Malicious Software Removal Tool

The Microsoft Malicious Software Removal Tool (MSRT) is designed to remove very specific malware - about 174 families as of April 2011. The tool is cumulative - once a family signature is added for detection, that signature remains in the tool even though the family may no longer be active.

The Microsoft Malicious Software Removal Tool (MSRT) is delivered monthly via Windows Updates as an "Important" update. Depending on whether you have Automatic Updates enabled and how it is configured, the MSRT download may occur automatically, or you may be prompted first. Note that malware typically disables the Windows Automatic Updates feature so it's important to periodically check to ensure this feature is working. (See: How to Enable Windows Automatic Updates).

MSRT is not a replacement for antivirus software, first because it doesn't protect against malware infection (it's a removal tool only), and second because it deals with such a small subset of in-the-wild malware.

MSRT is not a barometer of malware prevalence. Data collected from the MSRT is published in the Microsoft Security Intelligence Report. While the Microsoft reports very specifically identify the source of their findings, the data is still sometimes misquoted or misunderstood by the media.

While vendor classifications vary, as an example G Data reported 2608 active malware families in the second half of 2010. Note that the G Data figure is for "active" families only. Also note that a single family can comprise thousands or even tens of thousands of malware variants. The MSRT, with 174 families as of April 2011 (not all of which are active) equates to a .07% detection rate at best if using the G Data family count.

These limitations do not mean the MSRT isn't providing a valuable function. The Microsoft Malicious Software Removal Tool is specifically designed to remove particularly prevalent malware families that have been identified as problematic by various global security organizations. And because it is delivered via automatic updates (or via the Windows Update center), it is accessible to the majority of Windows users.

In summary, the Microsoft Malicious Software Removal Tool is a very accessible (and free) adjunct to existing antivirus protection, but it is not a replacement for antivirus and its detection data is not indicative of overall malware infection rates or of overall malware prevalance.