The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running supported versions of Windows

Microsoft Download Center
Deploying the Malicious Software Removal Tool in an enterprise environment
Prerequisites for running the Malicious Software Removal Tool
Support for command-line switches
Usage and release information
Reporting component
Possible scanning results
Frequently asked questions about the Malicious Software Removal Tool

This section is intended for advanced computer users. If you are not comfortable with advanced troubleshooting, you might want to ask someone for help or contact support. For more information about how to contact Microsoft support, go to the Microsoft Support website.

Microsoft Download Center

You can manually download the Malicious Software Removal Tool from the Microsoft Download Center. The following files are available for download from the Microsoft Download Center:

For 32-bit x86-based systems:


Download the x86 MSRT package now.


For 64-bit x64-based systems:


Download the x64 MSRT package now.

Release Date: March 12, 2013

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Deploying the Malicious Software Removal Tool in an enterprise environment

If you are an IT administrator who wants more information about how to deploy the tool in an enterprise environment, click the following article number to view the article in the Microsoft Knowledge Base:This article includes information about Microsoft Systems Management Server (SMS), Microsoft Software Update Services (SUS), and Microsoft Baseline Security Analyzer (MBSA).

Prerequisites for running the Malicious Software Removal Tool

Except where noted, the information in this section applies to all the ways that you can download and run the Malicious Software Removal Tool:

• Microsoft Update
• Windows Update
• Automatic Updates
• The Microsoft Download Center
• The Malicious Software Removal Tool website on Microsoft.com

To run the Malicious Software Removal Tool, the following conditions are required:

• The computer must be running Windows 7, Windows Vista, Windows Server 2003, or Windows XP.
• You must log on to the computer by using an account that is a member of the Administrators group. If your logon account does not have the required permissions, the tool exits. If the tool is not being run in quiet mode, it displays a dialog box that describes the failure.
• If the tool is more than 60 days out-of-date, the tool displays a dialog box that recommends that you download the latest version of the tool.

Support for command-line switches

The Malicious Software Removal Tool supports four command-line switches:

Usage and release information

When you download the tool from Microsoft Update or from Automatic Updates, and no malicious software is detected on the computer, the tool will run in quiet mode next time. If malicious software is detected on the computer, the next time that an administrator logs on to the computer, a balloon will appear in the notification area to notify you of the detection. For more information about the detection, click the balloon.

When you download the tool from the Microsoft Download Center, the tool displays a user interface when it runs. However, if you supply the /Q command-line switch, it runs in quiet mode.

Release information

The Malicious Software Removal Tool is released on the second Tuesday of every month. Each release of the tool helps detect and remove current, prevalent malicious software. This malicious software includes viruses, worms, and Trojan horses. Microsoft uses several metrics to determine the prevalence of a malicious software family and the damage that can be associated with it.

The following table lists the malicious software that the tool can remove. The tool can also remove any known variants at the time of release. The table also lists the version of the tool that first included detection and removal for the malicious software family.

Each release of the tool is cumulative. That is, each release not only helps detect and remove new malicious software families, it also helps detect and remove all the malicious software covered in earlier versions. New variants of malicious software that is detected and removed in previous releases are also covered in each monthly release.

This Microsoft Knowledge Base article will be updated with information for each monthly release so that the number of the relevant article remains the same. The name of the file will be changed to reflect the tool version. For example, the file name of the January 2005 version is Windows-KB890830-ENU.exe, and the file name of the February 2005 version is Windows-KB890830-V1.1-ENU.exe. *The severity rating refers to the virus alert severity ratings that appear on the following Microsoft website: Be aware that the severity ratings of threats may be updated occasionally to account for changes in prevalence and other factors.

**W32/Hackdef typically hides other potentially unwanted software on the computer. If the cleaner tool reports that W32/Hackdef was detected on the computer, we strongly recommend that you run a scan with up-to-date antivirus and antispyware programs (see http://www.microsoft.com/security/pc-security/spyware-prevent.aspx). If you want to view the software that W32/Hackdef was hiding, first open the log file for the cleaner tool (%Windir%\Debug\Mrt.log). Next, in the "Possible scanning results" section, find the line or lines that note the folder in which Win32/Hackdef was found. In that same folder, you should find the Win32/Hackdef configuration file that has the .ini file name extension. View this file to determine the software that Win32/Hackdef was hiding on the computer.

Any malicious software that is not listed in this table is not detected and not removed by the tool. To scan for and remove other malicious software, use an up-to-date antivirus product. For more information, go to the following Microsoft Protect Your PC website:

Reporting component

The Malicious Software Removal Tool sends information to Microsoft if it detects malicious software or finds an error. The specific information that is sent to Microsoft consists of the following items:

• The name of the malicious software that is detected
• The result of malicious software removal
• The operating system version
• The operating system locale
• The processor architecture
• The version number of the tool
• An indicator that notes whether the tool is being run by Microsoft Update, Windows Update, Automatic Updates, the Download Center, or from the website
• An anonymous GUID
• A cryptographic one-way hash (MD5) of the path and file name of each malicious software file that is removed from the computer

If apparently malicious software is found on the computer, the tool prompts you to send information to Microsoft beyond what is listed here. You are prompted in each of these instances, and this information is sent only with your consent. The additional information includes the following:

• The files that are suspected to be malicious software. The tool will identify the files for you.
• A cryptographic one-way hash (MD5) of any suspicious files that are detected.

You can disable the reporting feature. For information about how to disable the reporting component and how to prevent this tool from sending information to Microsoft, see Microsoft Knowledge Base article

Possible scanning results

After the tool runs, there are four main results that the removal tool can report to the user:

• No infection was found.
• At least one infection was found and was removed.
• An infection was found but was not removed. This result will be displayed if suspicious files were found on the computer. To help remove these files, you should use an up-to-date antivirus product.
• An infection was found and was partially removed. To complete this removal, you should use an up-to-date antivirus product.

Frequently asked questions about the Malicious Software Removal Tool

• Q1: Is this tool digitally signed by Microsoft?
  A1: Yes.
• Q2: What kind of information does the log file contain?
  A2: For information about the log file, see Microsoft Knowledge Base article
  891716

  (http://support.microsoft.com/kb/891716/ )

  Deployment of the Microsoft Windows Malicious Software Removal Tool in an enterprise environment
• Q3: Can this tool be redistributed?
  A3: Yes. Per the terms of this tool's license terms, the tool can be redistributed. However, make sure that you are redistributing the latest version of the tool.
• Q4: How do I know that I am using the latest version of the tool?
  A4: If you are a Windows 7, Windows Vista, Windows XP, or Windows Server 2003 user, use Microsoft Update or the Microsoft Update Automatic Updates functionality to test whether you are using the latest version of the tool. If you have chosen not to use Microsoft Update, and you are a Windows 7, Windows Vista, Windows XP, or Windows Server 2003 Service Pack 1 (SP1) user, use Windows Update. Or, use the Windows Update Automatic Updates functionality to test whether you are using the latest version of the tool. Additionally, you can visit the Microsoft Download Center. Also, if the tool is more than 60 days out-of-date, the tool will remind you to look for a new version of the tool.
• Q5: Will the Microsoft Knowledge Base article number of the tool change with each new version?
  A5: No. The Microsoft Knowledge Base article number for the tool will remain as 890830 for future versions of the tool. The file name of the tool when it is downloaded from the Microsoft Download Center will change with each release to reflect the month and the year when that version of the tool was released.
• Q6: Is there any way I can request that new malicious software be targeted in the tool?
  A6: Currently, no. Malicious software that is targeted in the tool is based on metrics that track the prevalence and damage of malicious software.
• Q7: Can I determine whether the tool has been run on a computer?
  A7: Yes. By checking a registry key, you can determine whether the tool has been run on a computer and which version was the latest version that was used. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
  891716

  (http://support.microsoft.com/kb/891716/ )

  Deployment of the Microsoft Windows Malicious Software Removal Tool in an enterprise environment
• Q8: Why do not I see the tool on Microsoft Update, Windows Update, or Automatic Updates?
  A8: Several scenarios may prevent you from the seeing the tool on Microsoft Update, Windows Update, or Automatic Updates:
  • Only Windows 7, Windows Vista, Windows XP, and Windows Server 2003 SP1 users are offered the tool on Windows Update or Automatic Updates.
  • If you have already run the current version of the tool from Windows Update, Microsoft Update, Automatic Updates, or from either of the other two release mechanisms, it will not be reoffered on Windows Update or Automatic Updates.
  • For Automatic Updates, the first time that you run the tool, you must be logged on as a member of the Administrators group to accept the license terms.
• Q9: How do Microsoft Update, Windows Update, and Automatic Updates determine who is offered the tool?
  A9: All Windows 7, Windows Vista, Windows XP, and Windows Server 2003 users are offered the tool if the following conditions are true:
  • The users are running the latest version of Microsoft Update or the Microsoft Update Automatic Updates feature.
  • The users have not already run the current version of the tool.
  All Windows 7, Windows Vista, Windows XP, and Windows Server 2003 SP1 users are offered the tool if the following conditions are true:
  • The users are not running Microsoft Update.
  • The users are running the latest version of Windows Update or Windows Update Automatic Updates.
  • The users have not already run the current version of the tool.
• Q10: When I look in the log file, it tells me that errors were found during the scan. How do I resolve them?
  A10: For information about the errors, see Microsoft Knowledge Base article
  891717

  (http://support.microsoft.com/kb/891717/ )

  How to troubleshoot an error when you run the Microsoft Windows Malicious Software Removal Tool
• Q11: Will you rerelease the tool even if there are no new security bulletins for a particular month?
  A11: Yes. Even if there are no new security bulletins for a particular month, the Malicious Software Removal Tool will be rereleased with detection and removal support for the latest prevalent malicious software.
• Q12: How do I prevent this tool from being offered to me by using Microsoft Update, Windows Update, or Automatic Updates?
  A12: When you are first offered the Malicious Software Removal Tool from Microsoft Update, Windows Update, or Automatic Updates, you can decline downloading and running the tool by declining the license terms. This decline can apply to only the current version of the tool or to both the current version of the tool and any future versions, depending on the options that you choose. If you have already accepted the license terms and would prefer not to install the tool through Windows Update, click to clear the check box that corresponds to the tool in the Windows Update UI.
• Q13: After I run the tool from Microsoft Update, Windows Update, or Automatic Updates, where are the tool files stored? Can I rerun the tool?
  A13: When it is downloaded from Microsoft Update or from Windows Update, the tool runs only one time each month. To manually run the tool multiple times a month, download the tool from the Download Center or by visiting the Microsoft Safety & Security Center
  (http://www.microsoft.com/security/malwareremove/default.mspx)
  website.
• 
  For an online scan of your system by using the Windows Live OneCare safety scanner, go to the Microsoft Safety Scanner
  (http://safety.live.com)
  website.
  http://safety.live.com

  (http://safety.live.com)
• Q14: Can I run this tool on a Windows Embedded computer?
  A14: Currently, the Malicious Software Removal Tool is not supported on a Windows Embedded computer.
• Q15: Does running of the tool require any security updates to be installed on the computer?
  A15: No. Unlike most previous cleaner tools that were produced by Microsoft, the Malicious Software Removal tool requires no security update prerequisites. However, we strongly recommend that you install all critical updates before you use the tool, to help prevent reinfection by malicious software that takes advantage of security vulnerabilities.
• Q16: Can I deploy this tool by using SUS or SMS? Is it compatible with MBSA?
  A16: For information about how to deploy this tool, see Microsoft Knowledge Base article
  891716

  (http://support.microsoft.com/kb/891716/ )

  Deployment of the Microsoft Windows Malicious Software Removal Tool in an enterprise environment
• Q17: Do I need the previous cleaner tools installed to run the Malicious Software Removal Tool?
  A17: No.
• Q18: Is there a newsgroup available to discuss this tool?
  A18: Yes. You can use the microsoft.public.security.virus newsgroup.
• Q19: Why did the "Windows File Protection" window appear when I ran the tool?
  A19: In some cases, when specific viruses are found on a system, the cleaner tool tries to repair infected Windows system files. Although this action removes the malicious software from these files, it may also trigger the Windows File Protection feature. If you see the Windows File Protection window, we strongly recommend that you follow the directions and insert your Microsoft Windows CD. This will restore the cleaned files to their original, pre-infection state.
• Q20: Are localized versions of this tool available?
  A20: Yes, the tool is available in 24 languages. Before the February 2006 release, each localized version of the tool was available as a separate download. Starting in February 2006, the tool is now offered as a multilingual download. Therefore, only one version of the tool is available, and the appropriate language appears based on the language of the current operating system.
• Q21: I found the Mrtstub.exe file in a randomly named directory on my computer. Is the Mrtstub.exe file a legitimate component of the tool?
  A21: The tool does use a file that is named Mrtstub.exe for certain operations. If you verify that the file is signed by Microsoft, the file is a legitimate component of the tool.
• Q22: Can the MSRT run in safe mode?
  A22: Yes. If you have run MSRT before you start the computer to safe mode, you can access MSRT at %windir%\system32\mrt.exe. Double-click the mrt.exe file to run MSRT, and then follow the on-screen instructions.