The Windows Malicious Software Removal Tool, Explained

Quick answer: The Windows Malicious Software Removal Tool (MSRT, file name mrt.exe) is a free Microsoft scanner delivered through Windows Update every month as KB890830. It runs once, silently, checks for a specific list of widespread malware families, and removes any it finds. It is not antivirus: it offers no real-time protection, and Microsoft Defender already catches everything on its list. To run it yourself, press Windows + R, type mrt, and choose a full scan.

Most people meet this tool by accident. It shows up in Windows Update history with an unglamorous name and a version number that changes every month. Or it appears in Task Manager, chewing through CPU for ten minutes after an update, with no window and no explanation.

That silence makes people nervous. A process named "mrt.exe" eating resources on its own looks exactly like the thing it is supposed to be removing.

It is legitimate. It is also far less important than its name suggests, and understanding what it does and does not do will save you from relying on it for protection it was never built to provide.

What MSRT actually is

Microsoft started shipping MSRT in 2005, back when large numbers of Windows PCs ran no antivirus at all. The idea was a safety net: once a month, sweep every Windows machine for the handful of malware families causing the most damage at that moment, and clean them up whether or not the owner had installed protection.

That design still holds. Each monthly release, usually on Patch Tuesday (the second Tuesday of the month), adds detections for whatever prevalent threats Microsoft wants gone. After Windows Update installs it, the tool runs one quick background scan. If it finds nothing, it says nothing. If it removes something, you get a notification.

Three things it does not do, and they matter:

• No real-time protection. It does not watch files as you open them or downloads as they arrive.
• No broad coverage. It targets a curated list of prevalent families, not the full universe of malware.
• No prevention. It cleans up after an infection. It does not stop one.

On a PC with Microsoft Defender switched on, MSRT is largely redundant. Defender's signatures include everything MSRT detects and a great deal more. The tool mainly matters on machines where antivirus was disabled, expired or broken.

How to run the Malicious Software Removal Tool manually

You do not need to download anything. The current version is already on your PC if Windows Update is working.

1. Press Windows + R, type mrt, and press Enter.
2. Approve the User Account Control prompt.
3. Click Next and choose a scan type:

- Quick scan checks the areas most likely to contain malware. A few minutes.

- Full scan checks every file on every fixed drive. Expect an hour or more on a large drive.

- Customized scan lets you pick a folder, such as your Downloads folder.

1. Let it run, and read the result.

If mrt is not found, Windows Update probably is not installing it. You can get the standalone version from Microsoft's official download page by searching for "Windows Malicious Software Removal Tool 64-bit" on microsoft.com. Download it from Microsoft directly and nowhere else. "Removal tool" downloads from third-party sites are a classic way to deliver the very thing you are trying to remove.

Reading the log

Every run, including the silent monthly one, writes to C:\Windows\debug\mrt.log. Open it in Notepad. Each run is a block with the version, start time and result. No infection found is what you want to see. If you see a malware family named with Successfully removed, take that seriously, and keep reading.

When MSRT finds something

A detection from MSRT means something got past whatever protection the PC had, or the PC had none. Either way, removal is step one, not the end of the job.

Do a full scan with a real antivirus. MSRT only looks for its list. Malware rarely arrives alone, and a second-stage download it does not recognise may still be there. Run a full scan in Microsoft Defender, then a Microsoft Defender Offline scan (Windows Security, Virus and threat protection, Scan options), which runs before Windows loads, where active malware cannot hide from it.

Get a second opinion from a different engine. Every scanner has blind spots. If MSRT and Defender share one, they share it completely, because both use Microsoft's detection research. A second, unrelated engine is the honest answer here. Our free malware scanner guide covers the free options. If you want a paid deep scan that runs alongside Defender rather than replacing it, Iolo Malware Killer is built for exactly this on-demand job.

Change your passwords from a different device. Many of the families MSRT targets steal credentials or open backdoors. Assume saved browser passwords were exposed. Our 4-hour response plan for leaked passwords gives the order to change them in.

Figure out why protection failed. Check that Defender is actually running and that Tamper Protection is on. Our Windows Defender settings guide walks through the checks in five minutes.

Can you remove or disable MSRT?

People ask this a lot, usually because the monthly scan slows the machine down for a few minutes.

You cannot uninstall it in the normal way. It does not appear in Apps or Programs and Features. Deleting mrt.exe from System32 works only until next month's update puts it back.

You can stop Windows Update from offering it. In Registry Editor, go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft, create a key named MRT if it does not exist, and inside it create a DWORD value named DontOfferThroughWUAU set to 1. Organisations use this when they run other security tooling.

Should you? On a machine with Defender or another active antivirus, disabling it costs you very little. It also gains you very little: a few minutes of disk activity once a month. Our own recommendation is to leave it alone. It is a harmless second net, and on the day your main antivirus quietly breaks, it is the only thing still sweeping.

Is mrt.exe ever malware itself?

The real file lives in C:\Windows\System32 and is signed by Microsoft. To check, find it in Task Manager, right-click, Open file location. If it lives anywhere else, such as a user AppData or Temp folder, that is suspicious. Right-click the file, open Properties, and check the Digital Signatures tab for Microsoft Corporation. A file named mrt.exe without a valid Microsoft signature deserves an immediate offline scan.

Pop-ups claiming to be the Microsoft malware removal tool are a separate scam. The real MSRT never asks you to call a phone number, never asks for payment, and never runs from a website. If a browser page claims Microsoft has detected viruses on your PC, close it with Task Manager.

MSRT vs Microsoft Defender vs paid tools

MSRT: monthly, one-shot, targeted cleanup of prevalent families. Free and automatic. Not protection.

Microsoft Defender Antivirus: full real-time antivirus built into Windows. Free and genuinely good, with independent lab results that have matched paid products for years. Our comparison of Microsoft Defender vs paid antivirus covers where it falls short.

Paid suites and second-opinion scanners: worth it when you want a second detection engine, extras like identity monitoring, or you have already had an infection that slipped past Defender. Iolo System Mechanic Ultimate Defense bundles antivirus with PC maintenance tools, if that combination suits you. For most people, Defender configured properly plus an occasional second-opinion scan is enough.

Frequently Asked Questions

Is the Windows Malicious Software Removal Tool safe?

Yes. It is a Microsoft-signed tool delivered through Windows Update and stored in C:\Windows\System32 as mrt.exe. The only safety concerns are fake versions downloaded from third-party sites and browser pop-ups impersonating it.

Is the Microsoft Malicious Software Removal Tool an antivirus?

No. It has no real-time protection and only detects a curated list of prevalent malware families. Microsoft itself describes it as a post-infection removal tool, not a replacement for antivirus. Keep Microsoft Defender or another antivirus running.

How often does MSRT run?

Once a month, after Windows Update installs the new version, usually around Patch Tuesday. It runs a single silent background scan and only notifies you if it removes something. You can run it manually any time with Windows + R and mrt.

Why is mrt.exe using so much CPU?

The monthly background scan reads a large number of files and can push CPU and disk usage up for several minutes, longer on slower hard drives. It finishes on its own. If mrt.exe runs constantly for days or lives outside C:\Windows\System32, investigate it as possible malware.

Can I delete the Malicious Software Removal Tool?

You can delete mrt.exe, but Windows Update reinstalls it the following month. To stop it permanently, set the DontOfferThroughWUAU registry value to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT. On a protected PC it does little harm either way.