Windows Malicious Software Removal Tool

microsoft.com

Free plan Windows

Spec score 7.2 #12 of 25 in Data Migration Tools

What it is

Windows Malicious Software Removal Tool (MSRT) is a free Windows utility that finds and removes prevalent malware threats and reverses changes they made. It is generally delivered monthly through Windows Update or as a standalone download. When automatic updates are enabled, Windows Update downloads and runs it in the background; the standalone version can be started on demand. After a standalone scan, it displays a report of threats found and removed and writes a log to %windir%\debug folder\mrt.log. MSRT targets prevalent malware families only, so it is not a replacement for full-fledged antimalware such as Windows Defender Antivirus. It requires local administrator privileges. The download page lists Windows 10, Windows 11, Windows 7, Windows 8.1, and specified Windows Server releases. It supports multiple languages and uses United States English if the operating system language is unsupported. The listed download is version 5.145, published September 11, 2026, and is 84.0 MB. The plan is free.

Spec sheet

Purpose: MSRT finds and removes prevalent malware threats and reverses changes they made.Read 12 Oct 2026 · microsoft.com
Free plan: YesRead 23 Sep 2026 · microsoft.com
Headquarters: Redmond, Washington, USARead 4 Oct 2026 · microsoft.com
Founded: 1975Read 4 Oct 2026 · microsoft.com
Administrator requirement: The tool must be run with local administrator privileges.Read 12 Oct 2026 · microsoft.com
Background operation: With Windows automatic updates enabled, Windows Update downloads and runs MSRT in the background.Read 12 Oct 2026 · microsoft.com
Current download: The page lists version 5.145, published September 11, 2026, with a file size of 84.0 MB.Read 12 Oct 2026 · microsoft.com
Delivery: It is generally released monthly through Windows Update or as a standalone download.Read 12 Oct 2026 · microsoft.com
IT administration: Microsoft provides information for IT administrators about command-line switches, deployment, covered malware families, and removing the tool.Read 12 Oct 2026 · microsoft.com
Language support: MSRT supports multiple languages and uses United States English when the operating system language is unsupported.Read 12 Oct 2026 · microsoft.com
Log file: The standalone tool generates a log at %windir%\debug folder\mrt.log.Read 12 Oct 2026 · microsoft.com
On-demand use: The standalone version can be run on demand after downloading it.Read 12 Oct 2026 · microsoft.com
Release timing: Microsoft generally delivers MSRT on the second Tuesday of each month.Read 12 Oct 2026 · microsoft.com
Scan report: After a standalone scan, MSRT displays a report listing the threats it found and removed.Read 12 Oct 2026 · microsoft.com
Supported systems: The download page lists Windows 10, Windows 11, Windows 7, Windows 8.1, and specified Windows Server releases as supported operating systems.Read 12 Oct 2026 · microsoft.com
Threat coverage limit: MSRT targets prevalent malware families only and is not a replacement for full-fledged antimalware such as Windows Defender Antivirus.Read 12 Oct 2026 · microsoft.com

Plans and prices

Windows Malicious Software Removal Tool Free Windows only · targets prevalent malware families · requires local administrator privileges Read 12 Oct 2026 · microsoft.com

Every Windows Malicious Software Removal Tool plan and price →

Strong points and limits

Strong points

Free plan: free
Runs through Windows Update or on demand
Standalone scans report found and removed threats
Supports multiple languages

Limits

Targets prevalent malware families only
Requires local administrator privileges
Windows only

Who it suits

It suits Windows users or IT administrators seeking a targeted malware cleanup tool delivered through Windows Update or run on demand. It is not intended to replace full-fledged antimalware protection.

Verdict

MSRT offers targeted cleanup and a standalone scan report, with background delivery through Windows Update when automatic updates are enabled. Its limited threat coverage means it should not be treated as a full antimalware replacement.