What is MRT.exe (Windows Malicious Software Removal Tool)

Do you happen to see a lot of disk activity and you’re wondering what the MRT.exe is? Also, here are some infos why you should *not* delete the MRT.exe or disable anonymous reports.

What is it?

MRT.exe is the Windows Malicious Software Removal Tool. It scans for malicious files like viruses in the background and is updating itself every patch day (second Tuesday in a month). The program (MRT.exe) will have a lot of disk activity at specific times and is also sending anonymous data to Microsoft about viruses and problems. There’s nothing wrong with that, in fact it’s a positive sign when the MRT.exe is running in the background.

Where is the MTR.exe located?

MRT.exe can be found in C:/Windows/system32 .. any other path should be considered a security warning and analysed immediately!

Do I need the MRT.exe

If you have secured your system with other security tools, such as Malwarebytes, SuperAntiSpyware, Search & Destroy or Adware (Top5 Spyware Scanner for Windows 7), you may not need the MRT.exe. You can disable the Windows 7 security center completely AND delete the file MRT.exe after creating a backup. However, I advise you not do this, more below.

Is it safe to delete MRT.exe?

Yes, you can safely delete the MRT.exe. However, I urge you not do this if you want to keep your PC secure. Only if you have encountered problems with that specific program I would consider removing it. Also, before you remove the MRT.exe create a backup, although you can probably restore it via sfc.exe anyway since it’s stored in the system32 folder.

I want to keep the MRT.exe, but disable anonymous reports. How?

You may want to disable anonymous reports that are send to Microsoft. However, since it is anonymous this is not a security-risk and will help Microsoft to improve their tool to find even more viruses.

Unfortunately, virus creators attack more and more endusers with viruses that are not recognized. Keep in mind, viruses that are not very common can often not be identified by anti-virus software. Therefore security firms rely on anonymous reports to find new viruses! You can actively help to find new viruses if you enable anonymous reports.

If you still want to disable anonymous reports, you may download this registry key: Disable anonymous MRT.exe reports

Alternatively, you can copy the following text into a notepad and save it as a .reg file, then execute via double-click:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
“DontReportInfectionInformation”=dword:00000001