4 replies to this topic

[alice2]

Is there any way to prevent the "MRT.log" from being deleted? (The mrt.log is produced after the MS KB890830 Malicious program runs once a month.)
Thank you.

[hazelnut]

http://support.micro....com/kb/891716#

Found this paragraph in the page above, perhaps it may help

Q4. With the March release, data in the Mrt.log file appears to have been lost. Why was this data removed, and is there a way for me to retrieve it?

A4. Starting with the March release, the Mrt.log file is being written as a Unicode file. To make sure of compatibility, when the March version of the tool is run, if an ANSI version of the file is on the system, the tool will copy the contents of that log to Mrt.log.old in %WINDIR%\debug and create a new Unicode version of Mrt.log. Like the ANSI version, this Unicode version will be appended to with each successive execution of the tool.

[Andavari]

If you're talking about CCleaner removing the log then you'd untick what's highlighted in yellow in the screenshot below. However unticking that box also means that CCleaner won't remove any Windows Logs.

Click to enlarge

[alice2]

Thank you.
The reason I asked was that after the KB890830 (Malicious Tool...) was downloaded, my son ran the "notepad %windir%\debug\mrt.log" and no infection found. He then did a CCleaner scan/clean.
When I later saw he downloaded the KB890830, I also ran the "notepad %windir%\debug\mrt.log" thinking I would see the scan results, however I was told there was no mrt.log (probably because it was erased by the CCleaner scan/clean.
I then went in and ran the mrt.exe and then typed in the "notepad %windir%\debug\mrt.log" and this time I also saw no infections found, but also a few of these:

->Scan ERROR: resource process://pid:1456 (code 0x0000054F (1359))
->Scan ERROR: resource process://pid:208 (code 0x0000054F (1359))

Would anyone know why these items showed-up mrt.log AFTER the CCleaner deleted the original mrt.log?

[hazelnut]

Interesting that this is happening, I have also been following your posts here

http://www.mcse.ms/message2562929.html