How in the Tech

Running Windows Malicious Software Removal Tool on your Schedule

By Adam Myers ⋅ January 23, 2009 ⋅ Tags: Security, System Administration

The Windows Malicious Software Removal Tool, a free utility provided Microsoft via Windows Update, scans your Windows installation to seek out specific malicious programs. Updates are delivered monthly as part of the second  Tuesday of the month release cycle Microsoft utilizes. It is important to state, and Microsoft is quite clear on this, that the tool is not a replacement for a fully functioning anti-virus suite. As mentioned in it’s name, the program only removes malicious software – meaning you would already be infected. Believe it or not, there are millions of PC users that don’t use proper AV software when they really should be. Microsoft is attempting to address these users without getting into hot water with current anti-virus vendors. As many of these malicious programs spread throughout networks on their own, it benefits everyone – even if you have protection – to eradicate the compromised machine. That’s the theory at least!

The problem with the Microsoft tool is that it is not memory resident – it isn’t actively scanning the system. Instead, the software runs on the next reboot after installing the latest update. In a way, this isn’t as bad as it sounds, if only because you are likely rebooting your computer after installing other security updates released at the same time. But what if you somehow became infected with a known piece of malicious software between the monthly definitions update? Simply, Microsoft’s tool won’t help you. Worse, there isn’t an easily apparent way to trigger a manual scan. That is, until now!

1. Click the Windows Key + R to launch the Run Dialog. Type mrt and click OK.



2. The Windows Malicious Software Removal Tool GUI will launch. From here, you can initiate a scan as well as see a list of software the tool can detect and remove. Click Next.



3. You have three levels of scanning: Quick, Full, and Custom. Quick is the scan level that is run on reboot as describe above. Full is the thorough scan of the entire file system while Custom can be pointed at specific folder locations. I chose Full and clicked Next.



4. The scan will commence. Be warned, the scan will take a few hours and it did noticeably slow down my PC as the harddrive thrashed. Thorough comes at a price doesn’t it?



5. Not surprising to me, my system was clean. But don’t be so quick to make the same assumption on yours; the full scan may uncover things that a quick scan wouldn’t. One would like to think that your anti-virus software has kept you protected sufficiently but it never hurts to have a few layers of checks and protection!