Deploy Windows Malicious Software Removal Tool in an enterprise environment (KB891716)

How to use the SMS software package

The following example provides step-by-step instructions for using SMS 2003. The steps for using SMS 2.0 resemble these steps.

1. Extract the Mrt.exe file from the package that is named Windows-KB890830-V5.130.exe /x.

2. Create a .bat file to start Mrt.exe and to capture the return code by using ISMIF32.exe.
   
   The following is an example.

   @echo off
   Start /wait Mrt.exe /q
   If errorlevel 13 goto error13
   If errorlevel 12 goto error12
   Goto end
   
   :error13
   Ismif32.exe –f MIFFILE –p MIFNAME –d ”text about error 13”
   Goto end
   
   :error12
   Ismif32.exe –f MIFFILE –p MIFNAME –d “text about error 12”
   Goto end
   
   :end
   

   For more information about Ismif32.exe, go to the following article in the Microsoft Knowledge Base:

   268791 How a status Management Information Format (MIF) file produced by the ISMIF32.exe file is processed in SMS 2.0

   186415 Status MIF creator, Ismif32.exe is available

3. To create a package in the SMS 2003 console, follow these steps:

   1. Open the SMS Administrator Console.

   2. Right-select the Packages node, select New, and then select Package.
      
      The Package Properties dialog box is displayed.

   3. On the General tab, name the package.

   4. On the Data Source tab, select to select the This package contains source files check box.

   5. Select Set, and then choose a source directory that contains the tool.

   6. On the Distribution Settings tab, set the Sending priority to High.

   7. On the Reporting tab, select Use these fields for status MIF matching, and then specify a name for the MIF file name field and for the
      Name field.
      
      Version and Publisher are optional.

   8. Select OK to create the package.

4. To specify a Distribution Point (DP) to the package, follow these steps:

   1. In the SMS 2003 console, locate the new package under the Packages node.

   2. Expand the package. Right-select Distribution Points, point to New, and then select Distribution Points.

   3. Start the New Distribution Points Wizard. Select an existing Distribution Point.

   4. Select Finish to exit the wizard.

5. To add the batch file that was previously created to the new package, follow these steps:

   1. Under the new package node, select the Programs node.

   2. Right-select Programs, point to New, and then select Program.

   3. Select the General tab, and then enter a valid name.

   4. At the Command line, select Browse to select the batch file that you created to start Mrt.exe.

   5. Change Run to Hidden. Change After to No action required.

   6. Select the Requirements tab, and then select This program can run only on specified client operating systems.

   7. Select All x86 Windows XP.

   8. Select the Environment tab, select Whether a user is logged in the Program can run list. Set the Run mode to Run with administrative rights.

   9. Select OK to close the dialog box.

6. To create an advertisement to advertise the program to clients, follow these steps:

   1. Right-select the Advertisement node, select New, and then select Advertisement.

   2. On the General tab, enter a name for the advertisement. In the Package field, select the package that you previously created. In the Program field, select the program that you previously created. Select Browse, and then select the All System collection or select a collection of computers that only includes Windows Vista and later versions.

   3. On the Schedule tab, leave the default options if you want the program to only run one time. To run the program on a schedule, assign a schedule interval.

   4. Set the Priority to High.

   5. Select OK to create the advertisement.

How to use a Group Policy-based computer startup script

This method requires you to restart the client computer after you set up the script and after you apply the Group Policy setting.

1. Set up the shares. To do this, follow the steps in the Initial setup and configuration section.

2. Set up the startup script. To do this, follow these steps:

   1. In the Active Directory Users and Computers MMC snap-in, right-select the domain name, and then select Properties.

   2. Select the Group Policy tab.

   3. Select New to create a new Group Policy Object (GPO), and type MRT Deployment for the name of the policy.

   4. Select the new policy, and then select Edit.

   5. Expand Windows Settings for Computer Configuration, and then select Scripts.

   6. Double-select Logon, and then select Add.
      
      The Add a Script dialog box is displayed.

   7. In the Script Name box, type \\ServerName\ShareName\RunMRT.cmd.

   8. Select OK, and then select Apply.

3. Restart the client computers that are members of this domain.

How to use a Group Policy-based user logon script

This method requires that the logon user account is a domain account and is a member of the local administrator's group on the client computer.

1. Set up the shares. To do this, follow the steps in the
   Initial setup and configuration section.

2. Set up the logon script. To do this, follow these steps:

   1. In the Active Directory Users and Computers MMC snap-in, right-select the domain name, and then select Properties.

   2. Select the Group Policy tab.

   3. Select New to create a new GPO, and then type MRT Deployment for the name.

   4. Select the new policy, and then select Edit.

   5. Expand Windows Settings for User Configuration, and then select Scripts.

   6. Double-select Logon, and then select Add. The Add a Script dialog box is displayed.

   7. In the Script Name box, type \\ServerName\ShareName\RunMRT.cmd.

   8. Select OK, and then select Apply.

3. Log off and back on to the client computers.

In this scenario, the script and the tool will run under the context of the logged-on user. If this user does not belong to the local administrators group or does not have sufficient permissions, the tool will not run and will not return the appropriate return code. For more information about how to use startup scripts and logon scripts, go to the following article in the Microsoft Knowledge Base:

198642 Overview of logon, logoff, startup, and shutdown scripts in Windows 2000

322241 How to assign scripts in Windows 2000

How to examine return codes

You can examine the return code of the tool in your deployment logon script or in your deployment startup script to verify the results of execution. See the Code sample section for an example of how to do this.

The following list contains the valid return codes.

How to parse the log file

The Malicious Software Removal Tool writes details about the result of its execution in the %windir%\debug\mrt.log log file.

Notes

• This log file is available only in English.

• Starting with version 1.2 of the removal tool (March 2005), this log file uses Unicode text. Before version 1.2, the log file used ANSI text.

• The log file format has changed with version 1.2, and we recommend that you download and use the latest version of the tool.
  
  If this log file already exists, the tool appends to the existing file.

• You can use a command script that resembles the previous example to capture the return code and to collect the files to a network share.

• Because of the switch from ANSI to Unicode, version 1.2 of the removal tool will copy any ANSI versions of the Mrt.log file in the %windir%\debug folder to Mrt.log.old in the same directory. Version 1.2 also creates a new Unicode version of the Mrt.log file in that same directory. Like the ANSI version, this log file will be appended to each month's release.

The following example is an Mrt.log file from a computer that was infected with the MPnTestFile worm:

Microsoft Windows Malicious Software Removal Tool v5.3, August 2013 (build 5.3.9300.0)
Started On Tue Jul 30 23:34:49 2013


Quick Scan Results:
-------------------
Threat Detected: Virus:Win32/MPnTestFile.2004 and Removed!
 Action: Remove, Result: 0x00000000
 regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\v5mpn
 runkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\v5mpn
 file://c:\temp\mpncleantest.exe
 SigSeq: 0x00002267735A46E2

Results Summary:
----------------
Found Virus:Win32/MPnTestFile.2004 and Removed!
Microsoft Windows Malicious Software Removal Tool Finished On Tue Jul 30 23:35:39 2013


Return code: 6 (0x6) 

 

The following is an example log file where no malicious software is found.

Microsoft Windows Malicious Software Removal Tool v5.3, August 2013 (build 5.3.9300.0)
Started On Thu Aug 01 21:15:43 2013


Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Thu Aug 01 21:16:28 2013


Return code: 0 (0x0)
 

The following is a sample log file in which errors are found.

For more information about warnings and errors that are caused by the tool, go to the following article in the Microsoft Knowledge Base:

891717 How to troubleshoot an error when you run the Microsoft Windows Malicious Software Removal Tool Microsoft Windows Malicious Software Removal Tool v5.3, August 2013 (build 5.3.9300.0) Started On Fri Aug 02 16:17:49 2013 Scan Results: ------------- Threat Detected: Virus:Win32/MPTestFile.2004, partially removed. Operation failed. Action: Clean, Result: 0x8007065E. Please use a full antivirus product ! ! file://d:\temp\mpcleantest.7z->mpcleantest.exe SigSeq: 0x00001080D2AE29FC containerfile://d:\temp\mpcleantest.7z Results Summary: ---------------- Found Virus:Win32/MPTestFile.2004, partially removed. Microsoft Windows Malicious Software Removal Tool Finished On Fri Aug 02 16:18:09 2013 Return code: 7 (0x7)

Known issue 1

When you run the tool by using a startup script, error messages that resemble the following error message may be logged in the Mrt.log file:
 

Note The pid number will vary.

This error message occurs when a process is just starting or when a process has been recently stopped. The only effect is that the process that is designated by the pid is not scanned.

Known issue 2

In some rare cases, if an administrator chooses to deploy the MSRT by using the /q quiet switch (also known as silent mode), this may not completely resolve cleaning for a small subset of infections in situations in which additional cleaning is required after a restart. This has been observed only in the removal of certain rootkit variants.