Microsoft Windows Malicious Software Removal Tool

This post provide furthur information about Microsoft Windows Support. It contain the information about Microsoft malicious Software removal tools.

This tool checks your computer for infection by specific, prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps to remove the infection if it is found. Microsoft will release an updated version of this tool on the second Tuesday of each month.

The Microsoft Windows Malicious Software Removal Tool checks Windows Vista, Windows XP, Windows 2000, and Windows Server 2003 computers for and helps remove infections by specific, prevalent malicious software—including Blaster, Sasser, and Mydoom. When the detection and removal process is complete, the tool displays a report describing the outcome, including which, if any, malicious software was detected and removed. The tool creates a log file named mrt.log in the %WINDIR%\debug folder.

Note that x64 version of this tool will only run on Vista x64, Windows XP x64 and Windows 2003 x64 computers.


This tool is not a replacement for an anti-virus support product. To help protect your computer, you should use an anti-virus product.


Microsoft will release an updated version of this tool on the second Tuesday of each month. New versions will be made available through this web page, Windows Update, and the Malicious Software Removal Tool Web site on Microsoft.com.

To have the newest versions automatically delivered and installed as soon as they are released, set the Automatic Updates feature to Automatic. The version of this tool delivered by Windows Update runs on your computer once a month, in the background. If an infection is found, the tool will display a status report the next time you start your computer. If you would like to run this tool more than once a month, run the version that is available from this Web page or use the version on the Malicious Software Removal Tool Support Web site.

Manual steps to remove the Conficker.b variant

Do not log on to the system by using a Domain account, if it is possible. Especially, do not log on by using a Domain Admin account. The malware impersonates the logged on user and accesses network resources by using the logged on user credentials. This behavior allows the malware to spread.

The Server service should only be disabled temporarily while you clean up the malware in your environment. This is especially true on production servers because this step will affect network resource availability. As soon as the environment is cleaned up, the Server service can be re-enabled.

To stop the Server service, use the Services Microsoft Management Console (MMC). To do this, follow these steps:

1. Depending on your system, do the following:
* In Windows Vista and Windows Server 2008, click Start, type services.msc in the Start Search box, and then click services.msc in the Programs list.
* In Windows 2000, Windows XP, and Windows Server 2003, click Start, click Run, type services.msc, and then click OK.
2. Double-click Server.
3. Click Stop.
4. Select Disabled in the Startup type box.
5. Click Apply.

Remove all AT-created scheduled tasks. To do this, type AT /Delete /Yes at a command prompt.
Stop the Task Scheduler service.

* To stop the Task Scheduler service in Windows 2000, Windows XP, and Windows Server 2003, use the Services Microsoft Management Console (MMC) or the SC.exe utility.
* To stop the Task Scheduler service in Windows Vista or in Windows Server 2008, follow these steps.

For more about Manual Removal of Conficker visit on Virus Removal Center