Deployment of the Microsoft Windows Malicious Software Removal Tool in an enterprise environment

• Windows Server Update Services
• Microsoft Systems Management Software (SMS) software package
• Group Policy-based computer startup script
• Group Policy-based user logon script

• Windows Update Catalog
• Execution of the tool against a remote computer
• Software Update Services (SUS)

Back to the top

Code sample

• Runs the tool in silent mode
• Copies the log file to a preconfigured network share
• Prefixes the log file name with the name of the computer from which the tool is executed and with the user name of the current user. You must set appropriate permissions on the share according to the instructions in the Initial setup and configuration section.

REM In this example, the script is named RunMRT.cmd.
REM The Sleep.exe utility is used to delay the execution of the tool when used as a 
REM startup script. See the "Known issues" section for details.
@echo off
call \\ServerName\ShareName\Sleep.exe 5
Start /wait \\ServerName\ShareName\Windows-KB890830-V3.0.exe /q

copy %windir%\debug\mrt.log \\ServerName\ShareName\Logs\%computername%_%username%_mrt.log

Back to the top

Initial setup and configuration

1. Set up a share on a member server. Then name the share ShareName.
2. Copy the tool and the sample script, RunMRT.cmd, to the share. See the Code sample section for details.
3. Configure the following share permissions and NTFS file system permissions:
   • Share permissions:
     1. Add the domain user account for the user who is managing this share, and then click Full Control.
     2. Remove the Everyone group.
     3. If you use the computer startup script method, add the Domain Computers group together with Change and Read permissions.
     4. If you use the logon script method, add the Authenticated Users group together with Change and Read permissions.
   • NTFS permissions:
     1. Add the domain user account for the user who is managing this share, and then click Full Control.
     2. Remove the Everyone group if it is in the list.
        
        Note If you receive an error message when you remove the Everyone group, click Advanced on the Security tab, and then click to clear the Allow inheritable permissions from parent to propagate to this object check box.
     3. If you use the computer startup script method, grant the Domain Computers group Read & Execute permissions, List Folder Contents permissions, and Read permissions.
     4. If you use the logon script method, grant the Authenticated Users group Read & Execute permissions, List Folder Contents permissions, and Read permissions.
4. Under the ShareName folder, create a folder that is named "Logs."
   
   This folder is where the final log files will be collected after the tool runs on the client computers.
5. To configure the NTFS permissions on the Logs folder, follow these steps.
   
   Note Do not change the Share permissions in this step.
   1. Add the domain user account for the user who is managing this share, and then click Full Control.
   2. If you use the computer startup script method, give the Domain Computers group Modify permissions, "Read & Execute" permissions, List Folder Contents permissions, Read permissions, and Write permissions.
   3. If you use the logon script method, give the Authenticated Users group Modify permissions, "Read & Execute" permissions, List Folder Contents permissions, Read permissions, and Write permissions.

Back to the top

Deployment methods

How to use the SMS software package

1. Extract the Mrt.exe file from the package that is named Windows-KB890830-V1.34-ENU.exe /x.
2. Create a .bat file to start Mrt.exe and to capture the return code by using ISMIF32.exe.
   
   The following is an example.

   @echo off
   Mrt.exe /q
   If errorlevel 13 goto error13
   If errorlevel 12 goto error12
   Goto end
   
   :error13
   Ismif32.exe –f MIFFILE –p MIFNAME –d ”text about error 13”
   Goto end
   
   :error12
   Ismif32.exe –f MIFFILE –p MIFNAME –d “text about error 12”
   Goto end
   
   :end
   

   For more information about Ismif32.exe, click the following article numbers to view the articles in the Microsoft Knowledge Base:
   268791  (http://support.microsoft.com/kb/268791/ ) How a status Management Information Format (MIF) file produced by the ISMIF32.exe file is processed in SMS 2.0
   186415  (http://support.microsoft.com/kb/186415/ ) Status MIF creator, Ismif32.exe is available
3. To create a package in the SMS 2003 console, follow these steps:
   1. Open the SMS Administrator Console.
   2. Right-click the Packages node, click New, and then click Package.
      
      The Package Properties dialog box is displayed.
   3. On the General tab, name the package.
   4. On the Data Source tab, click to select the This package contains source files check box.
   5. Click Set, and then choose a source directory that contains the tool.
   6. On the Distribution Settings tab, set the Sending priority to High.
   7. On the Reporting tab, click Use these fields for status MIF matching, and then specify a name for the MIF file name field and for the Name field.
      
      Version and Publisher are optional.
   8. Click OK to create the package.
4. To specify a Distribution Point (DP) to the package, follow these steps:
   1. In the SMS 2003 console, locate the new package under the Packages node.
   2. Expand the package. Right-click Distribution Points, point to New, and then click Distribution Points.
   3. Start the New Distribution Points Wizard. Select an existing Distribution Point.
   4. Click Finish to close the wizard.
5. To add the batch file that was previously created to the new package, follow these steps:
   1. Under the new package node, click the Programs node.
   2. Right-click Programs, point to New, and then click Program.
   3. Click the General tab, and then enter a valid name.
   4. At the Command line, click Browse to select the batch file that you created to start Mrt.exe.
   5. Change Run to Hidden. Change After to No action required.
   6. Click the Requirements tab, and then click This program can run only on specified client operating systems.
   7. Click All x86 Windows 2000, All x86 Windows Server 2003, and All x86 Windows XP.
   8. Click the Environment tab, click Whether a user is logged in the Program can run list. Set the Run mode to Run with administrative rights.
   9. Click OK to close the dialog box.
6. To create an advertisement to advertise the program to clients, follow these steps:
   1. Right-click the Advertisement node, click New, and then click Advertisement.
   2. On the General tab, enter a name for the advertisement. In the Package field, select the package that you previously created. In the Program field, select the program that you previously created. Click Browse, and then click the All System collection or select a collection of computers that only includes Microsoft Windows 2000 and later versions.
   3. On the Schedule tab, leave the default options if you want the program to only run one time. To run the program on a schedule, assign a schedule interval.
   4. Set the Priority to High.
   5. Click OK to create the advertisement.

How to use a Group Policy-based computer startup script

1. Set up the shares. To do this, follow the steps in the Initial setup and configuration section.
2. Set up the startup script. To do this, follow these steps:
   1. In the Active Directory Users and Computers MMC snap-in, right-click the domain name, and then click Properties.
   2. Click the Group Policy tab.
   3. Click New to create a new Group Policy object (GPO), and type MRT Deployment for the name of the policy.
   4. Click the new policy, and then click Edit.
   5. Expand Windows Settings for Computer Configuration, and then click Scripts.
   6. Double-click Logon, and then click Add.
      
      The Add a Script dialog box is displayed.
   7. In the Script Name box, type \\ServerName\ShareName\RunMRT.cmd.
   8. Click OK, and then click Apply.
3. Restart the client computers that are members of this domain.

How to use a Group Policy-based user logon script

1. Set up the shares. To do this, follow the steps in the Initial setup and configuration section.
2. Set up the logon script. To do this, follow these steps:
   1. In the Active Directory Users and Computers MMC snap-in, right-click the domain name, and then click Properties.
   2. Click the Group Policy tab.
   3. Click New to create a new GPO, and then type MRT Deployment for the name.
   4. Click the new policy, and then click Edit.
   5. Expand Windows Settings for User Configuration, and then click Scripts.
   6. Double-click Logon, and then click Add. The Add a Script dialog box is displayed.
   7. In the Script Name box, type \\ServerName\ShareName\RunMRT.cmd.
   8. Click OK, and then click Apply.
3. Log off and then log on to the client computers.

Back to the top

Additional information that is relevant to enterprise deployment

How to examine return codes

How to parse the log file

• This log file is available only in English.
• Starting with version 1.2 of the removal tool (March 2005), this log file uses Unicode text. Before version 1.2, the log file used ANSI text.
• The log file format has changed with version 1.2, and we recommend that you download and use the latest version of the tool.
  
  If this log file already exists, the tool appends to the existing file.
• You can use a command script that resembles the previous example to capture the return code and to collect the files to a network share.
• Because of the switch from ANSI to Unicode, version 1.2 of the removal tool will copy any ANSI versions of the Mrt.log file in the %windir%\debug folder to Mrt.log.old in the same directory. Version 1.2 also creates a new Unicode version of the Mrt.log file in that same directory. Like the ANSI version, this log file will be appended to each month's release.

Microsoft Windows Malicious Software Removal Tool v1.28, April 2007
Started On Mon Mar 19 13:15:07 2007
 
Quick Scan Results:
----------------
Found virus: Win32/Sasser.A.worm in file://C:\WINDOWS\avserve.exe
Found virus: Win32/Sasser.A.worm in regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\avserve.exe
Found virus: Win32/Sasser.A.worm in runkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\avserve.exe
Found virus: Win32/Sasser.A.worm in file://C:\WINDOWS\avserve.exe
 
Quick Scan Removal Results
----------------
Start 'remove' for regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\avserve.exe
Operation succeeded !
 
Start 'remove' for runkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\avserve.exe
Operation succeeded !
 
Start 'remove' for file://\\?\C:\WINDOWS\avserve.exe
Operation succeeded !
 
Results Summary:
----------------
Found Win32/Sasser.A.worm and Removed!
 
Return code: 6
Microsoft Windows Malicious Software Removal Tool Finished On Mon Mar 19 13:15:57 2007

Microsoft Windows Malicious Software Removal Tool v1.2, March 2005
Started On Wed May 01 21:19:01 2002
 
Results Summary:
----------------
No infection found.
 
Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Wed May 01 21:19:05 2002

Microsoft Windows Malicious Software Removal Tool v1.2, March 2005
Started On Wed May 01 21:27:57 2002
 
Scanning Results:
----------------
Found virus: Win32/HLLW.Gaobot.ZF in process 1880
Found virus: Win32/HLLW.Gaobot.ZF in process 1880
Found virus: Win32/HLLW.Gaobot.ZF in file C:\WINDOWS\System32\winsec16.exe
Found virus: Win32/HLLW.Gaobot.ZF in process 1880
Found virus: Win32/HLLW.Gaobot.ZF in process 1880
Found virus: Win32/HLLW.Gaobot.ZF in file C:\WINDOWS\System32\winsec16.exe
Found virus: Win32/HLLW.Gaobot.ZF in file C:\WINDOWS\System32\winsec16.exe
 
Removal Results:
----------------
Terminating process with pid 1880
->Sysclean ERROR: Failed to kill process with PID: 1880 (Win32 Error Code: 0x00000102 (258):The wait operation timed out.) [697]
Operation failed !
 
Terminating process with pid 1880
Operation had previously completed.
 
Terminating process with pid 1880
Operation had previously completed.
 
Deleting registry value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, entry: WinSec
Operation succeeded !
 
Terminating process with pid 1880
Operation had previously completed.
 
Deleting registry value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, entry: WinSec
Operation succeeded !
 
Writing in file C:\WINDOWS\system32\drivers\etc\hosts
Operation succeeded !
 
Deleting file C:\WINDOWS\System32\winsec16.exe
Operation succeeded !
 
Deleting file C:\WINDOWS\System32\winsec16.exe
Operation had previously completed.
 
Deleting file C:\WINDOWS\System32\winsec16.exe
Operation had previously completed.
 

Results Summary:
----------------
For cleaning Win32/HLLW.Gaobot.ZF, the system must be restarted.
Found Win32/HLLW.Gaobot.ZF, partially removed.

Back to the top

Known issues

Back to the top

FAQ

Back to the top