MSRT vs. MSERT: Using Microsoft native malware handlers

Microsoft provides Windows users with two tools that offer malware scanning and repair services, should those scans turn up anything in need of fixing. One is named MSRT; the other runs an executable called MSERT. (Microsoft also calls it the “Microsoft Safety Scanner.”)

Naturally, this overlap raised my curiosity. That led me to explore these two tools further,  to suss out their similarities and differences.

As it turns out, MSRT (the Malicious Software Removal Tool) is delivered via Windows Update and is also available for download at the Microsoft Download Center. The Microsoft Safety Scanner (msert.exe) is available via Microsoft Learn, and from the Download Center as well. Both are shown in File Explorer in Figure 1.

Figure 1: MSRT (appears here as KB890830) comes either from Windows Update or the Download Center; msert.exe comes from Microsoft Learn or the Download Center.
Ed Tittel / Foundry

WARNING! Because malware protection requires constant updates, you’ll want to download a fresh copy of either tool before using it on a Windows system. Don’t rely on a local copy. Be sure to grab the latest and greatest version instead.

There are times when either tool will do the job, but there are other times when one will be preferable to the other, as explained below.

Meet MSRT, the Malicious Software Removal Tool

Like clockwork, Microsoft issues Windows security and bug-fix updates on the second Tuesday of each month. Over time, this day of the month has become known as “Patch Tuesday” or “Update Tuesday.” Such updates flow through the Windows Update (WU) facility built into all modern Windows versions. Invariably, every Patch Tuesday includes an item named Windows Malicious Software Removal Tool, a.k.a. MSRT.

Here’s how Microsoft describes MSRT on its Download Center page (Windows 11 users must use the 64-bit version; Windows 10 users may use either the 32- or 64-bit version):

Windows Malicious Software Removal Tool (MSRT) helps keep Windows computers free from prevalent malware. MSRT finds and removes threats and reverses the changes made by these threats. MSRT is generally released monthly as part of Windows Update or as a standalone tool available here for download.

Figure 2 shows a screencap from Windows 11 that includes a recent MSRT release, from Settings > Windows Update > Update History:

Figure 2: MSRT shows up under the “Other Updates” heading in Update History.
Ed Tittel / Foundry

As part of the normal update drill for most Windows users — except those who get their updates through their organization’s own update servers, on their own calendars — the MSRT gets run every second Tuesday each month as a matter of routine. This means that many, if not most, Windows desktops get an obligatory malware check-and-repair run at least once a month. MSRT can be run on its own, but is not often used that way. That said, the download page is always there, updated monthly, ready for access.

Meet MSERT.exe, the Microsoft Safety Scanner

MSERT, on the other hand, was once an acronym for the Microsoft Emergency Response Tool. These days, Microsoft calls this tool the Microsoft Safety Scanner instead. You can read all about it on its Microsoft Learn page, where you can also grab a 32- or 64-bit version of that download. (As with MSRT, Windows 11 runs only the 64-bit version of MSERT.)

Here’s the brief explainer for msert.exe from its Microsoft Learn page:

Microsoft Safety Scanner is a scan tool designed to find and remove malware from Windows computers. Download it and run a scan to find malware and try to reverse changes made by identified threats.

Careful comparison of these two descriptions and their respective tools shows them to be mostly alike. That said, Microsoft also notes under an “Important information” heading for msert.exe:

Microsoft Safety Scanner only scans when manually triggered. Safety Scanner expires 10 days after being downloaded. To rerun a scan with the latest anti-malware definitions, download and run Safety Scanner again. We recommend that you always download the latest version of this tool before each scan.

That points to a key difference between MSRT and MSERT: currency. By the third week of any month, a new MSERT version should be available, whereas MSRT changes only once a month. Thus, I concur with Microsoft that one should always download the latest version of msert.exe before each scan.

Furthermore, msert.exe is a portable executable and doesn’t show up in the Start menu or as a desktop icon. Thus, you must manually locate and run msert.exe by double-clicking its entry in File Explorer. Microsoft says, succinctly: “Note where you saved this download.” (By default, you should find it in your Downloads folder, as shown in Figure 1.)

Run MSRT via WU, use MSERT manually

Windows PCs subject to regular updates via WU or a company-run substitute will likely get the latest MSRT each time an update cycle runs. The tool is intended for such automatic use, and it ages past its freshness date quickly thereafter.

Because MSERT is updated at 10-day intervals, it is preferable to use MSRT 10 days after Patch Tuesday (or the latest in-house update) has come and gone. Keep that in mind should you need to perform a malware scan on any of your Windows PCs — it does make a difference.

This doesn’t mean that MSERT is better or more capable than MSRT. It simply means that it works from more current threat intelligence and is thus able to handle more (and more recent) malware that it might encounter on a Windows PC.

This story was originally published in September 2021 and updated in July 2025.