How to Use Malicious Software Removal Tool in Windows

The Microsoft Windows Malicious Software Removal Tool (MSRT) helps remove malicious software from your computers that are running Windows 10, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows Server 2012 R2, Windows 8, Windows Server 2012, Windows 7, or Windows Server 2008


Microsoft generally releases the MSRT monthly as part of Windows Update or as the standalone tool. Use this tool to find and remove specific prevalent threats and reverse the changes they have made (see covered malware families). For comprehensive malware detection and removal, consider using Microsoft Safety Scanner.


The Microsoft Malicious Software Removal Tool does not replace an antivirus product. It is strictly a post-infection removal tool. Therefore, we strongly recommend that you install and use an up-to-date antivirus product. If you like, Windows 10 already has Windows Defender Antivirus included for antivirus.


The Microsoft Malicious Software Removal Tool differs from an antivirus product in three key ways:


The tool removes malicious software from an already-infected computer. Antivirus products block malicious software from running on a computer. It is significantly more desirable to block malicious software from running on a computer than to remove it after infection.

The tool removes only specific prevalent malicious software. Specific prevalent malicious software is a small subset of all the malicious software that exists today.

The tool focuses on the detection and removal of active malicious software. Active malicious software is malicious software that is currently running on the computer. The tool cannot remove malicious software that is not running. However, an antivirus product can perform this task.



The Malicious Software Removal Tool runs in quiet mode in the background. If it detects malicious software on your computer, the next time that you log on to your computer as a computer administrator, a balloon will appear in the notification area to make you aware of the detection.


Performing a full scan


If the tool finds malicious software, you may be prompted to perform a full scan. We recommend that you perform this scan. A full scan performs a quick scan and then a full scan of the computer, regardless of whether malicious software is found during the quick scan. This scan can take several hours to complete because it will scan all fixed and removable drives. However, mapped network drives are not scanned.


Removing malicious files


If malicious software has modified (infected) files on your computer, the tool prompts you to remove the malicious software from those files. If the malicious software modified your browser settings, your homepage may be changed automatically to a page that gives you directions on how to restore these settings.


You can clean specific files or all the infected files that the tool finds. Be aware that some data loss is possible during this process. Also, be aware that the tool may be unable to restore some files to the original, pre-infection state.


The removal tool may request that you restart your computer to complete the removal of some malicious software, or it may prompt you to perform manual steps to complete the removal of the malicious software. To complete the removal, you should use an up-to-date antivirus product.


Reporting infection information to Microsoft


The Malicious Software Removal Tool will send basic information to Microsoft if the tool detects malicious software or finds an error. This information will be used for tracking virus prevalence. No identifiable personal information that is related to you or to the computer is sent together with this report.


This tutorial will show you how to open and use the Malicious Software Removal Tool (MSRT) to scan and remove specific prevalent malicious software in Windows.


To Open and Use Malicious Software Removal Tool

1. Type mrt ("C:\Windows\System32\MRT.exe") in the search box (Windows+S) on Start menu or taskbar, and press Enter to open Malicious Software Removal Tool.

2. Click/tap on Next.

3. Do step step 4 (quick), step 5 (full), or step 6 (custom) below for what type of scan you want to run.

4. To Run a Quick Scan with MSRT

A) Select (dot) Quick scan, click/tap on Next, and go to step 7.

5. To Run a Full Scan with MSRT

A) Select (dot) Full scan, click/tap on Next, and go to step 7

6. To Run a Customized Scan with MSRT

A) Select (dot) Customized scan, and click/tap on Choose Folder

B) Browse to and select a folder or drive you want to scan, and click/tap on OK.

C) Click/tap on Next, and go to step 7 below

7. MSRT will now start scanning your computer.

8. When the scan finishes, you will see the results, and can click/tap on the View detailed results of the scan link. When finished, click/tap on Finish.