The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Vista, Windows Server 2003, Windows XP, or Windows 2000
Microsoft released the Microsoft Windows Malicious Software Removal Tool to help remove specific prevalent malicious software from computers that are running Windows Vista, Windows Server 2003, Windows XP, or Windows 2000. After you download the Microsoft Malicious Software Removal Tool, it runs one time to check your computer for inflection by specific, prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps remove any infection it finds. Microsoft releases a new version of the tool every month.
This article contains information about how the tool differs from an antivirus product, how you can download and run the tool, and what happens when the tool finds malicious software on your computer. The advanced user section includes information for the IT administrator and additional information about how to manage and run the Malicious Software Removal Tool.
How the Microsoft Malicious Software Removal Tool differs from an antivirus product
The Microsoft Malicious Software Removal Tool does not replace an
antivirus product. It is strictly a post-infection removal tool. Therefore, we
strongly recommend that you install and use an up-to-date antivirus
product.
The Microsoft Malicious Software Removal Tool differs from an
antivirus product in three key ways:
•
The tool removes malicious software from an
already-infected computer. Antivirus products block malicious software from
running on a computer. It is significantly more desirable to block malicious
software from running on a computer than to remove it after
infection.
•
The tool removes only specific, prevalent malicious
software. Specific, prevalent malicious software is a small subset of all the
malicious software that exists today.
•
The tool focuses on the detection and removal of active
malicious software. Active malicious software is malicious software that is
currently running on the computer. The tool cannot remove malicious software
that is not running. However, an antivirus product can perform this
task.
For more information about how to protect your computer, visit
the following Microsoft Protect Your PC Web site:
Note The Microsoft Malicious Software Removal Tool focuses on the
detection and removal of malicious software such as viruses, worms, and Trojan
horses only. It does not remove spyware. However, you can use Windows Defender
to detect and remove spyware. To download Windows Defender, visit the following
Microsoft Web site:
You do not have to disable or remove your antivirus program when
you install the Microsoft Malicious Software Removal Tool. However, if
prevalent, malicious software has infected your computer, the antivirus program
may detect this malicious software and may prevent the removal tool from
removing it when the removal tool runs. In this case, you can use your
antivirus program to remove the malicious software.
Because the
Microsoft Malicious Software Removal Tool does not contain a virus or a worm,
the removal tool alone should not trigger your antivirus program. However, if
malicious software infected the computer before you installed an up-to-date
antivirus program, your antivirus program may not detect this malicious
software until the tool tries to remove it.
How to download and run the Microsoft Malicious Software Removal Tool
You can download and run the Microsoft Malicious Software Removal
Tool if your computer is running Windows Vista, Windows Server 2003, Windows
XP, or Windows 2000.
Note You cannot download and run the tool if you are running Microsoft
Windows 98, Windows Millennium Edition, or Microsoft Windows NT
4.0.
The easiest way to download and run the tool is to turn on
Automatic Updates. Turning on Automatic Updates guarantees that you receive the
tool automatically every month. If you have Automatic Updates turned on, you
have already been receiving new versions of this tool monthly. The tool runs in
quiet mode unless it finds an infection. If you have not been notified of an
infection, no malicious software has been found that needs your attention.
Note If your computer is running Windows XP Service Pack 2 (SP2),
Automatic Updates is turned on by default.
Are you unsure whether
Automatic Updates is turned on? Follow these steps to determine whether
Automatic Updates is turned on:
1.
Log on to your computer as an administrator, log on with a
user account that is a member of the Administrators group, or be able to
provide an administrator password when the computer prompts you to provide one.
If you do not know if you meet these criteria, follow the steps for the
operating system that your computer is running.
If your computer is running
Follow these steps:
Windows Vista
a.
Click Start, and then click Start Search.
b.
In the Start Search box, type
timedata.cpl, and then press ENTER. The Date and
Time dialog box opens.
c.
On the Date and Time tab, click
Change date and time. If the User Account
Control dialog box opens, click Continue.
d.
If you are prompted to type an administrator
password, and you see administrator account names listed, you are not logged on
with a computer administrator account. Type the administrator password and
press ENTER. If you do not know the administrator password, you may have to ask
the administrator of your computer for help.
Otherwise, if you are not
prompted to type an administrator password, you are already logged on with a
computer administrator account. Click Cancel, and then click
Cancel again to close the Date and Time
dialog box. Go to step 2.
Windows XP, Windows Server 2003, or Windows 2000
a.
Click Start, and note your user
name at the top of the Start menu.
b.
Click User Accounts.
c.
Under your user name, you should see either
Limited account or Computer administrator. If
you see Computer administrator, go to step 2. Otherwise, if
you do not see Computer administrator, click
Start, and then click Log Off.
d.
When you are prompted, click Switch
User.
e.
On the Welcome screen, press
CTRL+ALT+DELETE by pressing down both the CTRL and ALT keys and then pressing
DELETE. The Log On to Windows dialog box appears.
f.
In the User name box, type
Administrator. In the Password box,
type your Administrator password, if you created one during Windows XP setup.
If you have not assigned a password, or you do not know your password, leave
the Password box blank. Then, click
OK.
2.
Turn on Windows Automatic Update. Follow the steps for the
operating system that your computer is running:
If your computer is running
Follow these steps:
Windows Vista
a.
Click Start, point to All Programs, and then click
Windows Update.
b.
In the left pane, click Change
settings.
c.
Click to select Install updates
automatically (recommended).
d.
Under Recommended updates, click
to select the Include recommended updates when downloading, installing,
or notifying me about updates check box, and then click
OK. If you are prompted for an administrative password or for
confirmation, type the password or provide confirmation. Go to step
3.
Windows XP, Windows Server 2003, or Windows 2000
a.
Click Start, click
Control Panel, and then click Performance and
Maintenance.
b.
Click System. The System
Properties box appears.
c.
On the Automatic Updates tab,
click to select the Automatic (recommended) check box is
selected, and then click OK.
3.
Download the Malicious Software Removal Tool. You must
accept the Microsoft Software License Terms. The license terms are only
displayed for the first time that you access Automatic Updates.
Note After you accept the one-time license terms, you can receive
future versions of the Malicious Software Removal Tool without being logged on
to the computer as an administrator.
When the Malicious Software Removal Tool detects malicious software
The Malicious Software Removal Tool runs in quiet mode. If it
detects malicious software on your computer, the next time that you log on to
your computer as a computer administrator, a balloon will appear in the
notification area to make you aware of the detection.
Performing a full scan
If the tool finds malicious software, you may be prompted to
perform a full scan. We recommend that you perform this scan. A full scan
performs a quick scan and then a full scan of the computer, regardless of
whether malicious software is found during the quick scan. This scan can take
several hours to complete because it will scan all fixed and removable drives.
However, mapped network drives will not be scanned.
Removing malicious files
If malicious software has modified (infected) files on your
computer, the tool prompts you to remove the malicious software from those
files. If the malicious software modified your browser settings, your homepage
may be changed automatically to a page that gives you directions on how to
restore these settings.
You can clean specific files or all the
infected files that the tool finds. Be aware that some data loss is possible
during this process. Also, be aware that the tool may be unable to restore some
files to the original, pre-infection state.
The removal tool may
request that you restart your computer to complete the removal of some
malicious software, or it may prompt you to perform manual steps to complete
the removal of the malicious software. To complete the removal, you should use
an up-to-date antivirus product.
Reporting infection information to Microsoft
The Malicious Software Removal Tool will send basic information
to Microsoft if the tool detects malicious software or finds an error. This
information will be used for tracking virus prevalence. No identifiable
personal information that is related to you or to the computer is sent together
with this report.
The Malicious Software Removal Tool does not use an installer.
Typically, when you run the Malicious Software Removal Tool, it creates a
randomly named temporary directory on the root drive of the computer. This
directory contains several files, and it includes the Mrtstub.exe file. Most of
the time, this folder is automatically deleted after the tool finishes running
or after the next time that you start the computer. However, this folder may
not always be automatically deleted. In these cases, you can manually delete
this folder, and this has no adverse effect on the computer.
No-charge support is available for home users by calling
1-866-PCSAFETY in the United States and in Canada. For international users,
contact your local Microsoft subsidiary. For more information about how to
contact your local Microsoft subsidiary for security update support issues,
visit the International Support Web site:
This section is intended for advanced computer
users. If you are not comfortable with advanced troubleshooting, you might want
to ask someone for help or contact support. For more information about how to
contact Microsoft support, visit the following Microsoft Web site:
You can manually download the Malicious Software Removal Tool
from the Microsoft Download Center.
The following
file is available for download from the Microsoft Download Center:
Download
the 890830 package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en)
Release Date: April 8, 2008
For more information
about how to download Microsoft support files, click the following article
number to view the article in the Microsoft Knowledge Base:
119591 (http://support.microsoft.com/kb/119591/) How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most
current virus-detection software that was available on the date that the file
was posted. The file is stored on security-enhanced servers that help prevent
any unauthorized changes to the file.
Deploying the Malicious Software Removal Tool in an enterprise environment
If you are an IT administrator who wants more information about
how to deploy the tool in an enterprise environment, click the following
article number to view the article in the Microsoft Knowledge Base:
891716 (http://support.microsoft.com/kb/891716/) Deployment of the Microsoft Windows Malicious Software Removal Tool in an enterprise environment
This article includes information about
Microsoft Systems Management Server (SMS), Microsoft Software Update Services
(SUS), and Microsoft Baseline Security Analyzer (MBSA).
Prerequisites for running the Malicious Software Removal Tool
Except where noted, the information in this section applies to all
the ways that you can download and run the Malicious Software Removal Tool:
•
Microsoft Update
•
Windows Update
•
Automatic Updates
•
The Microsoft Download Center
•
The Malicious Software Removal Tool Web site on
Microsoft.com
To run the Malicious Software Removal Tool, the following
conditions are required:
•
The computer must be running Windows Vista, Windows Server
2003, Windows XP, or Windows 2000.
•
You must log on to the computer by using an account that is
a member of the Administrators group. If your logon account does not have the
required permissions, the tool exits. If the tool is not being run in quiet
mode, it displays a dialog box that describes the failure.
•
If the tool is more than 60 days out-of-date, the tool
displays a dialog box that recommends that you download the latest version of
the tool.
When you download the tool from Microsoft Update or from Automatic
Updates, and no malicious software is detected on the computer, the tool will
run in quiet mode next time. If malicious software is detected on the computer,
the next time that an administrator logs on to the computer, a balloon will
appear in the notification area to notify you of the detection. For more
information about the detection, click the balloon.
When you run the
tool from the http://www.microsoft.com (http://www.microsoft.com) Web site,
the tool always displays a user interface (UI).
When you download the
tool from the Microsoft Download Center, the tool displays a user interface
when it runs. However, if you supply the /Q command-line switch, it runs in quiet mode.
Extended
scan and file disinfection functionality currently are not supported when you
run the tool from the Malicious Software Removal Tool Web site. Run the tool
from the Download Center, from Microsoft Update, from Windows Update, or from
Automatic Updates to enable this functionality.
Release information
The Malicious Software Removal Tool is released on the second
Tuesday of every month. Each release of the tool helps detect and remove
current, prevalent malicious software. This malicious software includes
viruses, worms, and Trojan horses. Microsoft uses several metrics to determine
the prevalence of a malicious software family and the damage that can be
associated with it.
The following table lists the malicious software
that the tool can remove. The tool can also remove any known variants at the
time of release. The table also lists the version of the tool that first
included detection and removal for the malicious software family.
Each
release of the tool is cumulative. That is, each release not only helps detect
and remove new malicious software families, it also helps detect and remove all
the malicious software covered in earlier versions. New variants of malicious
software that is detected and removed in previous releases are also covered in
each monthly release.
This Microsoft Knowledge Base article will be
updated with information for each monthly release so that the number of the
relevant article remains the same. The name of the file will be changed to
reflect the tool version. For example, the file name of the January 2005
version is Windows-KB890830-ENU.exe, and the file name of the February 2005
version is Windows-KB890830-V1.1-ENU.exe.
Be aware that the severity ratings of threats may be updated
occasionally to account for changes in prevalence and other
factors.
**W32/Hackdef typically hides other potentially unwanted
software on the computer. If the cleaner tool reports that W32/Hackdef was
detected on the computer, we strongly recommend that you run a scan with
up-to-date antivirus and antispyware programs (see
http://www.microsoft.com/protect/computer/spyware/default.mspx (http://www.microsoft.com/protect/computer/spyware/default.mspx)).
If you want to view the software that W32/Hackdef was hiding, first open the
log file for the cleaner tool (%Windir%\Debug\Mrt.log). Next, in the "Possible
scanning results" section, find the line or lines that note the folder in which
Win32/Hackdef was found. In that same folder, you should find the Win32/Hackdef
configuration file that has the .ini file name extension. View this file to
determine the software that Win32/Hackdef was hiding on the computer.
Any malicious software that is not listed in this table is not
detected and not removed by the tool. To scan for and remove other malicious
software, use an up-to-date antivirus product. For more information, visit the
following Microsoft Protect Your PC Web site:
The Malicious Software Removal Tool sends information to Microsoft
if it detects malicious software or finds an error. The specific information
that is sent to Microsoft consists of the following items:
•
The name of the malicious software that is
detected
•
The result of malicious software removal
•
The operating system version
•
The operating system locale
•
The processor architecture
•
The version number of the tool
•
An indicator that notes whether the tool is being run by
Microsoft Update, Windows Update, Automatic Updates, the Download Center, or
from the Web site
•
An anonymous GUID
•
A cryptographic one-way hash (MD5) of the path and file
name of each malicious software file that is removed from the
computer
If apparently malicious software is found on the computer, the
tool prompts you to send information to Microsoft beyond what is listed here.
You are prompted in each of these instances, and this information is sent only
with your consent. The additional information includes the following:
•
The files that are suspected to be malicious software. The
tool will identify the files for you.
•
A cryptographic one-way hash (MD5) of any suspicious files
that are detected.
You can disable the reporting feature. For information about how
to disable the reporting component and how to prevent this tool from sending
information to Microsoft, click the following article umber to view the article
in the Microsoft Knowledge Base:
891716 (http://support.microsoft.com/kb/891716/) Deployment of the Microsoft Windows Malicious Software Removal Tool in an enterprise environment
After the tool runs, there are four main results that the removal
tool can report to the user:
•
No infection was found.
•
At least one infection was found and was
removed.
•
An infection was found but was not removed. This result
will be displayed if suspicious files were found on the computer. To help
remove these files, you should use an up-to-date antivirus product.
•
An infection was found and was partially removed. To
complete this removal, you should use an up-to-date antivirus
product.
Frequently asked questions about the Malicious Software Removal Tool
•
Q1: Is this tool digitally signed by Microsoft? A1: Yes.
•
Q2: What type of information does the log file contain? A2: For information about the log file, click the following article
number to view the article in the Microsoft Knowledge Base:
891716 (http://support.microsoft.com/kb/891716/) Deployment of the Microsoft
Windows Malicious Software Removal Tool in an enterprise environment
•
Q3: Can this tool be redistributed? A3: Yes. Per the terms of this tool's license terms, the tool can be
redistributed. However, make sure that you are redistributing the latest
version of the tool.
•
Q4: How do I know that I am using the latest version of the tool?
A4: If you are a Windows Vista, Windows XP, Windows Server 2003, or
Windows 2000 user, use Microsoft Update or the Microsoft Update Automatic
Updates functionality to test whether you are using the latest version of the
tool. If you have chosen not to use Microsoft Update, and you are a Windows
Vista, Windows XP, or Windows Server 2003 Service Pack 1 (SP1) user, use
Windows Update. Or, use the Windows Update Automatic Updates functionality to
test whether you are using the latest version of the tool. Additionally, you
can visit the Microsoft Download Center. Also, if the tool is more than 60 days
out-of-date, the tool will remind you to look for a new version of the
tool.
•
Q5: Will the Microsoft Knowledge Base article number of the tool change with each new version? A5: No. The Microsoft Knowledge Base article number for the tool will
remain as 890830 for future versions of the tool. The file name of the tool
when it is downloaded from the Microsoft Download Center will change with each
release to reflect the month and the year when that version of the tool was
released.
•
Q6: Is there any way I can request that new malicious software be targeted in the tool? A6: Currently, no. Malicious software that is targeted in the tool is
based on metrics that track the prevalence and damage of malicious
software.
•
Q7: Can I determine whether the tool has been run on a computer? A7: Yes. By checking a registry key, you can determine whether the
tool has been run on a computer and which version was the latest version that
was used.
For more information, click the following article number to view
the article in the Microsoft Knowledge Base:
891716 (http://support.microsoft.com/kb/891716/)
Deployment of the Microsoft
Windows Malicious Software Removal Tool in an enterprise environment
•
Q8: Why don't I see the tool on Microsoft Update, Windows Update, or Automatic Updates?
A8: Several scenarios may prevent you from the seeing the tool on
Microsoft Update, Windows Update, or Automatic Updates:
•
Only Windows Vista, Windows XP, and Windows Server 2003
SP1 users are offered the tool on Windows Update or Automatic
Updates.
•
If you have already run the current version of the tool
from Windows Update, Microsoft Update, Automatic Updates, or from either of the
other two release mechanisms, it will not be reoffered on Windows Update or
Automatic Updates.
•
For Automatic Updates, the first time that you run the
tool, you must be logged on as a member of the Administrators group to accept
the license terms.
•
Q9: How do Microsoft Update, Windows Update, and Automatic Updates determine who is offered the tool? A9: All Windows Vista, Windows XP, Windows Server 2003, and Windows
2000 users are offered the tool if the following conditions are true:
•
The users are running the latest version of Microsoft
Update or the Microsoft Update Automatic Updates feature.
•
The users have not already run the current version of
the tool.
All Windows Vista, Windows XP, and Windows Server 2003 SP1
users are offered the tool if the following conditions are true:
•
The users are not running Microsoft Update.
•
The users are running the latest version of Windows
Update or Windows Update Automatic Updates.
•
The users have not already run the current version of
the tool.
•
Q10: When I look in the log file, it tells me that errors were found during the scan. How do I resolve them?
A10: For information about the errors, click the following article
number to view the article in the Microsoft Knowledge Base:
891717 (http://support.microsoft.com/kb/891717/) How to troubleshoot an error when you run the Microsoft Windows Malicious Software Removal Tool
•
Q11: Will you rerelease the tool even if there are no new security bulletins for a particular month? A11: Yes. Even if there are no new security bulletins for a particular
month, the Malicious Software Removal Tool will be rereleased with detection
and removal support for the latest prevalent malicious software.
•
Q12: How do I prevent this tool from being offered to me by using Microsoft Update, Windows Update, or Automatic Updates?
A12: When you are first offered the Malicious Software Removal Tool
from Microsoft Update, Windows Update, or Automatic Updates, you can decline
downloading and running the tool by declining the license terms. This decline
can apply to only the current version of the tool or to both the current
version of the tool and any future versions, depending on the options that you
choose. If you have already accepted the license terms and would prefer not to
install the tool through Windows Update, click to clear the check box that
corresponds to the tool in the Windows Update UI.
•
Q13: After I run the tool from Microsoft Update, Windows Update, or Automatic Updates, where are the tool files stored? Can I rerun the tool?
A13: When it is downloaded from Microsoft Update or from Windows
Update, the tool runs only one time each month. To manually run the tool
multiple times a month, download the tool from the Download Center or by
visiting the following Microsoft Web site:
Q14: Can I run this tool on a Windows Embedded computer? A14: Currently, the Malicious Software Removal Tool is not supported
on a Windows Embedded computer.
•
Q15: Does running of the tool require any security updates to be installed on the computer?
A15: No. Unlike most previous cleaner tools that were produced by
Microsoft, the Malicious Software Removal tool requires no security update
prerequisites. However, we strongly recommend that you install all critical
updates before you use the tool, to help prevent reinfection by malicious
software that takes advantage of security vulnerabilities.
•
Q16: Can I deploy this tool by using SUS or SMS? Is it compatible with MBSA?
A16: For information about how to deploy this tool, click the
following article number to view the article in the Microsoft Knowledge
Base:
891716 (http://support.microsoft.com/kb/891716/) Deployment of the Microsoft
Windows Malicious Software Removal Tool in an enterprise environment
•
Q17: Do I need the previous cleaner tools installed to run the Malicious Software Removal Tool? A17: No.
•
Q18: Is there a newsgroup available to discuss this tool?
A18: Yes. You can use the microsoft.public.security.virus
newsgroup.
•
Q19: Why did the "Windows File Protection" window appear when I ran the tool? A19: In some cases, when specific viruses are found on a system, the
cleaner tool tries to repair infected Windows system files. Although this
action removes the malicious software from these files, it may also trigger the
Windows File Protection feature. If you see the Windows File Protection window,
we strongly recommend that you follow the directions and insert your Microsoft
Windows CD. This will restore the cleaned files to their original,
pre-infection state.
•
Q20: Are localized versions of this tool available? A20: Yes, the tool is available in 24 languages. Before the February
2006 release, each localized version of the tool was available as a separate
download. Starting in February 2006, the tool is now offered as a multilingual
download. Therefore, only one version of the tool is available, and the
appropriate language appears based on the language of the current operating
system.
•
Q21: I found the Mrtstub.exe file in a randomly named directory on my computer. Is the Mrtstub.exe file a legitimate component of the tool? A21: The tool does use a file that is named Mrtstub.exe for certain
operations. If you verify that the file is signed by Microsoft, the file is a
legitimate component of the tool.
Contact Microsoft Phone Numbers, Support Options and Pricing, Online Help, and more.
Customer Service For non-technical assistance with product purchases, subscriptions, online services, events, training courses, corporate sales, piracy issues, and more.
Newsgroups Pose a question to other users. Discussion groups and Forums about specific Microsoft products, technologies, and services.
Download
the 890830 package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en)
Back to the top
, and then click Start Search.
