How do i use malicious software removal tool

The license terms are only displayed for the first time that you access Automatic Updates. Note After you accept the one-time license terms, you can receive future versions of the MSRT without being logged on to the computer as an administrator.

If it detects malicious software on your computer, the next time that you log on to your computer as a computer administrator, a balloon appears in the notification area to make you aware of the detection. If the tool finds malicious software, you may be prompted to perform a full scan. We recommend that you perform this scan. A full scan performs a quick scan and then a full scan of the computer, regardless of whether malicious software is found during the quick scan. This scan can take several hours to complete because it will scan all fixed and removable drives.

However, mapped network drives are not scanned. If malicious software has modified infected files on your computer, the tool prompts you to remove the malicious software from those files.

If the malicious software modified your browser settings, your homepage may be changed automatically to a page that gives you directions on how to restore these settings. You can clean specific files or all the infected files that the tool finds. Be aware that some data loss is possible during this process.

Also, be aware that the tool may be unable to restore some files to the original, pre-infection state. The removal tool may request that you restart your computer to complete the removal of some malicious software, or it may prompt you to perform manual steps to complete the removal of the malicious software.

To complete the removal, you should use an up-to-date antivirus product. Reporting infection information to Microsoft The MSRT sends basic information to Microsoft if the tool detects malicious software or finds an error. This information will be used for tracking virus prevalence.

No identifiable personal information that is related to you or to the computer is sent together with this report. The MSRT does not use an installer. Typically, when you run the MSRT, it creates a randomly named temporary directory on the root drive of the computer.

This directory contains several files, and it includes the Mrtstub. Most of the time, this folder is automatically deleted after the tool finishes running or after the next time that you start the computer. However, this folder may not always be automatically deleted.

In these cases, you can manually delete this folder, and this has no adverse effect on the computer. Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center. Help installing updates: Support for Microsoft Update.

Local support according to your country: International Support. The following files are available for download from the Microsoft Download Center: For bit xbased systems:. Download the x86 MSRT package now. Download the x64 MSRT package now. For more information about how to download Microsoft support files, see How to obtain Microsoft support files from online services. Microsoft scanned this file for viruses.

Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file. If you are an IT administrator who wants more information about how to deploy the tool in an enterprise environment, see Deploy Windows Malicious Software Removal Tool in an enterprise environment. Except where noted, the information in this section applies to all the ways that you can download and run the MSRT:.

You must log on to the computer by using an account that is a member of the Administrators group. If your logon account does not have the required permissions, the tool exits. If the tool is not being run in quiet mode, it displays a dialog box that describes the failure. If the tool is more than days 7 months out of date, the tool displays a dialog box that recommends that you download the latest version of the tool.

Runs in detect-only mode. In this mode, malicious software will be reported to the user, but it will not be removed. When you download the tool from Microsoft Update or from Automatic Updates, and no malicious software is detected on the computer, the tool will run in quiet mode next time. If malicious software is detected on the computer, the next time that an administrator logs on to the computer, a balloon will appear in the notification area to notify you of the detection.

For more information about the detection, click the balloon. When you download the tool from the Microsoft Download Center, the tool displays a user interface when it runs. Each release of the tool helps detect and remove current, prevalent malicious software. This malicious software includes viruses, worms, and Trojan horses. Microsoft uses several metrics to determine the prevalence of a malicious software family and the damage that can be associated with it. This Microsoft Knowledge Base article will be updated with information for each release so that the number of the relevant article remains the same.

The name of the file will be changed to reflect the tool version. The following table lists the malicious software that the tool can remove. The tool can also remove any known variants at the time of release. The table also lists the version of the tool that first included detection and removal for the malicious software family. We maximize customer protection by regularly reviewing and prioritizing our signatures.

We add or remove detections as the threat landscape evolves. Note: It is recommended to have an up to date next-gen antimalware product installed for continuous protection. The specific information that is sent to Microsoft consists of the following items:.

An indicator that notes whether the tool is being run by Microsoft Update, Windows Update, Automatic Updates, the Download Center, or from the website. A cryptographic one-way hash MD5 of the path and file name of each malicious software file that is removed from the computer. If apparently malicious software is found on the computer, the tool prompts you to send information to Microsoft beyond what is listed here. You are prompted in each of these instances, and this information is sent only with your consent.

The additional information includes the following:. You can disable the reporting feature. For information about how to disable the reporting component and how to prevent this tool from sending information to Microsoft, see Deploy Windows Malicious Software Removal Tool in an enterprise environment.

An infection was found but was not removed. Note This result is displayed if suspicious files were found on the computer. To help remove these files, you should use an up-to-date antivirus product. An infection was found and was partially removed. Note To complete this removal, you should use an up-to-date antivirus product. A3: Yes. Active malicious software is malicious software that is currently running on the computer.

The tool cannot remove malicious software that is not running. However, an antivirus product can perform this task. The Malicious Software Removal Tool runs in quiet mode in the background. If it detects malicious software on your computer, the next time that you log on to your computer as a computer administrator, a balloon will appear in the notification area to make you aware of the detection.

If the tool finds malicious software, you may be prompted to perform a full scan. We recommend that you perform this scan.

A full scan performs a quick scan and then a full scan of the computer, regardless of whether malicious software is found during the quick scan. This scan can take several hours to complete because it will scan all fixed and removable drives. However, mapped network drives are not scanned.

If malicious software has modified infected files on your computer, the tool prompts you to remove the malicious software from those files. If the malicious software modified your browser settings, your homepage may be changed automatically to a page that gives you directions on how to restore these settings. You can clean specific files or all the infected files that the tool finds.

Be aware that some data loss is possible during this process. Also, be aware that the tool may be unable to restore some files to the original, pre-infection state. The removal tool may request that you restart your computer to complete the removal of some malicious software, or it may prompt you to perform manual steps to complete the removal of the malicious software. To complete the removal, you should use an up-to-date antivirus product. Scan type options will appear. Quick scan only the areas where malicious software are commonly found.

Full Scan looks bad software in your whole system. And Customized scan option will let you select folders for scanning. Choose one option. The Malicious Software Removal Tool will scan your computer.

Once the scan is completes, results will be presented. For more information, you can press the View detailed results of the scan link.