How to Use Malicious Software Removal Tool in Windows


The Microsoft Windows Malicious Software Removal Tool (MSRT) is a post-infection removal tool that helps remove malicious software from your computers that are running Windows 10, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows Server 2012 R2, Windows 8.1, Windows Server 2012 R2, Windows Server 2012, or Windows 7.

Starting May 2020, Microsoft releases the MSRT on a quarterly cadence as part of Windows Update or as a standalone tool. You can use this tool to find and remove specific prevalent threats and reverse the changes they have made (see covered malware families). For comprehensive malware detection and removal, consider using Microsoft Safety Scanner.

The Microsoft Malicious Software Removal Tool does not replace an antivirus product. It is strictly a post-infection removal tool. Therefore, we strongly recommend that you install and use an up-to-date antivirus product. If you like, Windows 10 already has Windows Defender Antivirus included for antivirus.

The Microsoft Malicious Software Removal Tool differs from an antivirus product in three key ways:

• The tool removes malicious software from an already-infected computer. Antivirus products block malicious software from running on a computer. It is significantly more desirable to block malicious software from running on a computer than to remove it after infection.
• The tool removes only specific prevalent malicious software. Specific prevalent malicious software is a small subset of all the malicious software that exists today.
• The tool focuses on the detection and removal of active malicious software. Active malicious software is malicious software that is currently running on the computer. The tool cannot remove malicious software that is not running. However, an antivirus product can perform this task.

The MSRT focuses on the detection and removal of malicious software such as viruses, worms, and Trojan horses only. It does not remove spyware.

You do not have to disable or remove your antivirus program when you install the MSRT. However, if prevalent, malicious software has infected your computer, the antivirus program may detect this malicious software and may prevent the removal tool from removing it when the removal tool runs. In this case, you can use your antivirus program to remove the malicious software.

Because the MSRT does not contain a virus or a worm, the removal tool alone should not trigger your antivirus program. However, if malicious software infected the computer before you installed an up-to-date antivirus program, your antivirus program may not detect this malicious software until the tool tries to remove it.

If MSRT is downloaded from Windows Update, the tool runs only one time each month. To manually run the tool multiple times a month, download the tool from the Download Center.

The MSRT tool runs in quiet mode unless it finds an infection. If it detects malicious software on your computer, the next time that you sign in to your computer as an administrator, a balloon appears in the notification area to make you aware of the detection. If you have not been notified of an infection, no malicious software has been found that requires your attention.

Performing a full scan

If the tool finds malicious software, you may be prompted to perform a full scan. We recommend that you perform this scan. A full scan performs a quick scan and then a full scan of the computer, regardless of whether malicious software is found during the quick scan. This scan can take several hours to complete because it will scan all fixed and removable drives. However, mapped network drives are not scanned.

Removing malicious files

If malicious software has modified (infected) files on your computer, the tool prompts you to remove the malicious software from those files. If the malicious software modified your browser settings, your homepage may be changed automatically to a page that gives you directions on how to restore these settings.

You can clean specific files or all the infected files that the tool finds. Be aware that some data loss is possible during this process. Also, be aware that the tool may be unable to restore some files to the original, pre-infection state.

The removal tool may request that you restart your computer to complete the removal of some malicious software, or it may prompt you to perform manual steps to complete the removal of the malicious software. To complete the removal, you should use an up-to-date antivirus product.

Reporting infection information to Microsoft

The Malicious Software Removal Tool will send basic information to Microsoft if the tool detects malicious software or finds an error. This information will be used for tracking virus prevalence. No identifiable personal information that is related to you or to the computer is sent together with this report.

This tutorial will show you how to open and use the Malicious Software Removal Tool (MSRT) to scan and remove specific prevalent malicious software in Windows.

The Malicious Software Removal Tool scan log is located at: C:\Windows\Debug\mrt.log

Microsoft releases a new version of the Malicious Software Removal Tool every second Tuesday of each month. MSRT is updated in Windows with Windows Update KB890830. You can also download and install MSRT for your 32-bit (x86) or 64-bit (x64) Windows.

Windows Malicious Software Removal Tool 32-bit

Windows Malicious Software Removal Tool 64-bit

Contents

• Option One: To Open and Use Malicious Software Removal Tool
• Option Two: To Run Malicious Software Removal Tool in Command Prompt

OPTION ONE

To Open and Use Malicious Software Removal Tool

1 Type mrt ("C:\Windows\System32\MRT.exe") in the search box (Windows+S) on Start menu or taskbar, and press Enter to open Malicious Software Removal Tool.

2 Click/tap on Next. (see screenshot below)

3 Do step step 4 (quick), step 5 (full), or step 6 (custom) below for what type of scan you want to run.

 4. To Run a Quick Scan with MSRT

This will scan areas of the system most likely to contain malicious software. If malicious software is found, you may be prompted to run a full scan.

A) Select (dot) Quick scan, click/tap on Next, and go to step 7 below. (see screenshot below)

 5. To Run a Full Scan with MSRT

This will scan the entire system. This scan can take up to several hours depending on how much data you have to scan.

A) Select (dot) Full scan, click/tap on Next, and go to step 7 below. (see screenshot below)

 6. To Run a Customized Scan with MSRT

This will run a quick scan first, and then will scan the contents of the folder or drive you specified.

A) Select (dot) Customized scan, and click/tap on Choose Folder. (see screenshot below)

B) Browse to and select a folder or drive you want to scan, and click/tap on OK. (see screenshot below)

C) Click/tap on Next, and go to step 7 below. (see screenshot below step A)

7 MSRT will now start scanning your computer. (see screenshot below)

8 When the scan finishes, you will see the results, and can click/tap on the View detailed results of the scan link. When finished, click/tap on Finish. (see screenshots below)

OPTION TWO

To Run Malicious Software Removal Tool in Command Prompt

1 Open and elevated command prompt.

2. In the elevated command prompt, copy and paste the command in bold below you want to use, and press Enter.

MRT /F = Opens MSRT UI, and performs a forced full scan.

MRT /F /Q = Performs a forced full scan without opening MSRT UI.

MRT /F:Y = Opens MSRT UI, performs a forced full scan, and automatically clean infected files.

MRT /F:Y /Q = Performs a forced full scan, and automatically clean infected files without opening MSRT UI.

That's it,
Shawn Brink

Related Tutorials

---

• How to Turn On or Off Windows 10 Limited Periodic Scanning with Windows Defender
• How to Manually Scan Files, Folders, and Drives with Windows Defender Antivirus in Windows 10
• How to Use Microsoft Safety Scanner in Windows

Windows 11 Tutorials