What is the Malicious Software Removal Tool?
Every Windows PC has a hidden malware scanner already installed. Microsoft calls it the Malicious Software Removal Tool (MRT). It is not a full antivirus suite, but it targets the most widespread malware families and can remove infections that are actively running on your computer. Microsoft updates MRT every month through Windows Update, so it stays current without any action from you.
MRT works alongside your main antivirus rather than replacing it. Think of it as a second opinion scanner that focuses on the threats Microsoft sees most often across millions of Windows machines.
How to run MRT on Windows
There is no desktop shortcut or Start menu entry for MRT. To launch it:
- Press Windows logo key + R to open the Run dialog.
- Type mrt and press Enter.
- Accept the User Account Control prompt if it appears.
- Choose a scan type: Quick scan checks the areas malware most commonly hides, Full scan examines the entire system, and Customized scan runs a quick scan plus a folder you choose.
- Click Next and wait for the scan to finish.
A quick scan typically takes a few minutes. A full scan can take an hour or more depending on the size of your hard drive.
If MRT will not start or you see an error message, that itself can be a sign of infection. Some malware deliberately disables security tools to protect itself.
How to read the MRT log file
Every time MRT runs, it writes the results to a log file at:
C:\Windows\debug\mrt.log
You can open this file by pressing Windows + R, pasting that path into the Run dialog and pressing Enter. The log records every scan, whether it completed, what it found and what it removed. Accessing files inside the C:\Windows folder may require administrator privileges.
If the log shows detections that MRT could not remove, or if your computer still behaves oddly after a clean scan, a deeper investigation is needed.
MRT vs Windows Defender
MRT and Windows Defender Antivirus (part of Windows Security) are two separate Microsoft tools that serve different purposes:
- Windows Defender runs in real time, scanning every file you open, download or execute. It is a full antivirus.
- MRT runs on demand or once a month after updates. It only targets a curated list of prevalent threats and does not provide real-time protection.
Both tools are free and built into Windows 10 and 11. You do not need to choose between them because they work together. Windows Defender handles everyday protection while MRT acts as a periodic deep check against known widespread threats.
When to get professional help
MRT and Windows Defender handle the majority of common threats, but there are situations where professional assistance is the safest option:
- MRT or Windows Defender will not start or keeps getting disabled.
- Your computer is extremely slow, shows pop-ups or redirects your browser even after scanning.
- The MRT log shows threats that could not be removed.
- You suspect data has been stolen or ransomware has encrypted your files.
- Windows itself is corrupted and built-in tools cannot run reliably.
In these cases a technician can boot from external media, run enterprise-grade tools and recover data that automated scanners cannot reach. If you are on the Northern Beaches, contact us for help.
2012 - 2026