Windows 7 - Malicious Software Removal Tool

   Information

This will show you how to open and use the Malicious Software Removal Tool (MRT) to manually run scans for and automatically remove malicious software in Windows 7.


For more information and FAQs about the Malicious Software Removal Tool, please read:

• Malicious Software Removal Tool | Protect Your Computer

• The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows 7, Windows Vista, Windows Server 2003, Windows Server 2008, Windows XP, or Windows 2000

   Tip

• The Microsoft Malicious Software Removal Tool is normally installed and updated on the second Tuesday of every month by the KB890830 Windows Update.
  WARNING: The Windows Malicious Software Removal Tool - September 2009 (KB89030) Windows Update will need to be installed first before you will have it available in Windows 7.
• The scan log is located at: C:\Windows\Debug\mrt.log
• The event log is located at: C:\Windows\Debug\mrteng.log

   Note

The Malicious Software Removal Tool normally runs in quiet mode. If it detects malicious software on your computer, the next time that you log on to your computer as a computer administrator, a balloon will appear in the notification area to make you aware of the detection and prompt you to run a full scan.

The release of the Microsoft Safety Scanner has resulted in confusion about the available anti-malware tools provided by Microsoft and questions about when they should be used.

Read more at: Understanding Microsoft Anti-Malware Software ~ Security Garden

   Warning

The Microsoft Malicious Software Removal Tool does not replace an antivirus program. It is strictly a post-infection removal tool. Therefore, it is strongly recommend that you install and use an up-to-date antivirus program.


The Microsoft Malicious Software Removal Tool differs from an antivirus program in three key ways:

• The tool removes malicious software from an already-infected computer. Antivirus products block malicious software from running on a computer. It is significantly more desirable to block malicious software from running on a computer than to remove it after infection.
• The tool removes only specific, prevalent malicious software. Specific, prevalent malicious software is a small subset of all the malicious software that exists today.
• The tool focuses on the detection and removal of active malicious software. Active malicious software is malicious software that is currently running on the computer. The tool cannot remove malicious software that is not running. However, an antivirus product can perform this task.

   Note

The Windows Malicious Software Removal Tool - September 2009 (KB89030) Windows Update will need to be installed first before you will have it available in Windows 7.



If not, then you can also download and install it manually from Microsoft at:

• Download details: Microsoft® Windows® Malicious Software Removal Tool (KB890830)
• Download details: Microsoft® Windows® Malicious Software Removal Tool (KB890830) x64

1. Open the Start Menu, and type mrt.exe in the search line and press enter.
NOTE: This file is located at C:\Windows\System32\mrt.exe.

2. If prompted by UAC, click on Yes.

3. Click on the Next button. (See screenshot below)

4. Select (dot) the type of scan you would like to run, then click on Next. (See screenshot below)

5. It will now start the scan. It can take a bit to finish depending on what scan options you selected in step 4 above. (See screenshot below)

6. When finished, it will report any scan results. (See screeshot below)

7. To see detailed scan results, click on the View detailed results of the scan link. (See screenshot below)

8. Click on the Finish button when done. (See screenshot below step 6)

   Tip

How to Run the "Windows Malicious Software Removal Tool" from the Command Prompt

In a command prompt, type mrt.exe followed by one of the switches below. For example, type mrt.exe /F:Y to run a full scan and automatically clean the infected files.