Remove specific prevalent malware with Windows Malicious Software Removal Tool

Applies to: Windows

Summary


The Windows Malicious Software Removal Tool (MSRT) helps remove malicious software from computers that are running Windows 10, Windows 8.1, Windows Server 2012 R2, Windows 8, Windows Server 2012, Windows 7, or Windows Server 2008.

Microsoft generally releases the MSRT monthly as part of Windows Update or as the standalone tool. Use this tool to find and remove specific prevalent threats and reverse the changes they have made (see covered malware families). For comprehensive malware detection and removal, consider using Microsoft Safety Scanner.

This article contains information about how the tool differs from an antivirus or antimalware product, how you can download and run the tool, what happens when the tool finds malware, and tool release information. It also includes information for the administrators and advanced users, including information about supported command-line switches.

More information


How to receive support

Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center
Help installing updates: Support for Microsoft Update
Local support according to your country: International Support.
 

Microsoft Download Center

You can manually download the MSRT from the Microsoft Download Center. The following files are available for download from the Microsoft Download Center:

For 32-bit x86-based systems:
 
For 64-bit x64-based systems:
 


Release Date: June 11, 2019. 

For more information about how to download Microsoft support files, see How to obtain Microsoft support files from online services.

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Deploying the MSRT in an enterprise environment

If you are an IT administrator who wants more information about how to deploy the tool in an enterprise environment, see Deploy Windows Malicious Software Removal Tool in an enterprise environment.

This article includes information about Microsoft Systems Management Server (SMS), Microsoft Software Update Services (MSUS), and Microsoft Baseline Security Analyzer (MBSA).

Prerequisites for running the MSRT

Except where noted, the information in this section applies to all the ways that you can download and run the MSRT:
  • Microsoft Update
  • Windows Update
  • Automatic Updates
  • The Microsoft Download Center
  • The MSRT website on Microsoft.com
To run the MSRT, the following conditions are required:
  • The computer must be running a supported version of Windows.
  • You must log on to the computer by using an account that is a member of the Administrators group. If your logon account does not have the required permissions, the tool exits. If the tool is not being run in quiet mode, it displays a dialog box that describes the failure.
  • If the tool is more than 60 days out of date, the tool displays a dialog box that recommends that you download the latest version of the tool.
     

Support for command-line switches

The MSRT supports the following command line switches.
 
Switch Purpose
/Q or /quiet Uses quiet mode. This option suppresses the user interface of the tool.
/? Displays a dialog box that lists the command-line switches.
/N Runs in detect-only mode. In this mode, malicious software will be reported to the user, but it will not be removed.
/F Forces an extended scan of the computer.
/F:Y Forces an extended scan of the computer and automatically cleans any infections that are found.


Usage and release information

When you download the tool from Microsoft Update or from Automatic Updates, and no malicious software is detected on the computer, the tool will run in quiet mode next time. If malicious software is detected on the computer, the next time that an administrator logs on to the computer, a balloon will appear in the notification area to notify you of the detection. For more information about the detection, click the balloon.

When you download the tool from the Microsoft Download Center, the tool displays a user interface when it runs. However, if you supply the /Q command-line switch, it runs in quiet mode.

Release information

The MSRT is released on the second Tuesday of every month. Each release of the tool helps detect and remove current, prevalent malicious software. This malicious software includes viruses, worms, and Trojan horses. Microsoft uses several metrics to determine the prevalence of a malicious software family and the damage that can be associated with it.

The following table lists the malicious software that the tool can remove. The tool can also remove any known variants at the time of release. The table also lists the version of the tool that first included detection and removal for the malicious software family.

This Microsoft Knowledge Base article will be updated with information for each monthly release so that the number of the relevant article remains the same. The name of the file will be changed to reflect the tool version. For example, the file name of the January 2005 version is Windows-KB890830-ENU.exe, and the file name of the February 2005 version is Windows-KB890830-V1.1-ENU.exe. 

* The severity rating refers to the virus alert severity ratings that appear on the following Microsoft website:

http://www.microsoft.com/technet/security/bulletin/rating.mspx

Be aware that the severity ratings of threats may be updated occasionally to account for changes in prevalence and other factors.

** W32/Hackdef typically hides other potentially unwanted software on the computer. If the cleaner tool reports that W32/Hackdef was detected on the computer, we strongly recommend that you run a scan with up-to-date antivirus and antispyware programs (see http://www.microsoft.com/security/pc-security/spyware-prevent.aspx). If you want to view the software that W32/Hackdef was hiding, first open the log file for the cleaner tool (%Windir%\Debug\Mrt.log). Next, in the "Possible scanning results" section, find the line or lines that note the folder in which Win32/Hackdef was found. In that same folder, you should find the Win32/Hackdef configuration file that has the .ini file name extension. View this file to determine the software that Win32/Hackdef was hiding on the computer.

To scan for and remove more malicious software, use an up-to-date antivirus product. For more information, go to the Microsoft Safety Scanner website.

We maximize customer protection by regularly reviewing and prioritizing our signatures. Each month we add or remove detections as the threat landscape evolves.

Reporting component

The MSRT sends information to Microsoft if it detects malicious software or finds an error. The specific information that is sent to Microsoft consists of the following items:

  • The name of the malicious software that is detected
  • The result of malicious software removal
  • The operating system version
  • The operating system locale
  • The processor architecture
  • The version number of the tool
  • An indicator that notes whether the tool is being run by Microsoft Update, Windows Update, Automatic Updates, the Download Center, or from the website
  • An anonymous GUID
  • A cryptographic one-way hash (MD5) of the path and file name of each malicious software file that is removed from the computer

If apparently malicious software is found on the computer, the tool prompts you to send information to Microsoft beyond what is listed here. You are prompted in each of these instances, and this information is sent only with your consent. The additional information includes the following:

  • The files that are suspected to be malicious software. The tool will identify the files for you.
  • A cryptographic one-way hash (MD5) of any suspicious files that are detected.

You can disable the reporting feature. For information about how to disable the reporting component and how to prevent this tool from sending information to Microsoft, see Deploy Windows Malicious Software Removal Tool in an enterprise environment.
 

Possible scanning results

After the tool runs, there are four main results that the removal tool can report to the user:

  • No infection was found.
  • At least one infection was found and was removed.
  • An infection was found but was not removed.

    Note This result is displayed if suspicious files were found on the computer. To help remove these files, you should use an up-to-date antivirus product.
  • An infection was found and was partially removed.

    Note To complete this removal, you should use an up-to-date antivirus product.
     

Frequently asked questions about the MSRT