Deployment of the Microsoft Windows Malicious Software Removal Tool in an enterprise environment (891716)

INTRODUCTION

Microsoft has released the Microsoft Windows Malicious Software Removal Tool to help you remove specific, prevalent malicious software from your computer.

The information that is contained in this article is specific to the enterprise deployment of the tool. We highly recommended that you review the following Microsoft Knowledge Base article. It contains general information about the tool and about the download locations. For more information, click the following article number to view the article in the Microsoft Knowledge Base: The tool is primarily intended for noncorporate users who do not have an existing, up-to-date antivirus product installed on their computers. However, the tool can also be deployed in an enterprise environment to enhance existing protection and as part of a defense-in-depth strategy. To deploy the tool in an enterprise environment, you can use one or more of the following methods:

• Windows Server Update Services
• SMS Software Package
• Group Policy-based computer startup script
• Group Policy-based user logon script

For more information about deploying the tool through Windows Update and Automatic Updates, click the following article number to view the article in the Microsoft Knowledge Base: The current version of this tool does not support the following deployment technologies and techniques:

• Windows Update Catalog
• Execution of the tool against a remote computer
• Software Update Services (SUS)

Additionally, the Microsoft Baseline Security Analyzer (MBSA) does not detect execution of the tool. This article includes information about how you can verify execution of the tool as part of deployment.

Code sample

The script and the steps that are provided here are only meant to be samples and examples. Customers must test these sample scripts and example scenarios and modify them appropriately to work in their environment. You will have to change the ServerName and the ShareName according to the setup in your environment.

The following code sample does the following things:

• Runs the tool in silent mode
• Copies the log file to a preconfigured network share
• Prefixes the log file name with the name of the computer that the tool is executed from and with the username of the current user. You must set appropriate permissions on the share according to the instructions in the Initial setup and configuration section.

REM In this example, the script is named RunMRT.cmd.
REM The Sleep.exe utility is used to delay the execution of the tool when used as a 
REM startup script. See the "Known issues" section for details.
@echo off
call \\ServerName\ShareName\Sleep.exe 5
Start /wait \\ServerName\ShareName\Windows-KB890830-V1.21.exe /q

copy %windir%\debug\mrt.log \\ServerName\ShareName\Logs\%computername%_%username%_mrt.log

Note In this code sample, ServerName is a placeholder for the name of your server, and ShareName is a placeholder for the name of your share.

Initial setup and configuration

This section is intended for administrators who are using a startup script or a logon script to deploy this tool. If you are using Systems Management Server (SMS), you can continue to the "Deployment methods" section.

To configure the server and the share, follow these steps:

1. Set up a share on a member server. Then name the share ShareName.
2. Copy the tool and the sample script, RunMRT.cmd, to the share. See the Code sample section for details.
3. Configure the following share permissions and NTFS file system permissions:
   • Share permissions:
     1. Add the domain user account for the user who is managing this share, and then click Full Control.
     2. Remove the Everyone group.
     3. If you use the computer startup script method, add the Domain Computers group with Change and Read permissions.
     4. If you use the logon script method, add the Authenticated Users group with Change and Read permissions.
   • NTFS permissions:
     1. Add the domain user account for the user who is managing this share, and then click Full Control.
     2. Remove the Everyone group if it is in the list.
        
        Note If you receive an error message when you remove the Everyone group, click Advanced on the Security tab, and then click to clear the Allow inheritable permissions from parent to propagate to this object check box.
     3. If you use the computer startup script method, grant the Domain Computers group Read & Execute permissions, List Folder Contents permissions, and Read permissions.
     4. If you use the logon script method, grant the Authenticated Users group Read & Execute permissions, List Folder Contents permissions, and Read permissions.
4. Under the ShareName folder, create a folder that is named Logs.
   
   This is where the final log files will be collected after the tool runs on the client computers.
5. To configure the NTFS permissions on the Logs folder, follow these steps.
   
   Note Do not change the Share permissions in this step.
   1. Add the domain user account for the user who is managing this share, and then click Full Control.
   2. If you use the computer startup script method, give the Domain Computers group Modify permissions, Read & Execute permissions, List Folder Contents permissions, Read permissions, and Write permissions.
   3. If you use the logon script method, give the Authenticated Users group Modify permissions, Read & Execute permissions, List Folder Contents permissions, Read permissions, and Write permissions.

Deployment methods

Note To run this tool, you must have Administrator permissions or SYSTEM permissions, regardless of the deployment option that you choose.

Using SMS software package

The following example provides step-by-step instructions for using SMS 2003. The steps for using SMS 2.0 are similar to these steps.

1. Extract the Mrt.exe file from the package that is named Windows-KB890830-V1.12-ENU.exe /x.
2. Create a .bat file to start Mrt.exe and to capture the return code by using ISMIF32.exe.
   
   The following is an example.

   @echo off
   Mrt.exe /q
   If errorlevel 13 goto error13
   If errorlevel 12 goto error12
   Goto end
   
   :error13
   Ismif32.exe -f MIFFILE -p MIFNAME -d "text about error 13"
   Goto end
   
   :error12
   Ismif32.exe -f MIFFILE -p MIFNAME -d "text about error 12"
   Goto end
   
   :end
   

   For more information about Ismif32.exe, click the following article numbers to view the articles in the Microsoft Knowledge Base:

   268791 How a status Management Information Format (MIF) file produced by the ISMIF32.exe file is processed in SMS 2.0

   186415 Status MIF creator, Ismif32.exe is available

3. To create a package in the SMS 2003 console, follow these steps:
   1. Open the SMS Administrator Console.
   2. Right-click the Packages node, click New, and then click Package.
      
      The Package Properties dialog box appears.
   3. On the General tab, name the package.
   4. On the Data Source tab, click to select the This package contains source files check box.
   5. Click Set, and then choose a source directory that contains the tool.
   6. On the Distribution Settings tab, set the Sending priority to High.
   7. On the Reporting tab, click Use these fields for status MIF matching, and then specify a name for the MIF file name field and for the Name field.
      
      Version and Publisher are optional.
   8. Click OK to create the package.
4. To specify a Distribution Point (DP) to the package, follow these steps:
   1. In the SMS 2003 console, locate the new package under the Packages node.
   2. Expand the package. Right-click Distribution Points, point to New, and then click Distribution Points.
   3. Start the New Distribution Points Wizard. Select an existing Distribution Point.
   4. Click Finish to close the wizard.
5. To add the batch file that was previously created to the new package, follow these steps:
   1. Under the new package node, click the Programs node.
   2. Right-click Programs, point to New, and then click Program.
   3. Click the General tab, and then enter a valid name.
   4. At the Command line, click Browse to select the batch file that you created to start Mrt.exe.
   5. Change Run to Hidden. Change After to No action required.
   6. Click the Requirements tab, and then click This program can run only on specified client operating systems.
   7. Click All x86 Windows 2000, All x86 Windows Server 2003, and All x86 Windows XP.
   8. Click the Environment tab, click Whether a user is logged in the Program can run list. Set the Run mode to Run with administrative rights.
   9. Click OK to close the dialog box.
6. To create an advertisement to advertise the program to clients, follow these steps:
   1. Right-click the Advertisement node, click New, and then click Advertisement.
   2. On the General tab, enter a name for the advertisement. In the Package field, select the package that you previously created. In the Program field, select the program that you previously created. Click Browse, and then click the All System collection or select a collection of computers that only includes Microsoft Windows 2000 and later versions.
   3. On the Schedule tab, leave the default options if you want the program to only run one time. To run the program on a schedule, assign a schedule interval.
   4. Set the Priority to High.
   5. Click OK to create the advertisement.

Using a Group Policy-based computer startup script

This method requires that you restart the client computer after you set up the script and after you apply the Group Policy setting.

1. Set up the shares. To do this, follow the steps in the Initial setup and configuration section.
2. Set up the startup script. To do this, follow these steps:
   1. In the Active Directory Users and Computers MMC snap-in, right-click the domain name, and then click Properties.
   2. Click the Group Policy tab.
   3. Click New to create a new Group Policy object (GPO), and type MRT Deployment for the name of the policy.
   4. Click the new policy, and then click Edit.
   5. Expand Windows Settings for Computer Configuration, and then click Scripts.
   6. Double-click Logon, and then click Add.
      
      The Add a Script dialog box appears.
   7. In the Script Name box, type \\ServerName\ShareName\RunMRT.cmd.
   8. Click OK, and then click Apply.
3. Restart the client computers that are members of this domain.

Using a Group Policy-based user logon script

This method requires that the logon user account is a domain account and is a member of the local administrator's group on the client computer.

1. Set up the shares. To do this, follow the steps in the Initial setup and configuration section.
2. Set up the logon script. To do this, follow these steps:
   1. In the Active Directory Users and Computers MMC snap-in, right-click the domain name, and then click Properties.
   2. Click the Group Policy tab.
   3. Click New to create a new GPO, and then type MRT Deployment for the name.
   4. Click the new policy, and then click Edit.
   5. Expand Windows Settings for User Configuration, and then click Scripts.
   6. Double-click Logon, and then click Add. The Add a Script dialog box appears.
   7. In the Script Name box, type \\ServerName\ShareName\RunMRT.cmd.
   8. Click OK, and then click Apply.
3. Log off and then log on to the client computers.

In this scenario, the script and the tool will run under the context of the logged-on user. If this user does not belong to the local administrators group or does not have sufficient permissions, the tool will not run and will not return the appropriate return code. For more information about using startup scripts and logon scripts, click the following article numbers to view the articles in the Microsoft Knowledge Base:

Additional information relevant to enterprise deployment

Examining return codes

You can examine the return code of the tool in your deployment logon script or in your deployment startup script to verify the results of execution. See the Code sample section for an example of how to accomplish this.

The following list contains the valid return codes.

0	=	No infection found
1	=	OS Environment Error
2	=	Not running as an Administrator
3	=	Not a supported OS
4	=	Error Initializing the scanner. (Download a new copy of the tool)
5	=	Not used
6	=	At least one infection detected. No errors.
7	=	At least one infection was detected, but errors were encountered.
8	=	At least one infection was detected and removed, but manual steps are required for a complete removal.
9	=	At least one infection was detected and removed, but manual steps are required for complete removal and errors were encountered.
10	=	At least one infection was detected and removed, but a restart is required for complete removal
11	=	At least one infection was detected and removed but a restart is required for complete removal and error(s) were encountered
12	=	At least one infection was detected and removed but both manual step(s) and a restart is required for complete removal.
13	=	At least one infection was detected and removed but a reboot is required. No errors were encountered.

Parsing the log file

The Malicious Software Removal Tool writes details about the result of its execution in the %windir%\debug\mrt.log log file.

Notes

• This log file is available only in English.
• Starting with version 1.2, March, of the removal tool, this log file uses Unicode text. Before version 1.2, the log file used ANSI text.
• The log file format has changed with version 1.2, March, and we recommend that you download and use the latest version of the tool.
  
  If this log file already exists, the tool appends to the existing file.
• You can use a command script that is similar to the previous example to capture the return code and to collect the files to a network share.
• Because of the switch from ANSI to Unicode, version 1.2 of the removal tool will copy any ANSI versions of Mrt.log in %WINDIR%\debug to Mrt.log.old in the same directory and create a new Unicode version of Mrt.log in that same directory. Like the ANSI version, this log file will be appended to each month.

The following example is an Mrt.log file from a computer that was infected with the Sasser.A worm:

Microsoft Windows Malicious Software Removal Tool v1.2, March 2005
Started On Wed May 01 21:21:42 2002
 
Scanning Results:
----------------
Found virus: Win32/Sasser.A.worm in process 1856
Found virus: Win32/Sasser.A.worm in process 1856
Found virus: Win32/Sasser.A.worm in file C:\WINDOWS\avserve.exe
Found virus: Win32/Sasser.A.worm in process 1856
Found virus: Win32/Sasser.A.worm in file C:\WINDOWS\avserve.exe
 
Removal Results:
----------------
Terminating process with pid 1856
Operation succeeded !
 
Terminating process with pid 1856
Operation had previously completed.
 
Terminating process with pid 1856
Operation had previously completed.
 
Deleting registry value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, entry: avserve.exe
Operation succeeded !
 
Deleting file C:\WINDOWS\avserve.exe
Operation succeeded !
 
Deleting file C:\WINDOWS\avserve.exe
Operation had previously completed.
 

Results Summary:
----------------
Found Win32/Sasser.A.worm and Removed!
 
Return code: 6
Microsoft Windows Malicious Software Removal Tool Finished On Wed May 01 21:21:45 2002

The following is an example log file where no malicious software is found.

Microsoft Windows Malicious Software Removal Tool v1.2, March 2005
Started On Wed May 01 21:19:01 2002
 
Results Summary:
----------------
No infection found.
 
Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Wed May 01 21:19:05 2002

The following is an example log file where errors are found. For more information about warnings and errors that are caused by the tool, click the following article number to view the article in the Microsoft Knowledge Base:

Microsoft Windows Malicious Software Removal Tool v1.2, March 2005
Started On Wed May 01 21:27:57 2002
 
Scanning Results:
----------------
Found virus: Win32/HLLW.Gaobot.ZF in process 1880
Found virus: Win32/HLLW.Gaobot.ZF in process 1880
Found virus: Win32/HLLW.Gaobot.ZF in file C:\WINDOWS\System32\winsec16.exe
Found virus: Win32/HLLW.Gaobot.ZF in process 1880
Found virus: Win32/HLLW.Gaobot.ZF in process 1880
Found virus: Win32/HLLW.Gaobot.ZF in file C:\WINDOWS\System32\winsec16.exe
Found virus: Win32/HLLW.Gaobot.ZF in file C:\WINDOWS\System32\winsec16.exe
 
Removal Results:
----------------
Terminating process with pid 1880
->Sysclean ERROR: Failed to kill process with PID: 1880 (Win32 Error Code: 0x00000102 (258):The wait operation timed out.) [697]
Operation failed !
 
Terminating process with pid 1880
Operation had previously completed.
 
Terminating process with pid 1880
Operation had previously completed.
 
Deleting registry value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, entry: WinSec
Operation succeeded !
 
Terminating process with pid 1880
Operation had previously completed.
 
Deleting registry value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, entry: WinSec
Operation succeeded !
 
Writing in file C:\WINDOWS\system32\drivers\etc\hosts
Operation succeeded !
 
Deleting file C:\WINDOWS\System32\winsec16.exe
Operation succeeded !
 
Deleting file C:\WINDOWS\System32\winsec16.exe
Operation had previously completed.
 
Deleting file C:\WINDOWS\System32\winsec16.exe
Operation had previously completed.
 

Results Summary:
----------------
For cleaning Win32/HLLW.Gaobot.ZF, the system needs to be restarted.
Found Win32/HLLW.Gaobot.ZF, partially removed.

Known issues

When you run the tool by using a startup script, you may receive error messages that are similar to the following in the Mrt.log file. The pid number will vary.This error occurs when a process is either just starting or when a process has been recently stopped. The only effect is that the process designated by the pid has not been scanned.

To work around this problem, use the Sleep.exe Platform SDK utility to delay five seconds in the startup script before running the tool. See the previous sample script. This delay lets processes on the computer stabilize after the restart process.

FAQ

Q1. When I test my startup or logon script to deploy the tool, I do not see the log files being copied to the network share that I set up. Why?

A1. This is frequently caused by permissions issues. For example, the account that the removal tool was run from does not have Write permission to the share. To troubleshoot this, first make sure that the tool ran by checking the registry key. Alternatively, you can look for the presence of the log file on the client computer. If the tool successfully ran, you can test a simple script and make sure that it can write to the network share when it runs under the same security context the removal tool was run.

Q2. How do I verify whether the removal tool has run on a client computer?

A2. You can examine the value data for following registry entry to verify the execution of the tool. You can implement such a check as part of a startup script or a logon script. This will prevent the tool from running multiple times. Every time the tool is run, independent of the results of the execution, the tool will record a GUID to the registry to indicate that it has been executed. The following table lists the GUID that corresponds to each release.

Release	Value data
January 2005	E5DD9936-C147-4CD1-86D3-FED80FAADA6C
February 2005	805647C6-E5ED-4F07-9E21-327592D40E83
March 2005	F8327EEF-52AA-439A-9950-CE33CF0D4FDD
April 2005	D89EBFD1-262C-4990-9927-5185FED1F261
May 2005	08112F4F-11BF-4129-A90A-9C8DD0104005
June 2005	63C08887-00BE-4C9B-9EFC-4B9407EF0C4C
July 2005	2EEAB848-93EB-46AE-A3BF-9F1A55F54833
August 2005	3752278B-57D3-4D44-8F30-A98F957EC3C8
August 2005 A	4066DA74-2DDE-4752-8186-101A7C543C5F
September 2005	33B662A4-4514-4581-8DD7-544021441C89
October 2005	08FFB7EB-5453-4563-A016-7DBC4FED4935
November 2005	1F5BA617-240A-42FF-BE3B-14B88D004E43
December 2005	F8FEC144-AA00-48B8-9910-C2AE9CCE014A
January 2006	250985ee-62e6-4560-b141-997fc6377fe2
February 2006	99cb494b-98bf-4814-bff0-cf551ac8e205
March 2006	b5784f56-32ca-4756-a521-ca57816391ca
April 2006	d0f3ea76-76c8-4287-8cdf-bdfee5e446ec
May 2006	ce818d5b-8a25-47c0-a9cd-7169da3f9b99
June 2006	7cf4b321-c0dd-42d9-afdf-edbb85e59767
July 2006	5df61377-4916-440f-b23f-321933b0afd3
August 2006	37949d24-63f1-4fdc-ad24-5dc3eb3ad265
September 2006	ac3fa517-20f0-4a42-95ca-6383f04773c8
October 2006	79e385d0-5d28-4743-aeb3-ed101c828abd

Q3. How can I disable the infection-reporting component of the tool so that the report is not sent back to Microsoft?

A3. An administrator can choose to disable the infection-reporting component of the tool by adding the following registry key value to computers. If this registry key value is set, the tool will not report infection information back to Microsoft.This functionality is automatically disabled if the following registry key value exists: This registry key value indicates that the computer is connected to an SUS server.

Q4. With the March release, data in the Mrt.log file appears to have been lost. Why was this data removed, and is there a way for me to retrieve it?

A4. Starting with the March release, the Mrt.log file is being written as a Unicode file. To make sure of compatibility, when the March version of the tool is run, if an ANSI version of the file is on the system, the tool will copy the contents of that log to Mrt.log.old in %WINDIR%\debug and create a new Unicode version of Mrt.log. Like the ANSI version, this Unicode version will be appended to with each successive execution of the tool.