Microsoft Windows Malicious Software Removal Tool (MSRT) is a
freeware
Freeware is software, often proprietary, that is distributed at no monetary cost to the end user. There is no agreed-upon set of rights, license, or EULA that defines ''freeware'' unambiguously; every publisher defines its own rules for the free ...
second-opinion malware scanner that
Microsoft
Microsoft Corporation is an American multinational corporation and technology company, technology conglomerate headquartered in Redmond, Washington. Founded in 1975, the company became influential in the History of personal computers#The ear ...
's
Windows Update
Windows Update is a Microsoft service for the Windows 9x and Windows NT families of the Microsoft Windows operating system, which automates downloading and installing Microsoft Windows software updates over the Internet. The service delivers sof ...
downloads and runs on
Windows
Windows is a Product lining, product line of Proprietary software, proprietary graphical user interface, graphical operating systems developed and marketed by Microsoft. It is grouped into families and subfamilies that cater to particular sec ...
computers each month, independent of the installed antivirus software. First released on January 13, 2005,
MSRT does not offer
real-time protection. It scans its host computer for specific, widespread
malware
Malware (a portmanteau of ''malicious software'')Tahir, R. (2018)A study on malware and malware detection techniques . ''International Journal of Education and Management Engineering'', ''8''(2), 20. is any software intentionally designed to caus ...
, and tries to eliminate the infection. Outside its monthly deployment schedule, it can be separately downloaded from Microsoft.
Availability
Since its January 13, 2005,
Microsoft releases the updated tool every second Tuesday of every month (commonly called "
Patch Tuesday
Patch Tuesday (also known as Update Tuesday) is an unofficial term used to refer to when Microsoft, Adobe, Oracle and others regularly release software patches for their software products. It is widely referred to in this way by the industry. Micro ...
") through Windows Update, at which point it runs once automatically in the background and reports if malicious software is found. The tool is also available as a standalone download.
Since support for
Windows 2000
Windows 2000 is a major release of the Windows NT operating system developed by Microsoft, targeting the server and business markets. It is the direct successor to Windows NT 4.0, and was Software release life cycle#Release to manufacturing (RT ...
ended on July 13, 2010, Microsoft stopped distributing the tool to Windows 2000 users via Windows Update. The last version of the tool that could run on Windows 2000 was 4.20, released on May 14, 2013. Starting with version 5.1, released on June 11, 2013, support for Windows 2000 was dropped altogether. Although
Windows XP
Windows XP is a major release of Microsoft's Windows NT operating system. It was released to manufacturing on August 24, 2001, and later to retail on October 25, 2001. It is a direct successor to Windows 2000 for high-end and business users a ...
support ended on April 8, 2014, updates for the Windows XP version of the Malicious Software Removal Tool would be provided until August, 2016; version 5.39. The latest version of MSRT for
Windows Vista
Windows Vista is a major release of the Windows NT operating system developed by Microsoft. It was the direct successor to Windows XP, released five years earlier, which was then the longest time span between successive releases of Microsoft W ...
is 5.47, released on 11 April 2017.
Despite Microsoft ending general support for the
Windows 7
Windows 7 is a major release of the Windows NT operating system developed by Microsoft. It was Software release life cycle#Release to manufacturing (RTM), released to manufacturing on July 22, 2009, and became generally available on October 22, ...
operating system in 2020, updates are still provided to Windows 7 users via the standard Windows Update delivery mechanism.
Operation
MSRT does not install a
shortcut
Shortcut may refer to:
Navigation
* Rat running or shortcut, a minor-road alternative to a signposted route
* File shortcut, a handle which allows the user to find a file or resource located in a different directory or folder on a computer
* Key ...
in the Start menu. Hence, users must manually execute
%windir%\System32\MRT.exe. The tool records its results in a log file located at
%windir%\debug\mrt.log.
The tool reports anonymized data about any detected infections to Microsoft.
MSRT's
EULA
An end-user license agreement or EULA () is a legal contract between a software supplier and a customer or end-user.
The practice of selling licenses to rather than copies of software predates the recognition of software copyright, which has ...
discloses this reporting behavior and explains how to disable it.
Impact
In a June 2006 Microsoft report,
the company claimed that the tool had removed 16 million instances of malicious software from 5.7 million of 270 million total unique Windows computers since its release in January 2005. The report also stated that, on average, the tool removes malicious software from 1 in every 311 computers on which it runs. On May 19, 2009, Microsoft claimed that the software has removed
password stealer threats from 859,842 machines.
In August 2013, the Malicious Software Removal Tool deleted old, vulnerable versions of the
Tor
Tor, TOR or ToR may refer to:
Places
* Toronto, Canada
** Toronto Raptors
* Tor, Pallars, a village in Spain
* Tor, former name of Sloviansk, Ukraine, a city
* Mount Tor, Tasmania, Australia, an extinct volcano
* Tor Bay, Devon, England
* Tor ...
client to end the spread of the
Sefnit botnet (which mined for
bitcoin
Bitcoin (abbreviation: BTC; Currency symbol, sign: ₿) is the first Decentralized application, decentralized cryptocurrency. Based on a free-market ideology, bitcoin was invented in 2008 when an unknown entity published a white paper under ...
s without the host owner's approval and later engaged in
click fraud). Approximately two million hosts had been cleaned by October;
although this was slightly less than half of the estimated infections, the rest of the suspected machines presumably did not have their automatic Windows Updates enabled or manually run.
References
Further reading
*
External links
*
{{Microsoft Security Products
Microsoft software
Spyware removal
2005 software