__NOTOC__
Microsoft Windows Malicious Software Removal Tool is a
freely distributed virus removal tool developed by
Microsoft
Microsoft Corporation is an American multinational technology corporation producing computer software, consumer electronics, personal computers, and related services headquartered at the Microsoft Redmond campus located in Redmond, Washin ...
for the
Microsoft Windows operating system. First released on January 13, 2005,
it is an on-demand anti-virus tool ("on-demand" means it lacks
real-time protection) that scans the computer for specific widespread
malware and tries to eliminate the infection. It is automatically distributed to Microsoft Windows computers via the
Windows Update
Windows Update is a Microsoft service for the Windows 9x and Windows NT families of operating system, which automates downloading and installing Microsoft Windows software updates over the Internet. The service delivers software updates for Wind ...
service but can also be separately downloaded from the Microsoft Download Center.
Reporting
The tool records its results in a log file located at ''%windir%\debug\mrt.log''.
To run it manually at other times, users can use the
Windows Command Prompt
Command Prompt, also known as cmd.exe or cmd, is the default command-line interpreter for the OS/2, eComStation, ArcaOS, Microsoft Windows (Windows NT family and Windows CE family), and ReactOS operating systems. On Windows CE .NET 4.2, W ...
or
Run command
The Run command on an operating system such as Microsoft Windows and Unix-like systems is used to directly open an application or document whose path is known.
Overview
The command functions more or less like a single-line command-line interfa ...
via the
Start Menu
The Start menu is a graphical user interface element used in Microsoft Windows since Windows 95 and in other operating systems. It provides a central launching point for computer programs and performing other tasks in the Windows shell. It is name ...
or the Windows + R key, and then start "mrt.exe". For example:
+%windir%\system32\mrt.exe
The tool is configured to report anonymized data about any detected infections to Microsoft.
The reporting behavior is disclosed in the tool's
EULA
An end-user license agreement or EULA () is a legal contract between a software supplier and a customer or end-user, generally made available to the customer via a retailer acting as an intermediary. A EULA specifies in detail the rights and restr ...
, and can be disabled if desired.
Results
In a June 2006 Microsoft report,
the company claimed that the tool had removed 16 million instances of malicious software from 5.7 million of 270 million total unique Windows computers since its release in January 2005. The report also stated that, on average, the tool removes malicious software from 1 in every 311 computers on which it runs. On May 19, 2009, Microsoft claimed that the software has removed
password stealer threats from 859,842 machines.
In August 2013, the Malicious Software Removal Tool deleted old, vulnerable versions of the
Tor client to end the spread of the
Sefnit botnet (which mined for
bitcoins without the host owner's approval and later engaged in
click fraud
Click, Klick and Klik may refer to:
Airlines
* Click Airways, a UAE airline
* Clickair, a Spanish airline
* MexicanaClick, a Mexican airline
Art, entertainment, and media Fictional characters
* Klick (fictional species), an alien race in t ...
). Approximately two million hosts had been cleaned by October; although this was slightly less than half of the estimated infections, the rest of the suspected machines presumably did not have their automatic Windows Updates enabled or manually run.
Compatibility and updates
Microsoft releases the updated tool every second Tuesday of every month (commonly called "
Patch Tuesday
Patch Tuesday (also known as Update Tuesday) is an unofficial term used to refer to when Microsoft, Adobe, Oracle and others regularly release software patches for their software products. It is widely referred to in this way by the industry. Micr ...
") through Windows Update, at which point it runs once automatically in the background and reports if malicious software is found. The tool is also available as a standalone download.
Since support for Windows 2000 ended on July 13, 2010, Microsoft stopped distributing the tool to Windows 2000 users via Windows Update. The last version of the tool that could run on Windows 2000 was 4.20, released on May 14, 2013. Starting with version 5.1, released on June 11, 2013, support for Windows 2000 was dropped altogether. Although
Windows XP
Windows XP is a major release of Microsoft's Windows NT operating system. It was released to manufacturing on August 24, 2001, and later to retail on October 25, 2001. It is a direct upgrade to its predecessors, Windows 2000 for high-end and ...
support ended on April 8, 2014, updates for the Windows XP version of the Malicious Software Removal Tool would be provided until August, 2016; version 5.39. The latest version of MSRT for Windows Vista is 5.47, released on 11 April 2017.
Despite Microsoft ending general support for the Windows 7 operating system in 2020, updates are still provided to Windows 7 users via the standard Windows Update delivery mechanism.
References
Further reading
*
*
External links
*
{{Microsoft Security Products
Microsoft software
Spyware removal
2005 software