Malicious Software Removal Tool

Malicious Software Removal Tool
Developer(s) Microsoft
Stable release 5.23 / 14 April 2015
Development status Active
Operating system Windows XP and later
Size 43.1 MB
Available in English, Arabic, Chinese, Czech, Danish, Dutch, Finnish, French, German, Greek, Hebrew, Hungarian, Italian, Japanese, Korean, Norwegian, Polish, Portuguese, Russian, Spanish, Swedish and Turkish
Type On-demand scanner
License Freeware
Website www.microsoft.com/security/pc-security/malware-removal.aspx

Microsoft Windows Malicious Software Removal Tool is a freely-distributed virus removal tool developed by Microsoft for the Microsoft Windows operating system. First released on January 13, 2005,[1] it is an on-demand anti-virus tool ("on-demand" meaning it lacks real-time protection) that scans the computer for specific widespread malware and tries to eliminate the infection. It is automatically distributed to Microsoft Windows computers via Windows Update service but can also be separately downloaded.[2][3][4]

The program is usually updated on the second Tuesday of every month and distributed via Windows Update, at which point it runs once automatically in the background and reports if malicious software is found. Alternatively, users can manually download this tool from Microsoft Download Center.[3] It records its results in a log file located at %windir%\debug\mrt.log.[2] To run it manually at other times, users can start "mrt.exe" using Windows Command Prompt or Run command in the Start Menu. With Windows 2000 going out of support in July 2010, Microsoft stopped distributing the MSRT tool to Windows 2000 users via Windows Update. Download and usage of the current versions up to 4.20 (May 2013) was still possible; however, starting with version 5.1 (June 2013) Windows 2000 is not supported anymore.

As released, the tool is configured to report anonymized data about infections to Microsoft if any are detected.[2] The reporting behavior is disclosed in the tool's EULA, and can be disabled if desired.[5]

In a June 2006 Microsoft report,[1] the company claimed that the tool had removed 16 million instances of malicious software from 5.7 million of 270 million total unique Windows computers since its release in January 2005. The report also stated that, on average, the tool removes malicious software from 1 in every 311 computers on which it runs. As of 19 May 2009 Microsoft claims that the software has removed password stealer threats from 859,842 machines.[6]

In August 2013, the Malicious Software Removal Tool deleted old, vulnerable versions of the Tor client, in order to end the spread of the Sefnit botnet (which mined for bitcoins without the host owner's approval and later engaged in click fraud.) Approximately two million hosts had been cleaned by October,[7][8][9] although this was slightly less than half of the estimated infections, the rest of the suspected machines presumably not having their automatic Windows Updates enabled or manually run.[10]

Although Windows XP support expired on April 8, 2014, Microsoft announced that updates for the XP version of the Malicious Software Removal Tool will be provided until July 14, 2015.[11]

Further reading

References

  1. ↑ 1.0 1.1 "Windows Malicious Software Removal Tool: Progress Made, Trends Observed". Microsoft. Retrieved 10 March 2010. Microsoft delivered the first version of the MSRT on January 13, 2005 in 24 languages to users of Windows 2000, Windows XP, and Windows Server 2003 computers.
  2. ↑ 2.0 2.1 2.2 "The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows 7, Windows Vista, Windows Server 2003, Windows Server 2008, Windows XP, or Windows 2000.". Microsoft Support Center. Microsoft Corporation. 8 December 2009. Retrieved 22 December 2009.
  3. ↑ 3.0 3.1 Windows Malicious Software Removal Tool download "Download Details: Microsoft Windows Malicious Software Removal Tool (KB890830)". Microsoft Download Center. Microsoft Corporation. 8 December 2009. Retrieved 22 December 2009.
  4. ↑ Savill, John (2005). "Windows IT Pro - "What's the Microsoft Windows Malicious Software Removal Tool?"". Retrieved 5 July 2006.
  5. ↑ "Deployment of the Microsoft Windows Malicious Software Removal Tool in an enterprise environment". 8 December 2009. Retrieved 22 December 2009. Q3. How can I disable the infection-reporting component of the tool so that the report is not sent back to Microsoft? A3. An administrator can choose to disable the infection-reporting component of the tool by adding the following registry key value to computers [~snip~]
  6. ↑ "Microsoft cleans password stealer tools from 859,842 PCs". Ars Technica. Condé Nast. 2009. Retrieved 21 May 2009.
  7. ↑ McHugh, Molly (2014-01-17). "Microsoft's secret battle against the Tor botnet". The Daily Dot. Retrieved 2014-02-10.
  8. ↑ "Microsoft uncovers Sefnit Trojan return after Groupon click-fraud scam - IT News from". V3.co.uk. Retrieved 2014-02-10.
  9. ↑ "Tackling the Sefnit botnet Tor hazard - Microsoft Malware Protection Center - Site Home - TechNet Blogs". Blogs.technet.com. 2014-01-09. Retrieved 2014-02-10.
  10. ↑ "Microsoft Takes Aim at Tor-Distributed Botnet - Computing Now | Newsfeed - IEEECS". Computer.org. Retrieved 2014-02-10.
  11. ↑ Gregg Keizer. "Microsoft retains weapon to silently scrub XP". Computerworld. Retrieved 2014-02-10.

External links