Can Qualys either detect or preferrably report out the results of the MS Malicious software removal tool? I searched knowledge base and could find nothing. Anyone else have ideas here on how to detect?
QID 121213 : Microsoft Windows Malicious Software Removal Tool Detected. The QID is in production.
If you have further questions, please don't hesitate to contact our Support Dept.
If the MS - MSRT is found in the raw scan results we can find this out else we can use Policy Compliance module to do it.
For clarification, I did NOT find the MSRT in the knowledge base so it doesn't seem to have a QID. Assuming my search was correct, it wouldn't be in the scan results, correct?
I don't subscribe to PC at the moment and am hoping to get this as a QID. However, would you happen to know the registry key to search for? Even having that would help me in the interim...
Hello... Anyone out there have some insight here? Bueller?
Currently we do not have a QID for MS Malicious Software Removal Tool in QualysGuard VM.
We will add this soon.
Has an ETA been established for this to be GA? Any insight you might be able to add here would be appreciated.
Thanks Craig! For anyone who is interested, the "results" value Qualys returns can be interpreted from the values shown here: http://support.microsoft.com/kb/891716
However, to see the actual result outcomes from the removal tool the above article mentions that "The Malicious Software Removal Tool writes details about the result of its execution in the %windir%\debug\mrt.log log file"
Retrieving data ...