Article ID: 890830 - View products that this article applies to.
Expand all | Collapse all

On This Page

Summary

The Microsoft Windows Malicious Software Removal Tool helps remove malicious software from your computers that are running Windows 8, Windows Server 2012, Windows 7, Windows Vista, Windows Server 2003, Windows Server 2008, or Windows XP.

Microsoft releases a new version of the Microsoft Malicious Software Removal Tool every month. After you download the tool, the tool runs one time to check your computer for infection by specific prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps remove any infection it finds.

This article contains information about how the tool differs from an antivirus product, how you can download and run the tool, and what happens when the tool finds malicious software on your computer. The advanced user section includes information for the IT administrator and additional information about how to manage and run the Malicious Software Removal Tool.

Collapse this imageExpand this image
2683283
Note In compliance with the Microsoft Support Lifecycle policy, the Windows Malicious Software Removal Tool (MSRT) will no longer be offered to or supported on Windows 2000-based systems after July 13, 2010. This date coincides with the end of the Extended Support phase for Windows 2000. For more information about the Support Lifecycle policy, go to the Microsoft Support Lifecycle website.

More information

How the Microsoft Malicious Software Removal Tool differs from an antivirus product

Collapse this imageExpand this image
assets folding start collapsed
The Microsoft Malicious Software Removal Tool does not replace an antivirus product. It is strictly a post-infection removal tool. Therefore, we strongly recommend that you install and use an up-to-date antivirus product.

The Microsoft Malicious Software Removal Tool differs from an antivirus product in three key ways:
  • The tool removes malicious software from an already-infected computer. Antivirus products block malicious software from running on a computer. It is significantly more desirable to block malicious software from running on a computer than to remove it after infection.
  • The tool removes only specific prevalent malicious software. Specific prevalent malicious software is a small subset of all the malicious software that exists today.
  • The tool focuses on the detection and removal of active malicious software. Active malicious software is malicious software that is currently running on the computer. The tool cannot remove malicious software that is not running. However, an antivirus product can perform this task.
For more information about how to protect your computer, go to the Microsoft Safety & Security Center website.


Collapse this imageExpand this image
2683283
Note The Microsoft Malicious Software Removal Tool focuses on the detection and removal of malicious software such as viruses, worms, and Trojan horses only. It does not remove spyware. However, you can use Microsoft Security Essentials to detect and remove spyware.
click here to download Microsoft Security Essentials
You do not have to disable or remove your antivirus program when you install the Microsoft Malicious Software Removal Tool. However, if prevalent, malicious software has infected your computer, the antivirus program may detect this malicious software and may prevent the removal tool from removing it when the removal tool runs. In this case, you can use your antivirus program to remove the malicious software.

Because the Microsoft Malicious Software Removal Tool does not contain a virus or a worm, the removal tool alone should not trigger your antivirus program. However, if malicious software infected the computer before you installed an up-to-date antivirus program, your antivirus program may not detect this malicious software until the tool tries to remove it.
Collapse this imageExpand this image
assets folding end collapsed

How to download and run the Microsoft Malicious Software Removal Tool

Collapse this imageExpand this image
assets folding start collapsed
You can download and run the Microsoft Malicious Software Removal Tool if your computer is running Windows 7, Windows Vista, Windows Server 2003, or Windows XP.

Collapse this imageExpand this image
2683283
Note You cannot download and run the tool if you are running Microsoft Windows 98, Windows Millennium Edition, or Microsoft Windows NT 4.0.

The easiest way to download and run the tool is to turn on Automatic Updates. Turning on Automatic Updates guarantees that you receive the tool automatically every month. If you have Automatic Updates turned on, you have already been receiving new versions of this tool monthly. The tool runs in quiet mode unless it finds an infection. If you have not been notified of an infection, no malicious software has been found that needs your attention.

Collapse this imageExpand this image
2683283
Note If your computer is running Windows XP Service Pack 2 (SP2), Automatic Updates is turned on by default.

Are you unsure whether Automatic Updates is turned on? Follow these steps to determine whether Automatic Updates is turned on: Turn on Windows Automatic Update. To have us turn on Automatic Updates for you, go to the "Fix it for me" section. If you would rather turn on Automatic Updates yourself, go to the "Let me fix it myself" section.

Fix it for me

To fix this problem automatically, click the Fix this problem link. Then click Run in the File Download dialog box, and follow the steps in this wizard.
Collapse this tableExpand this table
Turn Automatic Updates onTurn Automatic Updates off
Fix this problem
Microsoft Fix it 50362
Fix this problem
Microsoft Fix it 50363


Collapse this imageExpand this image
2683283
Note This wizard may be in English only. However, the automatic fix also works for other language versions of Windows.

Collapse this imageExpand this image
2683283
Note If you are not on the computer that has the problem, you can save the automatic fix to a flash drive or to a CD, and then you can run it on the computer that has the problem.

Let me fix it myself

To turn on Automatic Updates yourself, follow the steps in the following table for the operating system that your computer is running:
Collapse this tableExpand this table
If your computer is runningFollow these steps:
Windows 7
  1. Click Start
    Collapse this imageExpand this image
    Start
button
    , point to All Programs, and then click Windows Update.
  2. In the left pane, click Change settings.
  3. Click to select Install updates automatically (recommended).
  4. Under Recommended updates, click to select the Give me recommended updates the same way I receive important updates check box, and then click OK. If you are prompted for an administrative password or for confirmation, type the password or provide confirmation. Go to step 3.
Windows Vista
  1. Click Start
    Collapse this imageExpand this image
    Start
button
    , point to All Programs, and then click Windows Update.
  2. In the left pane, click Change settings.
  3. Click to select Install updates automatically (recommended).
  4. Under Recommended updates, click to select the Include recommended updates when downloading, installing, or notifying me about updates check box, and then click OK. If you are prompted for an administrative password or for confirmation, type the password or provide confirmation. Go to step 3.
Windows XP, or Windows Server 2003
  1. Click Start, click Control Panel, and then click Performance and Maintenance.
  2. Click System. The System Properties box appears.
  3. On the Automatic Updates tab, click to select the Automatic (recommended) check box is selected, and then click OK.

Video: How to turn on Automatic Updates in Windows 7


Collapse this imageExpand this image
assets video1
uuid=beba3f86-dff1-4b23-baaa-d94f400b2d1f
Collapse this imageExpand this image
assets video2


Download the Malicious Software Removal Tool. You must accept the Microsoft Software License Terms. The license terms are only displayed for the first time that you access Automatic Updates.

Collapse this imageExpand this image
2683283
Note After you accept the one-time license terms, you can receive future versions of the Malicious Software Removal Tool without being logged on to the computer as an administrator.
Collapse this imageExpand this image
assets folding end collapsed

When the Malicious Software Removal Tool detects malicious software

Collapse this imageExpand this image
assets folding start collapsed
The Malicious Software Removal Tool runs in quiet mode. If it detects malicious software on your computer, the next time that you log on to your computer as a computer administrator, a balloon will appear in the notification area to make you aware of the detection.

Performing a full scan

If the tool finds malicious software, you may be prompted to perform a full scan. We recommend that you perform this scan. A full scan performs a quick scan and then a full scan of the computer, regardless of whether malicious software is found during the quick scan. This scan can take several hours to complete because it will scan all fixed and removable drives. However, mapped network drives are not scanned.

Removing malicious files

If malicious software has modified (infected) files on your computer, the tool prompts you to remove the malicious software from those files. If the malicious software modified your browser settings, your homepage may be changed automatically to a page that gives you directions on how to restore these settings.

You can clean specific files or all the infected files that the tool finds. Be aware that some data loss is possible during this process. Also, be aware that the tool may be unable to restore some files to the original, pre-infection state.

The removal tool may request that you restart your computer to complete the removal of some malicious software, or it may prompt you to perform manual steps to complete the removal of the malicious software. To complete the removal, you should use an up-to-date antivirus product.

Reporting infection information to Microsoft

The Malicious Software Removal Tool will send basic information to Microsoft if the tool detects malicious software or finds an error. This information will be used for tracking virus prevalence. No identifiable personal information that is related to you or to the computer is sent together with this report.
Collapse this imageExpand this image
assets folding end collapsed

How to remove the Malicious Software Removal Tool

Collapse this imageExpand this image
assets folding start collapsed
The Malicious Software Removal Tool does not use an installer. Typically, when you run the Malicious Software Removal Tool, it creates a randomly named temporary directory on the root drive of the computer. This directory contains several files, and it includes the Mrtstub.exe file. Most of the time, this folder is automatically deleted after the tool finishes running or after the next time that you start the computer. However, this folder may not always be automatically deleted. In these cases, you can manually delete this folder, and this has no adverse effect on the computer.
Collapse this imageExpand this image
assets folding end collapsed

How to receive support

Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center
Security solutions for IT professionals: TechNet Security Troubleshooting and Support
Help installing updates: Support for Microsoft Update
Local support according to your country: International Support.

More information for advanced users

Click here to show/hide solution

Properties

Article ID: 890830 - Last Review: November 11, 2014 - Revision: 142.0
Applies to
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Home Edition
  • Windows Vista Home Basic
  • Windows Vista Home Premium
  • Windows Vista Business
  • Windows Vista Enterprise
  • Windows Vista Ultimate
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Windows Server 2008 Standard
  • Windows Server 2008 Enterprise
  • Windows 7 Enterprise
  • Windows 7 Enterprise N
  • Windows 7 Home Basic
  • Windows 7 Home Premium
  • Windows 7 Home Premium N
  • Windows 7 Professional
  • Windows 7 Professional N
  • Windows 7 Starter
  • Windows 7 Starter N
  • Windows 7 Ultimate
  • Windows 7 Ultimate N
  • Windows 8
  • Windows 8 Enterprise
  • Windows 8 Pro
  • Windows Server 2012 Datacenter
  • Windows Server 2012 Essentials
  • Windows Server 2012 Foundation
  • Windows Server 2012 Standard
Keywords: 
kbmsnpartnerportal kbhowto kbacwsurvey kbsecurity kbinfo kbfixme kbmsifixme kbvideocontent KB890830

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com