|
Laptops & Tablets
|
Desktop & All-In-Ones
|
Servers
|
Workstations
|
Smartphones
|
Accessories & Upgrades
|
Monitors & Projectors
|
|
|||||
|
|||||
Microsoft released the Microsoft Windows Malicious Software Removal Tool to help remove specific prevalent malicious software from computers that are running Windows 7, Windows Vista, Windows Server 2003, Windows Server 2008, or Windows XP. After you download the Microsoft Malicious Software Removal Tool, the tool runs one time to check your computer for infection by specific prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps remove any infection it finds. Microsoft releases a new version of the tool every month.
In compliance with the Microsoft Support Lifecycle policy, the Windows Malicious Software Removal Tool (MSRT) will no longer be offered to or supported on Windows 2000-based systems after July 13, 2010. This date coincides with the end of the Extended Support phase for Windows 2000. For more information about the Support Lifecycle policy, please visit the following Microsoft website: http://support.microsoft.com/lifecycle (http://support.microsoft.com/lifecycle)
This article contains information about how the tool differs from an antivirus product, how you can download and run the tool, and what happens when the tool finds malicious software on your computer. The advanced user section includes information for the IT administrator and additional information about how to manage and run the Malicious Software Removal Tool.
Back to the top
The Microsoft Malicious Software Removal Tool does not replace an antivirus product. It is strictly a post-infection removal tool. Therefore, we strongly recommend that you install and use an up-to-date antivirus product.
The Microsoft Malicious Software Removal Tool differs from an antivirus product in three key ways:
For more information about how to protect your computer, visit the following Microsoft Protect Your PC Web site: http://www.microsoft.com/protect/default.mspx (http://www.microsoft.com/protect/default.mspx)
Note The Microsoft Malicious Software Removal Tool focuses on the detection and removal of malicious software such as viruses, worms, and Trojan horses only. It does not remove spyware. However, you can use Windows Defender to detect and remove spyware. click here to download Windows Defender (http://www.microsoft.com/downloads/details.aspx?FamilyId=435BFCE7-DA2B-4A6A-AFA4-F7F14E605A0D&displaylang=en)
You do not have to disable or remove your antivirus program when you install the Microsoft Malicious Software Removal Tool. However, if prevalent, malicious software has infected your computer, the antivirus program may detect this malicious software and may prevent the removal tool from removing it when the removal tool runs. In this case, you can use your antivirus program to remove the malicious software.
Because the Microsoft Malicious Software Removal Tool does not contain a virus or a worm, the removal tool alone should not trigger your antivirus program. However, if malicious software infected the computer before you installed an up-to-date antivirus program, your antivirus program may not detect this malicious software until the tool tries to remove it.
Back to the top
You can download and run the Microsoft Malicious Software Removal Tool if your computer is running Windows 7, Windows Vista, Windows Server 2003, or Windows XP.
Note You cannot download and run the tool if you are running Microsoft Windows 98, Windows Millennium Edition, or Microsoft Windows NT 4.0.
The easiest way to download and run the tool is to turn on Automatic Updates. Turning on Automatic Updates guarantees that you receive the tool automatically every month. If you have Automatic Updates turned on, you have already been receiving new versions of this tool monthly. The tool runs in quiet mode unless it finds an infection. If you have not been notified of an infection, no malicious software has been found that needs your attention.
Note If your computer is running Windows XP Service Pack 2 (SP2), Automatic Updates is turned on by default.
Are you unsure whether Automatic Updates is turned on? Follow these steps to determine whether Automatic Updates is turned on:
| If your computer is running | Follow these steps: |
| Windows 7 |
|
| Windows Vista |
|
| Windows XP, or Windows Server 2003 |
|
Back to the top| Turn Automatic Updates on | Turn Automatic Updates off |
| Fix this problem Microsoft Fix it 50362 | Fix this problem Microsoft Fix it 50363 |
Back to the top| If your computer is running | Follow these steps: |
| Windows 7 |
|
| Windows Vista |
|
| Windows XP, or Windows Server 2003 |
|
The Malicious Software Removal Tool runs in quiet mode. If it detects malicious software on your computer, the next time that you log on to your computer as a computer administrator, a balloon will appear in the notification area to make you aware of the detection.
If the tool finds malicious software, you may be prompted to perform a full scan. We recommend that you perform this scan. A full scan performs a quick scan and then a full scan of the computer, regardless of whether malicious software is found during the quick scan. This scan can take several hours to complete because it will scan all fixed and removable drives. However, mapped network drives will not be scanned.
If malicious software has modified (infected) files on your computer, the tool prompts you to remove the malicious software from those files. If the malicious software modified your browser settings, your homepage may be changed automatically to a page that gives you directions on how to restore these settings.
You can clean specific files or all the infected files that the tool finds. Be aware that some data loss is possible during this process. Also, be aware that the tool may be unable to restore some files to the original, pre-infection state.
The removal tool may request that you restart your computer to complete the removal of some malicious software, or it may prompt you to perform manual steps to complete the removal of the malicious software. To complete the removal, you should use an up-to-date antivirus product.
The Malicious Software Removal Tool will send basic information to Microsoft if the tool detects malicious software or finds an error. This information will be used for tracking virus prevalence. No identifiable personal information that is related to you or to the computer is sent together with this report.
Back to the top
The Malicious Software Removal Tool does not use an installer. Typically, when you run the Malicious Software Removal Tool, it creates a randomly named temporary directory on the root drive of the computer. This directory contains several files, and it includes the Mrtstub.exe file. Most of the time, this folder is automatically deleted after the tool finishes running or after the next time that you start the computer. However, this folder may not always be automatically deleted. In these cases, you can manually delete this folder, and this has no adverse effect on the computer.
Back to the top
No-charge support is available for home users by calling 1-866-PCSAFETY in the United States and in Canada. For international users, contact your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for security update support issues, visit the International Support Web site: http://support.microsoft.com/common/international.aspx (http://support.microsoft.com/common/international.aspx)
Back to the top
Microsoft Download Center
Deploying the Malicious Software Removal Tool in an enterprise environment
Prerequisites for running the Malicious Software Removal Tool
Support for command-line switches
Usage and release information
Reporting component
Possible scanning results
Frequently asked questions about the Malicious Software Removal Tool
This section is intended for advanced computer users. If you are not comfortable with advanced troubleshooting, you might want to ask someone for help or contact support. For more information about how to contact Microsoft support, visit the following Microsoft Web site: http://support.microsoft.com/contactus/ (http://support.microsoft.com/contactus/)
Back to the top
You can manually download the Malicious Software Removal Tool from the Microsoft Download Center. The following files are available for download from the Microsoft Download Center:
For 32-bit x86-based systems:
Collapse this image Expand this image
Download the x86 MSRT package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en)
For 64-bit x64-based systems:
Collapse this image Expand this image
Download the x64 MSRT package now. (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=585d2bde-367f-495e-94e7-6349f4effc74)
Release Date: February 8, 2011
For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591 (http://support.microsoft.com/kb/119591/ ) How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.
Back to the top
If you are an IT administrator who wants more information about how to deploy the tool in an enterprise environment, click the following article number to view the article in the Microsoft Knowledge Base: 891716 (http://support.microsoft.com/kb/891716/ ) Deployment of the Microsoft Windows Malicious Software Removal Tool in an enterprise environment
This article includes information about Microsoft Systems Management Server (SMS), Microsoft Software Update Services (SUS), and Microsoft Baseline Security Analyzer (MBSA).
Back to the top
Except where noted, the information in this section applies to all the ways that you can download and run the Malicious Software Removal Tool:
To run the Malicious Software Removal Tool, the following conditions are required:
The Malicious Software Removal Tool supports four command-line switches: Collapse this table Expand this table
| Switch | Purpose |
| /Q or /quiet | Uses quiet mode. This option suppresses the user interface of the tool. |
| /? | Displays a dialog box that lists the command-line switches. |
| /N | Runs in detect-only mode. In this mode, malicious software will be reported to the user, but it will not be removed. |
| /F | Forces an extended scan of the computer. |
| /F:Y | Forces an extended scan of the computer and automatically cleans any infections that are found. |
When you download the tool from Microsoft Update or from Automatic Updates, and no malicious software is detected on the computer, the tool will run in quiet mode next time. If malicious software is detected on the computer, the next time that an administrator logs on to the computer, a balloon will appear in the notification area to notify you of the detection. For more information about the detection, click the balloon.
When you download the tool from the Microsoft Download Center, the tool displays a user interface when it runs. However, if you supply the /Q command-line switch, it runs in quiet mode.
The Malicious Software Removal Tool is released on the second Tuesday of every month. Each release of the tool helps detect and remove current, prevalent malicious software. This malicious software includes viruses, worms, and Trojan horses. Microsoft uses several metrics to determine the prevalence of a malicious software family and the damage that can be associated with it.
The following table lists the malicious software that the tool can remove. The tool can also remove any known variants at the time of release. The table also lists the version of the tool that first included detection and removal for the malicious software family.
Each release of the tool is cumulative. That is, each release not only helps detect and remove new malicious software families, it also helps detect and remove all the malicious software covered in earlier versions. New variants of malicious software that is detected and removed in previous releases are also covered in each monthly release.
This Microsoft Knowledge Base article will be updated with information for each monthly release so that the number of the relevant article remains the same. The name of the file will be changed to reflect the tool version. For example, the file name of the January 2005 version is Windows-KB890830-ENU.exe, and the file name of the February 2005 version is Windows-KB890830-V1.1-ENU.exe. Collapse this table Expand this table
| Malicious software family | Tool version | Current severity rating |
|---|---|---|
| Win32/Berbew (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Berbew) | January 2005 (V 1.0) | Low |
| Win32/Doomjuice (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Doomjuice) | January 2005 (V 1.0) | Low |
| Win32/Gaobot (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Gaobot) | January 2005 (V 1.0) | Moderate |
| Win32/MSBlast (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/MSBlast) | January 2005 (V 1.0) | Low |
| Win32/Mydoom (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Mydoom) | January 2005 (V 1.0) | Low |
| Win32/Nachi (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Nachi) | January 2005 (V 1.0) | Low |
| Win32/Sasser (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Sasser) | January 2005 (V 1.0) | Low |
| Win32/Zindos (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Zindos) | January 2005 (V 1.0) | Low |
| Win32/Korgo (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Korgo) | February 2005 (V 1.1) | Low |
| Win32/Netsky (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Netsky) | February 2005 (V 1.1) | Moderate |
| Win32/Randex (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Randex) | February 2005 (V 1.1) | Low |
| Win32/Zafi (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Zafi) | February 2005 (V 1.1) | Low |
| Win32/Bagle (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Bagle) | March 2005 (V 1.2) | Moderate |
| Win32/Bropia (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Bropia) | March 2005 (V 1.2) | Low |
| Win32/Goweh (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Goweh) | March 2005 (V 1.2) | Low |
| Win32/Sober (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Sober) | March 2005 (V 1.2) | Moderate |
| Win32/Sobig (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Sobig) | March 2005 (V 1.2) | Low |
| Win32/Hackdef** (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/hackdef) | April 2005 (V 1.3) | Moderate |
| Win32/Mimail (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Mimail) | April 2005 (V 1.3) | Low |
| Win32/Rbot (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Rbot) | April 2005 (V 1.3) | Moderate |
| Win32/Sdbot (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Sdbot) | May 2005 (V 1.4) | Moderate |
| WinNT/Ispro (http://go.microsoft.com/fwlink/?linkid=37020&name=WinNT/Ispro) | May 2005 (V 1.4) | Low |
| WinNT/FURootkit (http://go.microsoft.com/fwlink/?linkid=37020&name=WinNT/FURootkit) | May 2005 (V 1.4) | Moderate |
| Win32/Kelvir (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Kelvir) | June 2005 (V 1.5) | Low |
| Win32/Lovgate (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Lovgate) | June 2005 (V 1.5) | Low |
| Win32/Mytob (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Mytob) | June 2005 (V 1.5) | Low |
| Win32/Spybot (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Spybot) | June 2005 (V 1.5) | Moderate |
| Win32/Hacty (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Hacty) | July 2005 (V 1.6) | Low |
| Win32/Optix (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Optix) | July 2005 (V 1.6) | Low |
| Win32/Optixpro (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Optixpro) | July 2005 (V 1.6) | Low |
| Win32/Purstiu (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Purstiu) | July 2005 (V 1.6) | Low |
| Win32/Wootbot (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Wootbot) | July 2005 (V 1.6) | Low |
| Win32/Bagz (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Bagz) | August 2005 (V 1.7) | Low |
| Win32/Dumaru (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Dumaru) | August 2005 (V 1.7) | Low |
| Win32/Spyboter (http://go.microsoft.com/fwlink/?linkid=37020&name=win32/Spyboter) | August 2005 (V 1.7) | Low |
| Win32/Zotob.A (http://go.microsoft.com/fwlink/?linkid=37020&name=Worm:Win32/Zotob.A) | August 2005 A (V 1.7.1) | Low |
| Win32/Zotob.B (http://go.microsoft.com/fwlink/?linkid=37020&name=Worm:Win32/Zotob.B) | August 2005 A (V 1.7.1) | Low |
| Win32/Zotob.C (http://go.microsoft.com/fwlink/?linkid=37020&name=Worm:Win32/Zotob.C) | August 2005 A (V 1.7.1) | Low |
| Win32/Zotob.D (http://go.microsoft.com/fwlink/?linkid=37020&name=Worm:Win32/Zotob.D) | August 2005 A (V 1.7.1) | Low |
| Win32/Zotob.E (http://go.microsoft.com/fwlink/?linkid=37020&name=Worm:Win32/Zotob.E) | August 2005 A (V 1.7.1) | Low |
| Win32/Bobax.O (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Bobax.O@mm) | August 2005 A (V 1.7.1) | Moderate |
| Win32/Esbot.A (http://go.microsoft.com/fwlink/?linkid=37020&name=Worm:Win32/Esbot.A) | August 2005 A (V 1.7.1) | Low |
| Win32/Rbot.MA (http://go.microsoft.com/fwlink/?linkid=37020&name=backdoor:Win32/Rbot.MA) | August 2005 A (V 1.7.1) | Low |
| Win32/Rbot.MB (http://go.microsoft.com/fwlink/?linkid=37020&name=backdoor:Win32/Rbot.MB) | August 2005 A (V 1.7.1) | Low |
| Win32/Rbot.MC (http://go.microsoft.com/fwlink/?linkid=37020&name=backdoor:Win32/Rbot.MC) | August 2005 A (V 1.7.1) | Low |
| Win32/Bobax (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Bobax) | September 2005 (V 1.8) | Moderate |
| Win32/Esbot (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Esbot) | September 2005 (V 1.8) | Low |
| Win32/Gael (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Gael) | September 2005 (V 1.8) | Moderate |
| Win32/Yaha (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Yaha) | September 2005 (V 1.8) | Low |
| Win32/Zotob (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Zotob) | September 2005 (V 1.8) | Low |
| Win32/Antinny (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Antinny) | October 2005 (V 1.9) | Moderate |
| Win32/Gibe (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Gibe) | October 2005 (V 1.9) | Low |
| Win32/Mywife (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Mywife) | October 2005 (V 1.9) | Low |
| Win32/Wukill (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Wukill) | October 2005 (V 1.9) | Moderate |
| Win32/Bugbear (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Bugbear) | November 2005 (V 1.10) | Low |
| Win32/Codbot (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Codbot) | November 2005 (V 1.10) | Low |
| Win32/Mabutu (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Mabutu) | November 2005 (V 1.10) | Low |
| Win32/Opaserv (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Opaserv) | November 2005 (V 1.10) | Low |
| Win32/Swen (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Swen) | November 2005 (V 1.10) | Low |
| Win32/IRCBot (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/IRCBot) | December 2005 (V 1.11) | Moderate |
| Win32/Ryknos (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Ryknos) | December 2005 (V 1.11) | Low |
| WinNT/F4IRootkit (http://go.microsoft.com/fwlink/?linkid=37020&name=WinNT/F4IRootkit) | December 2005 (V 1.11) | Moderate |
| Win32/Bofra (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Bofra) | January 2006 (V 1.12) | Low |
| Win32/Maslan (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Maslan) | January 2006 (V 1.12) | Low |
| Win32/Parite (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Parite) | January 2006 (V 1.12) | Moderate |
| Win32/Alcan (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Alcan) | February 2006 (V 1.13) | Moderate |
| Win32/Badtrans (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Badtrans) | February 2006 (V 1.13) | Low |
| Win32/Eyeveg (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Eyeveg) | February 2006 (V 1.13) | Low |
| Win32/Magistr (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Magistr) | February 2006 (V 1.13) | Low |
| Win32/Atak (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Atak) | March 2006 (V 1.14) | Low |
| Win32/Torvil (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Torvil) | March 2006 (V 1.14) | Low |
| Win32/Zlob (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Zlob) | March 2006 (V 1.14) | Moderate |
| Win32/Locksky (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Locksky) | April 2006 (V 1.15) | Moderate |
| Win32/Reatle (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Reatle) | April 2006 (V 1.15) | Low |
| Win32/Valla (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Valla) | April 2006 (V 1.15) | Low |
| Win32/Evaman (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Evaman) | May 2006 (V 1.16) | Low |
| Win32/Ganda (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Ganda) | May 2006 (V 1.16) | Low |
| Win32/Plexus (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Plexus) | May 2006 (V 1.16) | Low |
| Win32/Cissi (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Cissi) | June 2006 (V 1.17) | Low |
| Win32/Fizzer (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Fizzer) | June 2006 (V 1.17) | Low |
| Win32/Alemod (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Alemod) | July 2006 (V 1.18) | Moderate |
| Win32/Chir (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Chir) | July 2006 (V 1.18) | Moderate |
| Win32/Hupigon (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Hupigon) | July 2006 (V 1.18) | Moderate |
| Win32/Nsag (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Nsag) | July 2006 (V 1.18) | Low |
| Win32/Banker (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Banker) | August 2006 (V 1.19) | Moderate |
| Win32/Jeefo (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Jeefo) | August 2006 (V 1.19) | Moderate |
| Win32/Bancos (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Bancos) | September 2006 (V 1.20) | Moderate |
| Win32/Sinowal (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Sinowal) | September 2006 (V 1.20) | Moderate |
| Win32/Harnig (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Harnig) | October 2006 (V 1.21) | Low |
| Win32/Passalert (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Passalert) | October 2006 (V 1.21) | Low |
| Win32/Tibs (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Tibs) | October 2006 (V 1.21) | Moderate |
| Win32/Brontok (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Brontok) | November 2006 (V 1.22) | Moderate |
| Win32/Beenut (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Beenut) | December 2006 (V 1.23) | Low |
| Win32/Haxdoor (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Haxdoor) | January 2007 (V 1.24) | Moderate |
| WinNT/Haxdoor (http://go.microsoft.com/fwlink/?linkid=37020&name=WinNT/Haxdoor) | January 2007 (V 1.24) | Moderate |
| Win32/Stration (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Stration) | February 2007 (V 1.25) | Moderate |
| Win32/Mitglieder (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Mitglieder) | February 2007 (V 1.25) | Low |
| Win32/Alureon (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Alureon) | March 2007 (V 1.27) | Moderate |
| Win32/Funner (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Funner) | April 2007 (V 1.28) | Low |
| Win32/Renos (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Renos) | May 2007 (V 1.29) | Moderate |
| Win32/Allaple (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Allaple) | June 2007 (V 1.30) | Moderate |
| Win32/Busky (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Busky) | July 2007 (V 1.31) | Moderate |
| Win32/Virut.A (http://go.microsoft.com/fwlink/?linkid=37020&name=Virus:Win32/Virut.A) | August 2007 (V 1.32) | Moderate |
| Win32/Virut.B (http://go.microsoft.com/fwlink/?linkid=37020&name=Virus:Win32/Virut.B) | August 2007 (V 1.32) | Moderate |
| Win32/Zonebac (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Zonebac) | August 2007 (V 1.32) | Moderate |
| Win32/Nuwar (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Nuwar) | September 2007 (V 1.33) | Moderate |
| Win32/RJump (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/RJump) | October 2007 (V 1.34) | Moderate |
| Win32/ConHook (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/ConHook) | November 2007 (V 1.35) | Moderate |
| Win32/Fotomoto (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Fotomoto) | December 2007 (V 1.36) | Moderate |
| Win32/Cutwail (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Cutwail) | January 2008 (V 1.37) | Moderate |
| Win32/Ldpinch (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Ldpinch) | February 2008 (V 1.38) | Moderate |
| Win32/Virtumonde (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Virtumonde) | March 2008 (V 1.39) | Moderate |
| Win32/Vundo (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Vundo) | March 2008 (V 1.39) | Moderate |
| Win32/Newacc (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Newacc) | March 2008 (V 1.39) | Moderate |
| Win32/Oderoor (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Oderoor) | May 2008 (V 1.41) | Moderate |
| Win32/Captiya (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Captiya) | May 2008 (V 1.41) | Moderate |
| Win32/Corripio (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Corripio) | June 2008 (V 1.42) | Moderate |
| Win32/Frethog (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Frethog) | June 2008 (V 1.42) | Moderate |
| Win32/Taterf (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Taterf) | June 2008 (V 1.42) | Moderate |
| Win32/Storark (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Storark) | June 2008 (V 1.42) | Moderate |
| Win32/Tilcun (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Tilcun) | June 2008 (V 1.42) | Moderate |
| Win32/Zuten (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Zuten) | June 2008 (V 1.42) | Moderate |
| Win32/Ceekat (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Ceekat) | June 2008 (V 1.42) | Moderate |
| Win32/Lolyda (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Lolyda) | June 2008 (V 1.42) | Moderate |
| Win32/Horst (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Horst) | July 2008 (V 2.0) | Moderate |
| Win32/Matcash (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Matcash) | August 2008 (V 2.1) | Moderate |
| Win32/Slenfbot (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Slenfbot) | September 2008 (V 2.2) | Moderate |
| Win32/Rustock (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Rustock) | October 2008 (V 2.3) | Moderate |
| Win32/FakeSecSen (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/FakeSecSen) | November 2008 (V 2.4 ) | Moderate |
| Win32/Gimmiv (http://go.microsoft.com/fwlink/?linkid=37020&name=Win32/Gimmiv) | November 2008 (V 2.4) | Moderate |
| Win32/FakeXPA (http://www.microsoft.com/security/portal/Entry.aspx?name=Win32%2fFakeXPA) | December 2008 (V 2.5) | Moderate |
| Win32/Yektel (http://www.microsoft.com/security/portal/Entry.aspx?name=Win32%2fYektel) | December 2008 (V 2.5) | Moderate |
| Win32/Banload (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fBanload) | January 2009 (V 2.6) | Moderate |
| Win32/Conficker (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fConficker) | January 2009 (V 2.6) | High |
| Win32/Srizbi (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fSrizbi) | February 2009 (V 2.7 ) | Moderate |
| Win32/Koobface (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fKoobface) | March 2009 (V 2.8) | Moderate |
| Win32/Waledac (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fWaledac) | April 2009 (V 2.9) | Moderate |
| Win32/Winwebsec (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fWinwebsec) | May 2009 (V 2.10) | Moderate |
| Win32/InternetAntivirus (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fInternetAntivirus) | June 2009 (V 2.11) | Moderate |
| Win32/FakeSpypro (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fFakeSpypro) | July 2009 (V 2.12) | Moderate |
| Win32/FakeRean (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fFakeRean) | August 2009 (V 2.13) | Moderate |
| Win32/Bredolab (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fBredolab) | September 2009 (V 2.14) | Moderate |
| Win32/Daurso (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fDaurso) | September 2009 (V 2.14) | Moderate |
| Win32/FakeScanti (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fFakeScanti) | October 2009 (V 3.0) | Moderate |
| Win32/FakeVimes (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fFakeVimes) | November 2009 (V 3.1) | Moderate |
| Win32/PrivacyCenter (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fPrivacyCenter) | November 2009 (V 3.1) | Moderate |
| Win32/Hamweq (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fHamweq) | December 2009 (V 3.2) | Moderate |
| Win32/Rimecud (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fRimecud) | January 2010 (V 3.3) | Moderate |
| Win32/Pushbot (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fPushbot) | February 2010 (V 3.4) | Moderate |
| Win32/Helpud (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fHelpud) | March 2010 (V 3.5) | Moderate |
| Win32/Magania (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fMagania) | April 2010 (V 3.6) | Moderate |
| Win32/Oficla (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fOficla) | May 2010 (V 3.7) | Moderate |
| Win32/FakeInit (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fFakeInit) | June 2010 (V 3.8) | Moderate |
| Win32/Bubnix (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fBubnix) | July 2010 (V 3.9) | Moderate |
| Win32/Stuxnet (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fStuxnet) | August 2010 (V 3.10) | Moderate |
| Win32/CplLnk (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fCplLnk) | August 2010 (V 3.10) | Moderate |
| Worm:Win32/Vobfus.gen!A (http://www.microsoft.com/security/portal/Entry.aspx?Name=Worm:Win32/Vobfus.gen!A) | August 2010 (V 3.10) | Moderate |
| Worm:Win32/Vobfus.gen!B (http://www.microsoft.com/security/portal/Entry.aspx?Name=Worm:Win32/Vobfus.gen!B) | August 2010 (V 3.10) | Moderate |
| Worm:Win32/Vobfus.gen!C (http://www.microsoft.com/security/portal/Entry.aspx?Name=Worm:Win32/Vobfus.gen!C) | August 2010 (V 3.10) | Moderate |
| Worm:Win32/Vobfus!dll (http://www.microsoft.com/security/portal/Entry.aspx?Name=Worm:Win32/Vobfus!dll) | August 2010 (V 3.10) | Moderate |
| Worm:Win32/Sality.AU (http://www.microsoft.com/security/portal/Entry.aspx?Name=Worm:Win32/Sality.AU) | August 2010 (V 3.10) | Moderate |
| Virus:Win32/Sality.AU (http://www.microsoft.com/security/portal/Entry.aspx?Name=Virus:Win32/Sality.AU) | August 2010 (V 3.10) | Moderate |
| Trojan:WinNT/Sality (http://www.microsoft.com/security/portal/Entry.aspx?Name=Trojan:WinNT/Sality) | August 2010 (V 3.10) | Moderate |
| Win32/FakeCog (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fFakeCog) | September 2010 (V 3.11) | Moderate |
| Win32/Vobfus (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fVobfus) | September 2010 (V 3.11) | Moderate |
| Win32/Zbot (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fZbot) | October 2010 (V 3.12) | Moderate |
| Win32/FakePAV (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fFakePAV) | November 2010 (V 3.13) | Moderate |
| Worm:Win32/Sality.AT (http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Worm%3aWin32%2fSality.AT) | November 2010 (V 3.13) | Moderate |
| Virus:Win32/Sality.AT (http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Virus%3aWin32%2fSality.AT) | November 2010 (V 3.13) | Moderate |
| Win32/Qakbot (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fQakbot) | December 2010 (V 3.14) | Moderate |
| Win32/Lethic (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fLethic) | January 2011 (V 3.15) | Moderate |
| Win32/Cycbot (http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fCycbot) | February 2011 (V 3.16) | Moderate |
*The severity rating refers to the virus alert severity ratings that appear on the following Microsoft Web site: http://www.microsoft.com/technet/security/bulletin/rating.mspx (http://www.microsoft.com/technet/security/bulletin/rating.mspx)
Be aware that the severity ratings of threats may be updated occasionally to account for changes in prevalence and other factors.
**W32/Hackdef typically hides other potentially unwanted software on the computer. If the cleaner tool reports that W32/Hackdef was detected on the computer, we strongly recommend that you run a scan with up-to-date antivirus and antispyware programs (see http://www.microsoft.com/protect/computer/spyware/default.mspx (http://www.microsoft.com/protect/computer/spyware/default.mspx) ). If you want to view the software that W32/Hackdef was hiding, first open the log file for the cleaner tool (%Windir%\Debug\Mrt.log). Next, in the "Possible scanning results" section, find the line or lines that note the folder in which Win32/Hackdef was found. In that same folder, you should find the Win32/Hackdef configuration file that has the .ini file name extension. View this file to determine the software that Win32/Hackdef was hiding on the computer.
Any malicious software that is not listed in this table is not detected and not removed by the tool. To scan for and remove other malicious software, use an up-to-date antivirus product. For more information, visit the following Microsoft Protect Your PC Web site: http://www.microsoft.com/canada/athome/security/protect/windowsxpsp2/default.mspx (http://www.microsoft.com/canada/athome/security/protect/windowsxpsp2/default.mspx)
Back to the top
The Malicious Software Removal Tool sends information to Microsoft if it detects malicious software or finds an error. The specific information that is sent to Microsoft consists of the following items:
If apparently malicious software is found on the computer, the tool prompts you to send information to Microsoft beyond what is listed here. You are prompted in each of these instances, and this information is sent only with your consent. The additional information includes the following:
You can disable the reporting feature. For information about how to disable the reporting component and how to prevent this tool from sending information to Microsoft, click the following article umber to view the article in the Microsoft Knowledge Base:
891716 (http://support.microsoft.com/kb/891716/ ) Deployment of the Microsoft Windows Malicious Software Removal Tool in an enterprise environment
Back to the top
After the tool runs, there are four main results that the removal tool can report to the user:

Article ID:
890830
Last Review:
February 8, 2011 - Revision: 84.0
| ADDITIONAL RESOURCES | ||||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
| Community | ||||||||
|