Malicious Software Removal Tool

How to Use the Malicious Software Removal Tool in Vista​

   Information

This will show you how to open and use the Malicious Software Removal Tool (MRT) to manually run scans for and automatically remove malicious software.

For more information and FAQs about the Malicious Software Removal Tool, please read:
The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows 7, Windows Vista, Windows Server 2003, Windows Server 2008, Windows XP, or Windows 2000

   Tip

• The Microsoft Malicious Software Removal Tool is normally installed and updated on the second Tuesday of every month by the KB890830 Windows Update.
• After a scan with MRT, the scan log is located at: C:\Windows\Debug\mrt.log
• After a scan with MRT, yhe event log is located at: C:\Windows\Debug\mrteng.log

   Note

The Malicious Software Removal Tool normally runs in quiet mode. If it detects malicious software on your computer, the next time that you log on to your computer as a computer administrator, a balloon will appear in the notification area to make you aware of the detection and prompt you to run a full scan.

   Warning

The Microsoft Malicious Software Removal Tool does not replace an antivirus program. It is strictly a post-infection removal tool. Therefore, it is strongly recommend that you install and use an up-to-date antivirus program.

The Microsoft Malicious Software Removal Tool differs from an antivirus program in three key ways:

• The tool removes malicious software from an already-infected computer. Antivirus products block malicious software from running on a computer. It is significantly more desirable to block malicious software from running on a computer than to remove it after infection.
• The tool removes only specific, prevalent malicious software. Specific, prevalent malicious software is a small subset of all the malicious software that exists today.
• The tool focuses on the detection and removal of active malicious software. Active malicious software is malicious software that is currently running on the computer. The tool cannot remove malicious software that is not running. However, an antivirus product can perform this task.

Here's How:

   Note

The Windows Malicious Software Removal Tool - (KB89030) Windows Update will need to be installed first before you will have it available in Windows Vista.



If not, then you can also download and install it manually from Microsoft at:

• Download details: Microsoft® Windows® Malicious Software Removal Tool (KB890830)
• Download details: Microsoft® Windows® Malicious Software Removal Tool (KB890830) x64

1. Open the Start Menu.​

​

2. In the white line (Start Search) area, type mrt.exe and press Enter. (See screenshot below)​

NOTE: You can also type mrt.exe in the RUN window. This file is located at C:\Windows\System32\mrt.exe.​

​

​

3. If prompted by UAC, click on Continue.​

​

4. Click on the Next button. (See screenshot below)​

​

​

5. Select and dot the type of scan you would like to run and click on Next. (See screenshot below)​

​

​

6. It will now start the scan and can take a bit to finish depending on what scan type you selected in step 5. (See screenshot below)​

​

​

7. When finished, it will report the scan results. (See screenshot below step 8)​

​

8. Click on the Finish button when you are ready to close the Microsoft Malicious Software Removal Tool window.​

NOTE: To see detailed scan results, click on the View detailed results of the scan link.​

​

​

   Tip

How to Run the "Windows Malicious Software Removal Tool" from the Command Prompt​

In a command prompt, type mrt.exe followed by one of the switches below. For example, type mrt.exe /F:Y to run a full scan and automatically clean the infected files.

That's it,
Shawn

Related Tutorials

---

• How to Use the Microsoft Safety Scanner
• Enhanced Mitigation Experience Toolkit (EMET)
• How to Install and Use Microsoft Security Essentials

 

[jakeers]

Hello Jakeers,

Yes. You can right click on the C:\Windows\System32\mrt.exe file and click on Send To - Desktop (Create shortcut). From there you can move the shortcut into the Start Menu.

Hope this helps,
Shawn

sorry for extreme late reply....vacation hit me....thanks much Shawn, works like a charm.
jakeers

 

[Brink]

You're welcome Jakeers. I'm happy to hear that you got it sorted out.

 

[Sicknerd]

hey Brink (or anyone who can answer this question).
How efficient is this tool? and what type of software does it detect and if does detect, what will it do to it?

 

[Brink]

Hello Sicknerd,

As long as you keep it's definititions updated through Windows Updates, it can be very efficient if needed. It is for removing malware that has been detected on your computer. If malware is detected, the tool prompts you to remove the malicious software from those files.

For more detailed information on this though, see the link in the green Information box at the top of the tutorial.

Hope this helps,
Shawn

 

[dinesh]

Can we install malicious software removal tool in windows 7?

 

[Brink]

Hi Dinesh,

Sorry, but it's not supported in Windows 7.

 

[Airbot]

Hi guys,

I've been downloading it monthly and running it in Windows 7 since the Beta 7000. Installs and scans as it does in Vista, without problems for me. Just won't get it thru WU in Win7 yet though.

Windows MSRT x86

Windows MSRT x64

 

[Brink]

Aaron, I think that MSE (Microsoft Security Esentials) will be replacing it in Windows 7 eventually though. It's good to know that you can manually update it though like that.

 

[Airbot]

Oh, yeah, you're probably right. Like it will replace Win Defender too. I don't think it updates in Win7, you could just download the tool every month if you wanted, and run it monthly after they update the tool on the website.

 

[Brink]

Yep, it most likely will to since it turns Windows Defender off when MSE is installed.

 

[kavita]

Hi Shawn, i guess you still use Avast for your computer?

 

[Brink]

Hi Kavita,

I'm using MSE instead right now since I'm testing it, but I would still recommend Avast to anyone though.

 

[kavita]

I too have used MSE but due to limited features, i switched to ESET Smart Security.
So did you like it? Do you think its better than Avast?

 

[Brink]

No yet, Avast has a lot more features.

 

[keyboard]

Mr Shawn,you are an excellent person along with Your forum.It is like one of the wonders of the world for people like us.It is very easy to understand and very helpful.Keep up the good work.

 

[anonprivate]

Hi,

Is there a log for this programme's activity?

Thanks

A

 

[Brink]

Hello Anonprivate,

Yes, it has these two log files.

The scan log is located at: C:\Windows\Debug\mrt.log

The event log is located at: C:\Windows\Debug\mrteng.log

 

[anonprivate]

Hi,

Thanks for responding.

I can't get much information from the logs.

mrt.log says that no infection found, which is good news. But there is also a note that says: scan error: resource process //pid followed by a number and code!

mrteng.log just tells me that a scan was started and finished on a date and times .

Any idea how I can interpret these logs. I have opened documents from the Web usining IE9 which scanned them for some seconds before opening. The logs only mentioned scans that lasted for say a couple of minutes. These scans were too long to represent the files downloaded using IE9! Since I get an error message in mrt.log does this mean that mrt.exe is not functioning properly?

Thanks.

Best wishes.

A

 

[Brink]

anonprivate,

Getting an error message could mean anything from it just not being able to run the scan at the moment, or more. You might Google the error code to see if it may be able to tell you more about what it means. Could you also post the full log here? We might be able to help with it.

For everyday malware protection, I would recommend to also run something like the free MSE as well.

 

[anonprivate]

Thanks for responding.

I'll try and Google the error codes and see what I can find.

Best wishes.

A