What Is Microsoft Windows Malicious Software Removal Tool

Summary

The Windows Malicious Software Removal Tool (MSRT) helps remove malicious software from computers that are running any of the post-obit operating systems:

Windows 10
Windows Server 2019
Windows Server 2016
Windows 8.1
Windows Server 2012 R2
Windows Server 2012
Windows Server 2008 R2
Windows 7
Windows Server 2008

Microsoft releases the MSRT on a monthly cadence equally part of Windows Update or every bit a standalone tool. Use this tool to discover and remove specific prevalent threats and opposite the changes they have made (encounter covered malware families). For comprehensive malware detection and removal, consider using Windows Defender Offline or Microsoft Safe Scanner.

This article contains information about how the tool differs from an antivirus or antimalware product, how yous tin can download and run the tool, what happens when the tool finds malware, and tool release information. It also includes information for the administrators and advanced users, including information about supported command-line switches.

More information

The MSRT does not supersede an antivirus product. It is strictly a mail-infection removal tool. Therefore, we strongly recommend that you install and use an up-to-appointment antivirus production.

The MSRT differs from an antivirus production in three important means:

The tool removes malicious software from an already-infected computer. Antivirus products block malicious software from running on a computer. It is significantly more desirable to block malicious software from running on a figurer than to remove it after infection.
The tool removes only specific prevalent malicious software. Specific prevalent malicious software is a small-scale subset of all the malicious software that exists today.
The tool focuses on the detection and removal of active malicious software. Active malicious software is malicious software that is currently running on the figurer. The tool cannot remove malicious software that is non running. However, an antivirus production can perform this chore.

For more information about how to protect your computer, go to the Microsoft Safety & Security Center website.

Annotation The MSRT focuses on the detection and removal of malicious software such every bit viruses, worms, and Trojan horses only. It does not remove spyware.

Y'all practise not accept to disable or remove your antivirus program when you install the MSRT. Yet, if prevalent, malicious software has infected your calculator, the antivirus program may observe this malicious software and may preclude the removal tool from removing it when the removal tool runs. In this case, y'all can use your antivirus program to remove the malicious software.

Because the MSRT does not comprise a virus or a worm, the removal tool alone should non trigger your antivirus programme. However, if malicious software infected the estimator before you installed an up-to-date antivirus plan, your antivirus program may not detect this malicious software until the tool tries to remove it.

The easiest way to download and run the MSRT is to turn on Automatic Updates. Turning on Automatic Updates guarantees that you receive the tool automatically. If you lot have Automatic Updates turned on, you lot have already been receiving new versions of this tool. The tool runs in Quiet manner unless it finds an infection. If you have not been notified of an infection, no malicious software has been found that requires your attention.

Enabling automated updates

To turn on Automatic Updates yourself, follow the steps in the following table for the operating organisation that your calculator is running.

If your computer is running:	Follow these steps:
Windows 10	Select the Start button, then selectSettings > Update & security > Windows Update . If you want to check for updates manually, selectCheck for updates. Select Avant-garde options, and so underCull how updates are installed, selectAutomatic (recommended). Note Windows 10 is a service. This ways that automated updates are turned on past default and your PC always has the latest and best features.
Windows 8.one	Open up Windows Update by swiping in from the correct border of the screen (or, if you're using a mouse, pointing to the lower-right corner of the screen and moving the mouse pointer up), selectSettings > Modify PC settings> Update and recovery> Windows Update. If yous want to check for updates manually, selectCheck now. SelectCull how updates get installed, and then underImportant updates, selectInstall updates automatically (recommended). UnderRecommended updates, select theGive me recommended updates the same way I receive important updates check box. UnderMicrosoft Update, select theGive me updates for other Microsoft products when I update Windows check box, and and then selectEmploy.
Windows 7	Click Offset , point to All Programs, and then click Windows Update. In the left pane, click Modify settings. Click to select Install updates automatically (recommended). Nether Recommended updates, click to select the Give me recommended updates the same way I receive of import updates bank check box, and then click OK. If you are prompted for an administrative password or for confirmation, blazon the password or provide confirmation. Go to step 3.

If your computer is running:

Follow these steps:

Windows 10

Select the Start button, then selectSettings > Update & security > Windows Update . If you want to check for updates manually, selectCheck for updates.
Select Avant-garde options, and so underCull how updates are installed, selectAutomatic (recommended).

Note Windows 10 is a service. This ways that automated updates are turned on past default and your PC always has the latest and best features.

Windows 8.one

Open up Windows Update by swiping in from the correct border of the screen (or, if you're using a mouse, pointing to the lower-right corner of the screen and moving the mouse pointer up), selectSettings > Modify PC settings> Update and recovery> Windows Update. If yous want to check for updates manually, selectCheck now.
SelectCull how updates get installed, and then underImportant updates, selectInstall updates automatically (recommended).
UnderRecommended updates, select theGive me recommended updates the same way I receive important updates check box.
UnderMicrosoft Update, select theGive me updates for other Microsoft products when I update Windows check box, and and then selectEmploy.

Windows 7

Click Offset , point to All Programs, and then click Windows Update.
In the left pane, click Modify settings.
Click to select Install updates automatically (recommended).
Nether Recommended updates, click to select the Give me recommended updates the same way I receive of import updates bank check box, and then click OK. If you are prompted for an administrative password or for confirmation, blazon the password or provide confirmation. Go to step 3.

Download the MSRT. You must accept the Microsoft Software License Terms. The license terms are only displayed for the first time that you access Automatic Updates.

Note Afterward you take the one-fourth dimension license terms, you can receive future versions of the MSRT without beingness logged on to the calculator as an administrator.

The MSRT runs in Placidity fashion. If it detects malicious software on your computer, the next time that you log on to your estimator equally a computer administrator, a balloon appears in the notification surface area to make you aware of the detection.

Performing a full scan

If the tool finds malicious software, you may be prompted to perform a full scan. We recommend that you perform this browse. A total browse performs a quick browse and then a full scan of the reckoner, regardless of whether malicious software is found during the quick scan. This browse tin take several hours to consummate considering it will scan all stock-still and removable drives. Yet, mapped network drives are not scanned.

Removing malicious files

If malicious software has modified (infected) files on your computer, the tool prompts you to remove the malicious software from those files. If the malicious software modified your browser settings, your homepage may be changed automatically to a page that gives you directions on how to restore these settings.

Y'all can make clean specific files or all the infected files that the tool finds. Be aware that some data loss is possible during this process. As well, be enlightened that the tool may exist unable to restore some files to the original, pre-infection country.

The removal tool may request that y'all restart your computer to complete the removal of some malicious software, or it may prompt you to perform manual steps to complete the removal of the malicious software. To complete the removal, you should use an upward-to-date antivirus production.

Reporting infection data to Microsoft The MSRT sends bones information to Microsoft if the tool detects malicious software or finds an error. This information will be used for tracking virus prevalence. No identifiable personal information that is related to you or to the computer is sent together with this study.

The MSRT does not use an installer. Typically, when you lot run the MSRT, it creates a randomly named temporary directory on the root drive of the computer. This directory contains several files, and it includes the Mrtstub.exe file. Near of the time, this folder is automatically deleted later on the tool finishes running or after the next fourth dimension that you start the reckoner. Yet, this folder may not ever be automatically deleted. In these cases, y'all tin manually delete this folder, and this has no adverse effect on the estimator.

How to receive support

Help protect your calculator that is running Windows from viruses and malware: Virus Solution and Security Heart

Assist installing updates: Back up for Microsoft Update

Local support according to your country: International Support.

Microsoft Download Centre

You can manually download the MSRT from the Microsoft Download Center. The following files are available for download from the Microsoft Download Center:

For 32-flake x86-based systems:

Download icon Download the x86 MSRT package now.

For 64-bit x64-based systems:

Download icon Download the x64 MSRT package at present.

Release Engagement: April 12, 2022.

For more than information most how to download Microsoft support files, meet How to obtain Microsoft support files from online services.

Microsoft scanned this file for viruses. Microsoft used the almost electric current virus-detection software that was bachelor on the engagement that the file was posted. The file is stored on security-enhanced servers that help prevent whatsoever unauthorized changes to the file.

Deploying the MSRT in an enterprise environment

If yous are an It administrator who wants more information about how to deploy the tool in an enterprise environment, see Deploy Windows Malicious Software Removal Tool in an enterprise environment.

This article includes information nearly Microsoft Systems Management Server (SMS), Microsoft Software Update Services (MSUS), and Microsoft Baseline Security Analyzer (MBSA).

Except where noted, the information in this section applies to all the ways that you can download and run the MSRT:

Microsoft Update
Windows Update
Automatic Updates
The Microsoft Download Eye
The MSRT website on Microsoft.com

To run the MSRT, the post-obit weather are required:

The computer must be running a supported version of Windows.
You must log on to the calculator by using an account that is a member of the Administrators group. If your logon account does not take the required permissions, the tool exits. If the tool is not being run in quiet style, it displays a dialog box that describes the failure.
If the tool is more 215 days (seven months) out of date, the tool displays a dialog box that recommends that you download the latest version of the tool.

Support for command-line switches

The MSRT supports the post-obit command line switches.

Switch	Purpose
/Q or /tranquility	Uses tranquillity fashion. This option suppresses the user interface of the tool.
/?	Displays a dialog box that lists the command-line switches.
/N	Runs in detect-only style. In this style, malicious software volition be reported to the user, but it will not be removed.
/F	Forces an extended scan of the computer.
/F:Y	Forces an extended scan of the computer and automatically cleans any infections that are found.

Usage and release data

When you download the tool from Microsoft Update or from Automatic Updates, and no malicious software is detected on the computer, the tool will run in quiet mode next time. If malicious software is detected on the computer, the next fourth dimension that an administrator logs on to the calculator, a balloon will appear in the notification area to notify you of the detection. For more than information about the detection, click the airship.

When y'all download the tool from the Microsoft Download Center, the tool displays a user interface when it runs. However, if you supply the /Q command-line switch, it runs in placidity mode.

Release information

The MSRT is released on the second Tuesday of each month. Each release of the tool helps detect and remove current, prevalent malicious software. This malicious software includes viruses, worms, and Trojan horses. Microsoft uses several metrics to determine the prevalence of a malicious software family and the damage that can be associated with it.

This Microsoft Knowledge Base commodity will exist updated with information for each release then that the number of the relevant article remains the same. The name of the file will be inverse to reverberate the tool version. For instance, the file name of the February 2020 version is Windows-KB890830-V5.80.exe, and the file proper noun of the May 2020 version is Windows-KB890830-V5.82-ENU.exe.

The following table lists the malicious software that the tool can remove. The tool can also remove any known variants at the fourth dimension of release. The tabular array also lists the version of the tool that first included detection and removal for the malicious software family unit.

Reporting component

The MSRT sends data to Microsoft if it detects malicious software or finds an error. The specific information that is sent to Microsoft consists of the following items:

The name of the malicious software that is detected
The result of malicious software removal
The operating system version
The operating system locale
The processor compages
The version number of the tool
An indicator that notes whether the tool is being run by Microsoft Update, Windows Update, Automatic Updates, the Download Heart, or from the website
An anonymous GUID
A cryptographic one-way hash (MD5) of the path and file proper name of each malicious software file that is removed from the figurer

If apparently malicious software is establish on the computer, the tool prompts you to send information to Microsoft beyond what is listed here. You are prompted in each of these instances, and this data is sent simply with your consent. The additional information includes the post-obit:

The files that are suspected to be malicious software. The tool will place the files for you.
A cryptographic one-mode hash (MD5) of any suspicious files that are detected.

You tin can disable the reporting feature. For information well-nigh how to disable the reporting component and how to prevent this tool from sending information to Microsoft, see Deploy Windows Malicious Software Removal Tool in an enterprise environment.

Possible scanning results

Afterwards the tool runs, there are four main results that the removal tool can study to the user:

No infection was establish.
At least one infection was found and was removed.
An infection was found but was non removed.

Note This consequence is displayed if suspicious files were found on the calculator. To assist remove these files, you should utilise an up-to-date antivirus production.
An infection was found and was partially removed.

Note To consummate this removal, you should employ an up-to-date antivirus production.

Frequently asked questions well-nigh the MSRT

A3: Yes. Per the terms of this tool's license terms, the tool can be redistributed. However, brand certain that you are redistributing the latest version of the tool.

A4: If yous are a Windows 7 user, use Microsoft Update or the Microsoft Update Automatic Updates functionality to test whether you are using the latest version of the tool. If yous take called not to utilize Microsoft Update, and you are a Windows 7 user, use Windows Update. Or, use the Windows Update Automated Updates functionality to examination whether you lot are using the latest version of the tool. Additionally, yous can visit the Microsoft Download Middle. Also, if the tool is more than than 60 days out of date, the tool reminds you lot to expect for a new version of the tool.

A5: No. The Microsoft Knowledge Base article number for the tool will remain as 890830 for future versions of the tool. The file proper noun of the tool when it is downloaded from the Microsoft Download Center volition alter with each release to reverberate the month and the year when that version of the tool was released.

A6: Currently, no. Malicious software that is targeted in the tool is based on metrics that track the prevalence and damage of malicious software.

A8: Several scenarios may prevent you lot from seeing the tool on Microsoft Update, Windows Update, or Automatic Updates:

If you have already run the electric current version of the tool from Windows Update, Microsoft Update, Automatic Updates, or from either of the other two release mechanisms, information technology will not be reoffered on Windows Update or Automatic Updates.
For Automatic Updates, the first time that you run the tool, you must be logged on as a member of the Administrators group to accept the license terms.

A9: The tool is offered to all supported Windows and Windows Server versions that are listed in the "Summary" section if the post-obit atmospheric condition are true:

The users are running the latest version of Windows Update or Windows Update Automatic Updates.
The users have not already run the current version of the tool.

A11: Yes. Even if there are no new security bulletins for a particular calendar month, the Malicious Software Removal Tool will be rereleased with detection and removal back up for the latest prevalent malicious software.

A12: When you lot are starting time offered the Malicious Software Removal Tool from Microsoft Update, Windows Update, or Automatic Updates, you can decline downloading and running the tool by declining the license terms. This action tin can apply to only the electric current version of the tool or to both the current version of the tool and any time to come versions, depending on the options that you choose. If you have already accustomed the license terms and adopt not to install the tool through Windows Update, clear the checkbox that corresponds to the tool in the Windows Update UI.

A13: If it is downloaded from Microsoft Update or from Windows Update, the tool runs only ane fourth dimension each month. To manually run the tool multiple times a month, download the tool from the Download Center or by visiting the Microsoft Condom & Security Center website.

For an online scan of your system past using the Windows Live OneCare safety scanner, go to the Microsoft Safety Scanner website.

A14: Currently, the Malicious Software Removal Tool is not supported on a Windows Embedded computer.

A15: No. Unlike virtually previous cleaner tools that were produced by Microsoft, the MSRT has no security update prerequisites. Notwithstanding, we strongly recommend that you install all critical updates before you use the tool, to aid forbid reinfection by malicious software that takes advantage of security vulnerabilities.

A18: Yep. Y'all tin can utilize the microsoft.public.security.virus newsgroup.

A19: In some cases, when specific viruses are found on a system, the cleaner tool tries to repair infected Windows system files. Although this action removes the malicious software from these files, it may besides trigger the Windows File Protection feature. If you see the Windows File Protection window, nosotros strongly recommend that you follow the directions and insert your Microsoft Windows CD. This will restore the cleaned files to their original, pre-infection state.

A20: Yes, the tool is available in 24 languages.

A21: The tool does use a file that is named Mrtstub.exe for certain operations. If you verify that the file is signed by Microsoft, the file is a legitimate component of the tool.

A22: Aye. If you accept run the MSRT before you showtime the estimator to Condom mode, you tin access MSRT at %windir%\system32\mrt.exe. Double-click the Mrt.exe file to run the MSRT, and then follow the on-screen instructions.