Windows 10: Malicious Software Removal Tool in Windows

How to: Malicious Software Removal Tool in Windows

How to Use Malicious Software Removal Tool in Windows


The Microsoft Windows Malicious Software Removal Tool (MSRT) helps remove malicious software from your computers that are running Windows 10, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows Server 2012 R2, Windows 8, Windows Server 2012, Windows 7, or Windows Server 2008

Microsoft generally releases the MSRT monthly as part of Windows Update or as the standalone tool. Use this tool to find and remove specific prevalent threats and reverse the changes they have made (see Microsoft Safety Scanner.

The Microsoft Malicious Software Removal Tool does not replace an antivirus product. It is strictly a post-infection removal tool. Therefore, we strongly recommend that you install and use an up-to-date antivirus product. If you like, Windows 10 already has Windows Defender Antivirus included for antivirus.

The Microsoft Malicious Software Removal Tool differs from an antivirus product in three key ways:

• The tool removes malicious software from an already-infected computer. Antivirus products block malicious software from running on a computer. It is significantly more desirable to block malicious software from running on a computer than to remove it after infection.
• The tool removes only specific prevalent malicious software. Specific prevalent malicious software is a small subset of all the malicious software that exists today.
• The tool focuses on the detection and removal of active malicious software. Active malicious software is malicious software that is currently running on the computer. The tool cannot remove malicious software that is not running. However, an antivirus product can perform this task.

The Malicious Software Removal Tool runs in quiet mode in the background. If it detects malicious software on your computer, the next time that you log on to your computer as a computer administrator, a balloon will appear in the notification area to make you aware of the detection.

Performing a full scan

If the tool finds malicious software, you may be prompted to perform a full scan. We recommend that you perform this scan. A full scan performs a quick scan and then a full scan of the computer, regardless of whether malicious software is found during the quick scan. This scan can take several hours to complete because it will scan all fixed and removable drives. However, mapped network drives are not scanned.

Removing malicious files

If malicious software has modified (infected) files on your computer, the tool prompts you to remove the malicious software from those files. If the malicious software modified your browser settings, your homepage may be changed automatically to a page that gives you directions on how to restore these settings.

You can clean specific files or all the infected files that the tool finds. Be aware that some data loss is possible during this process. Also, be aware that the tool may be unable to restore some files to the original, pre-infection state.

The removal tool may request that you restart your computer to complete the removal of some malicious software, or it may prompt you to perform manual steps to complete the removal of the malicious software. To complete the removal, you should use an up-to-date antivirus product.

Reporting infection information to Microsoft

The Malicious Software Removal Tool will send basic information to Microsoft if the tool detects malicious software or finds an error. This information will be used for tracking virus prevalence. No identifiable personal information that is related to you or to the computer is sent together with this report.

This tutorial will show you how to open and use the Malicious Software Removal Tool (MSRT) to scan and remove specific prevalent malicious software in Windows.

The Malicious Software Removal Tool scan log is located at: C:\Windows\Debug\mrt.log


Microsoft releases a new version of the Malicious Software Removal Tool every second Tuesday of each month. MSRT is updated in Windows with 32-bit (x86) or 64-bit (x64) Windows.

Download Malicious Software Removal Tool (MSRT)




Contents

• Option One: To Open and Use Malicious Software Removal Tool
• Option Two: To Run Malicious Software Removal Tool in Command Prompt

OPTION ONE [/i] To Open and Use Malicious Software Removal Tool
1 Type mrt ("C:\Windows\System32\MRT.exe") in the search box (Windows+S) on Start menu or taskbar, and press Enter to open Malicious Software Removal Tool.

2 Click/tap on Next. (see screenshot below)



3 Do step step 4 (quick), step 5 (full), or step 6 (custom) below for what type of scan you want to run.


4. To Run a Quick Scan with MSRT
This will scan areas of the system most likely to contain malicious software. If malicious software is found, you may be prompted to run a full scan.


A) Select (dot) Quick scan, click/tap on Next, and go to step 7 below. (see screenshot below)





5. To Run a Full Scan with MSRT
This will scan the entire system. This scan can take up to several hours depending on how much data you have to scan.


A) Select (dot) Full scan, click/tap on Next, and go to step 7 below. (see screenshot below)





6. To Run a Customized Scan with MSRT
This will run a quick scan first, and then will scan the contents of the folder or drive you specified.


A) Select (dot) Customized scan, and click/tap on Choose Folder. (see screenshot below)



B) Browse to and select a folder or drive you want to scan, and click/tap on OK. (see screenshot below)



C) Click/tap on Next, and go to step 7 below. (see screenshot below step A)

7 MSRT will now start scanning your computer. (see screenshot below)



8 When the scan finishes, you will see the results, and can click/tap on the View detailed results of the scan link. When finished, click/tap on Finish. (see screenshots below)










OPTION TWO [/i] To Run Malicious Software Removal Tool in Command Prompt
1 Open and elevated command prompt.

2. In the elevated command prompt, copy and paste the command in bold below you want to use, and press Enter.
MRT /F = Opens MSRT UI, and performs a forced full scan.

MRT /F /Q = Performs a forced full scan without opening MSRT UI.

MRT /F:Y = Opens MSRT UI, performs a forced full scan, and automatically clean infected files.

MRT /F:Y /Q = Performs a forced full scan, and automatically clean infected files without opening MSRT UI.





That's it,
Shawn


Related Tutorials

• How to Turn On or Off Windows 10 Limited Periodic Scanning with Windows Defender
• How to Manually Scan Files, Folders, and Drives with Windows Defender Antivirus in Windows 10
• How to Use Microsoft Safety Scanner in Windows

:)

 

Malicious Software Removal Tool

What is Malicious Software Removal Tool? Is that like the another anti-viruses?

If it like Avira e.g., how to disable it? Because i don't want it to scan my drives.

 

Malicious Software Removal Tool

What does this have to do with your initial question?

 

I was reading your mind. *Wink

 

I've always been a bit confused about this thing. Windows has Defender now. So isn't this redundant? Defender and other antiviruses monitor the system in real time as well as give options for scheduled or manual scans.

 

Hello Crimson, *Smile

No. They have different purposes.

 

What's the different purpose? Like if I find out I'm infected with a virus. Post-infection, wouldn't I be able to just run the Defender scan? And it scans and removes it? Or say I'm using a third party anti-virus. Can't I just use that instead of this tool?

 

Technically you could use both to do so.

Think of it like Windows Defender as prevention, and MSRT as clean up after infected.

Of course, there's no guarantee that either will be able remove the infection since it all depends on if both have updated definitions, and if the infection was defined and included in the definitions to be able remove.

 

Right which applies to any anti-virus. Not sure why they would have it from MS side. Defender can now be used as clean up to fix infections. Why have a separate tool for that?

I mean sure I can have multiple different antivirus for added protection. It's actually sometimes necessary on an infected computer to go into safe-mode, and run scans with different anti-viruses. I usually have Avast installed with Defender disabled as standard protection.

But if I'm dealing with an infected system, I install the latest Malwarebytes in addition to whatever anti-virus is already installed. Then use whatever anti-virus is installed to run full scan in safe-mode. And again with Malwarebytes as an extra scan. Like I can also, on top of this, run the MSRT thing.

Either way, if a anti-virus is already installed such as Defender or Avast which all have the ability to remove viruses as clean up after infection, I don't really see anything else special that the MSRT does that a normal anti-virus scan wouldn't be able to do. It was released before MS Security Essentials and the new full anti-virus-Defender. So perhaps in the past, it might have been useful?

I guess I'd use it in the same way as I use Malwarebytes. As an extra scan in safe-mode to fix an already infected computer. Keep regular antivirus on, monitoring, and doing regular full scans. For infected computers, install latest Malwarebytes and MSRT, as additional scanners.

 

Yeah, it's pretty much just another tool to use as needed.

 

Oh OK.

I guess it's like some kind of HiJack this?

 

New KB890830 Windows Update for Malicious Software Removal Tool on December 12th 2016.

https://www.tenforums.com/tutorials/4...dows-10-a.html

 

This is Very Good

many thanks

 

Hey Brink,

As always, great tutorials.

Just wondering, as I've just checked the log and it appears it runs silently in the background after updates have been downloaded but is there a way to setup MRT run mode to pre-warn before running or running on-demand.

I take it, if it does find something while it is silently running in the background, it will pop up an alert??

In all my time, I've only ever run it manually and it has never found anything malicious, so I have no idea what it throws back if something is found.

Cheers

 

Hello Hawks, and welcome to Ten Forums. *Smile

Yeah, MSRT is only a tool that you manually run to help remove malicious software from your computer. It won't run in the background or monitor your system.

It will alert you if it finds anything when you run it, but you can always read the scan log located below.

C:\Windows\Debug\mrt.log