Malicious Software Removal Tool in Windows  

Page 1 of 11 123 ... LastLast
    Malicious Software Removal Tool in Windows

    Malicious Software Removal Tool in Windows

    How to Use Malicious Software Removal Tool in Windows
    Published by Category: Security System
    11 Oct 2022
    Designer Media Ltd

    How to Use Malicious Software Removal Tool in Windows


    The Microsoft Windows Malicious Software Removal Tool (MSRT) is a post-infection removal tool that helps remove malicious software from your computers that are running Windows 10, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows Server 2012 R2, Windows 8.1, Windows Server 2012 R2, Windows Server 2012, or Windows 7.

    Starting May 2020, Microsoft releases the MSRT on a quarterly cadence as part of Windows Update or as a standalone tool. You can use this tool to find and remove specific prevalent threats and reverse the changes they have made (see covered malware families). For comprehensive malware detection and removal, consider using Microsoft Safety Scanner.

    The Microsoft Malicious Software Removal Tool does not replace an antivirus product. It is strictly a post-infection removal tool. Therefore, we strongly recommend that you install and use an up-to-date antivirus product. If you like, Windows 10 already has Windows Defender Antivirus included for antivirus.

    The Microsoft Malicious Software Removal Tool differs from an antivirus product in three key ways:

    • The tool removes malicious software from an already-infected computer. Antivirus products block malicious software from running on a computer. It is significantly more desirable to block malicious software from running on a computer than to remove it after infection.
    • The tool removes only specific prevalent malicious software. Specific prevalent malicious software is a small subset of all the malicious software that exists today.
    • The tool focuses on the detection and removal of active malicious software. Active malicious software is malicious software that is currently running on the computer. The tool cannot remove malicious software that is not running. However, an antivirus product can perform this task.

    The MSRT focuses on the detection and removal of malicious software such as viruses, worms, and Trojan horses only. It does not remove spyware.

    You do not have to disable or remove your antivirus program when you install the MSRT. However, if prevalent, malicious software has infected your computer, the antivirus program may detect this malicious software and may prevent the removal tool from removing it when the removal tool runs. In this case, you can use your antivirus program to remove the malicious software.

    Because the MSRT does not contain a virus or a worm, the removal tool alone should not trigger your antivirus program. However, if malicious software infected the computer before you installed an up-to-date antivirus program, your antivirus program may not detect this malicious software until the tool tries to remove it.



    If MSRT is downloaded from Windows Update, the tool runs only one time each month. To manually run the tool multiple times a month, download the tool from the Download Center.

    The MSRT tool runs in quiet mode unless it finds an infection. If it detects malicious software on your computer, the next time that you sign in to your computer as an administrator, a balloon appears in the notification area to make you aware of the detection. If you have not been notified of an infection, no malicious software has been found that requires your attention.

    Performing a full scan

    If the tool finds malicious software, you may be prompted to perform a full scan. We recommend that you perform this scan. A full scan performs a quick scan and then a full scan of the computer, regardless of whether malicious software is found during the quick scan. This scan can take several hours to complete because it will scan all fixed and removable drives. However, mapped network drives are not scanned.

    Removing malicious files

    If malicious software has modified (infected) files on your computer, the tool prompts you to remove the malicious software from those files. If the malicious software modified your browser settings, your homepage may be changed automatically to a page that gives you directions on how to restore these settings.

    You can clean specific files or all the infected files that the tool finds. Be aware that some data loss is possible during this process. Also, be aware that the tool may be unable to restore some files to the original, pre-infection state.

    The removal tool may request that you restart your computer to complete the removal of some malicious software, or it may prompt you to perform manual steps to complete the removal of the malicious software. To complete the removal, you should use an up-to-date antivirus product.

    Reporting infection information to Microsoft

    The Malicious Software Removal Tool will send basic information to Microsoft if the tool detects malicious software or finds an error. This information will be used for tracking virus prevalence. No identifiable personal information that is related to you or to the computer is sent together with this report.

    This tutorial will show you how to open and use the Malicious Software Removal Tool (MSRT) to scan and remove specific prevalent malicious software in Windows.

    The Malicious Software Removal Tool scan log is located at: C:\Windows\Debug\mrt.log


    Microsoft releases a new version of the Malicious Software Removal Tool every second Tuesday of each month. MSRT is updated in Windows with Windows Update KB890830. You can also download and install MSRT for your 32-bit (x86) or 64-bit (x64) Windows.

    Windows Malicious Software Removal Tool 32-bit

    Windows Malicious Software Removal Tool 64-bit



    Contents

    • Option One: To Open and Use Malicious Software Removal Tool
    • Option Two: To Run Malicious Software Removal Tool in Command Prompt






    OPTION ONE

    To Open and Use Malicious Software Removal Tool


    1 Type mrt ("C:\Windows\System32\MRT.exe") in the search box (Windows+S) on Start menu or taskbar, and press Enter to open Malicious Software Removal Tool.

    2 Click/tap on Next. (see screenshot below)

    Malicious Software Removal Tool in Windows-microsoft_windows_malicious_software_removal_tool-1.png

    3 Do step step 4 (quick), step 5 (full), or step 6 (custom) below for what type of scan you want to run.


     4. To Run a Quick Scan with MSRT

    This will scan areas of the system most likely to contain malicious software. If malicious software is found, you may be prompted to run a full scan.


    A) Select (dot) Quick scan, click/tap on Next, and go to step 7 below. (see screenshot below)

    Malicious Software Removal Tool in Windows-microsoft_windows_malicious_software_removal_tool-q-1.png


     5. To Run a Full Scan with MSRT

    This will scan the entire system. This scan can take up to several hours depending on how much data you have to scan.


    A) Select (dot) Full scan, click/tap on Next, and go to step 7 below. (see screenshot below)

    Malicious Software Removal Tool in Windows-microsoft_windows_malicious_software_removal_tool-f-1.png


     6. To Run a Customized Scan with MSRT

    This will run a quick scan first, and then will scan the contents of the folder or drive you specified.


    A) Select (dot) Customized scan, and click/tap on Choose Folder. (see screenshot below)

    Malicious Software Removal Tool in Windows-microsoft_windows_malicious_software_removal_tool-c-1.png

    B) Browse to and select a folder or drive you want to scan, and click/tap on OK. (see screenshot below)

    Malicious Software Removal Tool in Windows-microsoft_windows_malicious_software_removal_tool-c-2.png

    C) Click/tap on Next, and go to step 7 below. (see screenshot below step A)


    7 MSRT will now start scanning your computer. (see screenshot below)

    Malicious Software Removal Tool in Windows-microsoft_windows_malicious_software_removal_tool-2.png

    8 When the scan finishes, you will see the results, and can click/tap on the View detailed results of the scan link. When finished, click/tap on Finish. (see screenshots below)

    Malicious Software Removal Tool in Windows-microsoft_windows_malicious_software_removal_tool-4.png Malicious Software Removal Tool in Windows-microsoft_windows_malicious_software_removal_tool-3.png






    OPTION TWO

    To Run Malicious Software Removal Tool in Command Prompt


    1 Open and elevated command prompt.

    2. In the elevated command prompt, copy and paste the command in bold below you want to use, and press Enter.

    MRT /F = Opens MSRT UI, and performs a forced full scan.

    MRT /F /Q = Performs a forced full scan without opening MSRT UI.

    MRT /F:Y = Opens MSRT UI, performs a forced full scan, and automatically clean infected files.

    MRT /F:Y /Q = Performs a forced full scan, and automatically clean infected files without opening MSRT UI.

    Malicious Software Removal Tool in Windows-command.png


    That's it,
    Shawn Brink






  1. Posts : 46
    64-bit 10240 10 Pro
       #1

    Thanks for the Tut, Funny I performed this yesterday.
      My Computer


  2. Posts : 68,543
    64-bit Windows 11 Pro for Workstations
    Thread Starter
       #2

    I was reading your mind.
      My Computers


  3. Posts : 35
    Windows 10
       #3

    I've always been a bit confused about this thing. Windows has Defender now. So isn't this redundant? Defender and other antiviruses monitor the system in real time as well as give options for scheduled or manual scans.
      My Computer


  4. Posts : 68,543
    64-bit Windows 11 Pro for Workstations
    Thread Starter
       #4

    Hello Crimson, :)

    No. They have different purposes.

    The Microsoft Malicious Software Removal Tool does not replace an antivirus product. It is strictly a post-infection removal tool. Therefore, we strongly recommend that you install and use an up-to-date antivirus product.
      My Computers


  5. Posts : 35
    Windows 10
       #5

    What's the different purpose? Like if I find out I'm infected with a virus. Post-infection, wouldn't I be able to just run the Defender scan? And it scans and removes it? Or say I'm using a third party anti-virus. Can't I just use that instead of this tool?
      My Computer


  6. Posts : 68,543
    64-bit Windows 11 Pro for Workstations
    Thread Starter
       #6

    Technically you could use both to do so.

    Think of it like Windows Defender as prevention, and MSRT as clean up after infected.

    Of course, there's no guarantee that either will be able remove the infection since it all depends on if both have updated definitions, and if the infection was defined and included in the definitions to be able remove.
      My Computers


  7. Posts : 35
    Windows 10
       #7

    Right which applies to any anti-virus. Not sure why they would have it from MS side. Defender can now be used as clean up to fix infections. Why have a separate tool for that?

    I mean sure I can have multiple different antivirus for added protection. It's actually sometimes necessary on an infected computer to go into safe-mode, and run scans with different anti-viruses. I usually have Avast installed with Defender disabled as standard protection.

    But if I'm dealing with an infected system, I install the latest Malwarebytes in addition to whatever anti-virus is already installed. Then use whatever anti-virus is installed to run full scan in safe-mode. And again with Malwarebytes as an extra scan. Like I can also, on top of this, run the MSRT thing.

    Either way, if a anti-virus is already installed such as Defender or Avast which all have the ability to remove viruses as clean up after infection, I don't really see anything else special that the MSRT does that a normal anti-virus scan wouldn't be able to do. It was released before MS Security Essentials and the new full anti-virus-Defender. So perhaps in the past, it might have been useful?

    I guess I'd use it in the same way as I use Malwarebytes. As an extra scan in safe-mode to fix an already infected computer. Keep regular antivirus on, monitoring, and doing regular full scans. For infected computers, install latest Malwarebytes and MSRT, as additional scanners.
      My Computer


  8. Posts : 68,543
    64-bit Windows 11 Pro for Workstations
    Thread Starter
       #8

    Yeah, it's pretty much just another tool to use as needed.
      My Computers


  9. Posts : 35
    Windows 10
       #9

    Brink said:
    Yeah, it's pretty much just another tool to use as needed.
    Oh OK.

    I guess it's like some kind of HiJack this?
    Last edited by crimson; 26 Oct 2015 at 10:26.
      My Computer


 

Tutorial Categories

Malicious Software Removal Tool in Windows Tutorial Index Network & Sharing Instalation and Upgrade Browsers and Email General Tips Gaming Customization Apps and Features Virtualization BSOD System Security User Accounts Hardware and Drivers Updates and Activation Backup and Restore Performance and Maintenance Mixed Reality Phone


  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 04:55.
Find Us




Windows 10 Forums