: /Q quiet mode, /N detect-only mode, /F force extended scan, /F:Y extended scan with automatic removal.
• Telemetry & reporting: MSRT sends an infection report to Microsoft when malware or an error is found; administrators can turn reporting off by Group Policy.