What is Windows Malicious Software Removal Tool (mrt.exe) and how to use it
The Windows Malicious Software Removal Tool was always a very enigmatic Windows Update for me. I always installed it both on my Windows XP and Windows Vista PCs and never really understood how it works and if it works. After I installed it, I did not see any new shortcuts or programs running in the background, not even new notification messages. It was as if I installed an update which did not do anything.
Recently, I went to one of my friend's house and installed Windows Vista on his PC. Of course, Windows Update installed Windows Malicious Software Removal Tool on his PC as well. When he asked me about this tool and how it works, I was not able to give him any answers. To answer his questions and any of your questions about this tool, I decided to do a little digging and write this article to share with you all there is to know about the Windows Malicious Software Removal Tool.
What is Windows Malicious Software Removal Tool (mrt.exe)?
Microsoft Windows Malicious Software Removal Tool is basically a free tool which helps to remove specific malicious software from computers which run Windows operating systems, including all versions of Windows Vista. This tool is updated on the second Tuesday of every month and it is distributed via Windows Update. After it is installed, it silently runs in the background and removes the malicious software that it finds. When the detection and removal process is complete, the tool generates a report describing the outcome of the scan. The report can be found in a log file named 'mrt.log' placed in the 'C:\Windows\Debug' folder.
Even though this tool helps you remove malicious software, it should never be used as a replacement for an antivirus program. That's because this tool has a very limited database of malicious software and searches only for specific threats. Also, it is updated on a monthly basis unlike antivirus solutions which are updated daily.
Where to find it
By default, the tool can be found in the 'C:\Windows\System32' folder. Once you open this location, search for a file called mrt.exe.
If you don't find this file, it means that this tool is not installed on your PC. In this case you can download it directly from the Microsoft Download Center. The 64 bit version can be found here.
How to use it in interactive mode
If you want to run this tool manually, go to the location mentioned above and double click the mrt.exe file. An easier way is to type mrt.exe in the Start Menu Search Box or in the Run window.
Alternatively, you can download the Windows Malicious Software Removal Tool Shortcut we have attached to this article, place it on your desktop and use it each time you want.
When the tool starts, you will receive an UAC prompt. Click Continue and the tool will start.
When you see the Welcome window, click Next.
Now you need to select the type of scan you want the tool to perform. You have three possible options: Quick scan, Full scan and Customized scan. If you did not scan your PC before and you don't have a reliable antivirus solution installed, you might want to select Full scan. Once you selected the option you prefer, click Next.
The tool will start to scan your computer and show you the status of the scan.
When finished you will see the results. In my case, no malicious software was detected. Now click Finish and the tool will close.
How to use it from the Command Prompt
You can use this tool from the Command Prompt as well. To use it, right click the Command Prompt shortcut and select 'Run as administrator.
Now type 'mrt.exe ' followed by one of these possible switches:
- /Q or /quiet - runs the tool in quiet mode. This option suppresses the user interface completely;
- /N - runs in detect-only mode. In this mode, any detected malicious software will be reported but it will not be removed;
- /F - performs a full scan of the computer without removing any infections that are found;
- /F:Y - performs a full scan of the computer and automatically cleans all the found infections;
- /? or /help - displays usage information.
If you are running the tool in quiet mode, you can find the log file mrt.log in the 'C:\Windows\Debug' folder. To easily open this file, you can download the attached shortcut, place it on your desktop and double click on it.
Related articles:
Protect your system from viruses for free
Protect your system from spyware for free
Protect your system from hackers for free
Windows Defender
Windows Firewall
Windows Vista Security Center
How to work with the new Windows Update
This work is licensed under a Creative Commons Attribution-Noncommercial 3.0 License.
Microsoft, Windows and the Windows logo are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Microsoft Corporation in no way endorses or is affiliated with www.vista4beginners.com.
All other products mentioned are registered trademarks and/or trademarks of their respective companies.
Comments
I have a question on this.
I have a question on this. If I was running a pirated copy of Office, would this tool also find that?
No. It wouldn't!
No. It wouldn't!
mrt.exe
I seem to have several folders in the root of my c drive, with class id like names that contain different versions/sizes of this executable. System is XP Pro SP3, should I delete these various entries, or will microsoft eventually remove them or just continue to add further versions add-infinitum 'til my hard drive fills up?
Delete
It should be ok to delete those older versions.
MRT
I'm late to this discussion but agree with the idea that we all should be able to permanently opt out of non-critical MS software such as the MRT.
Everything running on a PC takes resources and also has the risk of failing and causing down time. Each user or support team (home / office) should have the freedom to control and monitor the installation of non-essential software that could affect system performance. So MS needs to either designate it as critical to their OS and ALWAYS install it OR make it easier to block and forget about it. Every month we have to kill this "update" from installing on our servers. The sad thing is MS is pretty smart about this stuff so that only leaves me with the thought this it is a marketing ploy of some kind that eventually will come to light and wipe out half their endpoint protection competitors due to it's integration into our mostly "MS World". Remember, this is one update that asks that we "agree" with a licensing agreement.....hmmmm, why is that? It's a "free" application, not an update.
MRT spyware
If you care to read the agreement...hang on, that's ridiculous, no one reads them, why do they force this on users. Keep googling and you may reveal why MS want you to run this application. It provides very useful information about your PC and how you use it.
I have never seen this tool detect anything so much as a cookie on my PC much less spyware. Maybe it should detect itself!
thanks
Hey, this was indeed helpful, i now know what's this all about.hopefully, i wont have to use it
Question?
Could a virus pose as this software?
MRT,exe
I have just recently had a window to send Windows Info on C:\Windows\system32\MRT.exe needing checked for use with windows[ not quoted per notice] sent. Log file says 0 , Why am i sending info and what info to WHO?
Big Brother
If you bother to read the license agreement, you will see that it is Microsoft who determines what software this tool will remove from your computer. That is, it can and will remove any software that Microsoft thinks is not appropriate. That is why they need a new license agreement, because that is not within the normal license. Yes, it may do something about viruses as well, but it is mainly a tool for Microsoft to control what you can and cannot install on your computer. With your approval, because you signed the license agreement.
Big Brother on stereoids.
Post new comment