| Malicious Software Removal Tool | |
|---|---|
 | |
 | |
| Developer | Microsoft |
| Initial release | 13 January 2005; 21 years ago (2005-01-13) |
| Stable release | |
| Operating system | Windows 7 and later |
| Size | 80.3MB |
| Available in | English, Portuguese, Arabic, Chinese, Czech, Danish, Dutch, Finnish, French, German, Greek, Hebrew, Hungarian, Italian, Japanese, Korean, Norwegian, Polish, Portuguese, Russian, Spanish, Swedish and Turkish |
| Type | On-demand scanner |
| License | Freeware |
| Website | support |
Microsoft Windows Malicious Software Removal Tool (MRT) is afreewaresecond-opinion malware scanner thatMicrosoft'sWindows Update downloads and runs onWindows computers each month, independent of the installed antivirus software. First released on January 13, 2005,[2] MRT does not offerreal-time protection. It scans its host computer for specific, widespreadmalware, and tries to eliminate the infection. Outside its monthly deployment schedule, it can be separately downloaded from Microsoft.[3][1][4]
Since its January 13, 2005,[2] Microsoft releases the updated tool every second Tuesday of every month (commonly called "Patch Tuesday") through Windows Update, at which point it runs once automatically in the background and reports if malicious software is found. The tool is also available as a standalone download.[1]
Since support forWindows 2000 ended on July 13, 2010, Microsoft stopped distributing the tool to Windows 2000 users via Windows Update. The last version of the tool that could run on Windows 2000 was 4.20, released on May 14, 2013. Starting with version 5.1, released on June 11, 2013, support for Windows 2000 was dropped altogether. AlthoughWindows XP support ended on April 8, 2014, updates for the Windows XP version of the Malicious Software Removal Tool would be provided until August, 2016; version 5.39. The latest version of MRT forWindows Vista is 5.47, released on 11 April 2017.
Despite Microsoft ending general support for theWindows 7 operating system in 2020, updates are still provided to Windows 7 users via the standard Windows Update delivery mechanism.[3]
MRT does not install ashortcut in the Start menu. Hence, users must manually execute%windir%\System32\MRT.exe. The tool records its results in a log file located at%windir%\debug\mrt.log.[3]
The tool reports anonymized data about any detected infections to Microsoft.[3] MRT'sEULA discloses this reporting behavior and explains how to disable it.[5]
In a June 2006 Microsoft report,[2] the company claimed that the tool had removed 16 million instances of malicious software from 5.7 million of 270 million total unique Windows computers since its release in January 2005. The report also stated that, on average, the tool removes malicious software from 1 in every 311 computers on which it runs. On May 19, 2009, Microsoft claimed that the software has removedpassword stealer threats from 859,842 machines.[6]
In August 2013, the Malicious Software Removal Tool deleted old, vulnerable versions of theTor client to end the spread of theSefnit botnet (which mined forbitcoins without the host owner's approval and later engaged inclick fraud). Approximately two million hosts had been cleaned by October;[7][8][9] although this was slightly less than half of the estimated infections, the rest of the suspected machines presumably did not have their automatic Windows Updates enabled or manually run.[8]
Microsoft delivered the first version of the MSRT on January 13, 2005 in 24 languages to users of Windows 2000, Windows XP, and Windows Server 2003 computers.
Q3. How can I disable the infection-reporting component of the tool so that the report is not sent back to Microsoft? A3. An administrator can choose to disable the infection-reporting component of the tool by adding the following registry key value to computers [~snip~]
