How to Use Windows MSRT (Malicious Software Removal Tool)

When a Windows computer suddenly stutters, fans spin up aggressively, or Task Manager displays 100% disk usage without any heavy foreground application running, an unwanted background process may be consuming system resources. Before turning to third-party cleaners or intrusive utilities, you can utilize the built-in Malicious Software Removal Tool (MSRT) provided directly by Microsoft.

1. What Is MSRT and How Does It Operate?

MSRT stands for Microsoft Windows Malicious Software Removal Tool. Introduced in 2005, it serves as a lightweight security utility designed to help Windows users purge specific, widespread malicious software infections from their machines.

Microsoft routinely distributes updated versions of this tool once a month on "Patch Tuesday" (the second Tuesday of each month) via Windows Update under the package identifier KB890830. Once delivered, Windows executes a brief background scan under low process priority to check core system areas.

It is important to recognize the distinction: MSRT is not a full-fledged antivirus replacement. It lacks real-time interception capabilities and only acts as an on-demand disinfectant for targeted malware strains when launched.

2. Comparing MSRT and Microsoft Defender Antivirus

Users often confuse MSRT with the built-in Microsoft Defender Antivirus. The table below outlines how these two native utilities differ:

3. Common Symptoms of Malware Resource Hogging

When unwanted malicious software or aggressive adware takes hold of an operating system, typical hardware and software symptoms include:

• Disk or CPU utilization pinned at 100% in Task Manager despite no active heavy workloads.
• System responsiveness degradation accompanied by persistent high fan speeds during idle states.
• Unexpected file extension modifications or unfamiliar executables populating the Startup apps tab.
• Unsolicited browser tab redirections or invasive desktop pop-up notifications.

Running an on-demand scan with MSRT offers a straightforward check to verify whether recognized malicious processes are behind these slowdowns.

4. Step-by-Step: How to Run the MRT Command on Windows

You can launch the scanner directly without downloading any external files:

1. Press the Windows + R keyboard shortcut to launch the Run dialog.
2. In the open field, type mrt and press Enter (or click OK).
3. When prompted by the User Account Control (UAC) dialog, click Yes to grant administrative privileges.
4. The Microsoft Windows Malicious Software Removal Tool welcome screen will appear. Click Next to proceed to the scan mode selection.

On the subsequent screen, select from three available scanning modes depending on your objective:

• Quick scan: Scans essential system directories where malware most commonly hides (Windows directory, System32, Registry). Typical duration is between 2 to 5 minutes.
• Full scan: Thoroughly analyzes all files across every connected drive. Because it inspects complete storage volumes, this scan can take anywhere from thirty minutes to several hours depending on drive capacity and speed.
• Customized scan: Allows you to target an individual folder or external storage drive for focused inspection.

Select your desired scan mode, click Next, and allow the tool to complete its inspection. Once finished, MSRT will summarize its findings, confirming whether malicious software was identified and removed.

5. Standalone MSRT Offline Package Download

If you run a debloated Windows edition or have permanently disabled Windows Update, MSRT may not receive the newest monthly threat definitions automatically. In such scenarios, download the official standalone executable directly from the Microsoft Download Center:

6. Frequently Asked Questions