Windows power user tips

MSRT vs. MSERT: When to use each Windows malware tool

The Windows Malicious Software Removal Tool (MSRT) and the Microsoft Safety Scanner (MSERT.exe) do more or less the same thing: scan for and remove Windows malware. We explore and explain the differences.

Computerworld |

Thinkstock/Microsoft

Windows power user tips

Microsoft provides Windows users with two tools that offer malware scanning and repair services, should those scans turn up anything in need of fixing. One is named MSRT; the other runs an executable called MSERT.

Naturally, this overlap raised my curiosity, and led me to explore these two tools to suss out their similarities and differences.

msrt vs msert 1 — Figure 1: MSRT appears in File Explorer as a Windows Knowledge Base download, while MSERT comes from Microsoft Docs documentation.

Meet the Windows Malicious Software Removal Tool (MSRT)

Like clockwork, Microsoft issues Windows security and bug-fix updates on the second Tuesday of each month. Over time, this day of the month has become known as “Patch Tuesday” or “Update Tuesday.” Those updates flow through the Windows Update (WU) facility that is built into all modern Windows versions.

Invariably, each Patch Tuesday includes an item named Windows Malicious Software Removal Tool, a.k.a. MSRT. Here’s how Microsoft describes MSRT on its Download Center page:

Windows Malicious Software Removal Tool (MSRT) helps keep Windows computers free from prevalent malware. MSRT finds and removes threats and reverses the changes made by these threats. MSRT is generally released monthly as part of Windows Update or as a standalone tool available here for download.

Figure 2 features a screencap from Windows 10 showing a fairly recent MSRT release:

msrt vs msert 2 wu — Figure 2: Notice that the WU download uses the same KB and version numbers as the File Explorer item in Figure 1.

As part of the normal update drill for most Windows users — except those who get their updates through their organization’s own update servers, on their own calendars — the MSRT gets run every Tuesday as a matter of routine. This means that many, if not most, Windows desktops get an obligatory malware check-and-repair run at least once a month. MSRT can be run on its own, but is not used in that way very often. That said, the download page is always there, updated monthly, ready for access.

Meet the Microsoft Safety Scanner (MSERT.exe)

MSERT, on the other hand, was once an acronym for the Microsoft Emergency Response Tool. These days, Microsoft calls this scan tool the Microsoft Safety Scanner instead. You can read all about it on its Microsoft Docs page, where you can also grab a 32- or 64-bit version of that download. Here’s the brief explainer for MSERT.exe from the head of that page:

Microsoft Safety Scanner is a scan tool designed to find and remove malware from Windows computers. Simply download it and run a scan to find malware and try to reverse changes made by identified threats.

Careful comparison of the two descriptions shows them to be more alike than different. Further perusal of the Docs page, however, helps to zero on an important difference. It reads:

Safety Scanner only scans when manually triggered and is available for use 10 days after being downloaded. We recommend that you always download the latest version of this tool before each scan.

One major difference between MSRT and MSERT is currency. By the third week of the month, a new version of MSERT should be available, whereas MSRT changes only once a month. Thus, I concur with Microsoft that one should “always download the latest version of [MSERT.exe] before each scan.” I also think this spells a key difference between the two tools.

Run MSRT through WU, use MSERT manually

Windows PCs subject to regular updates via WU or a company-run substitute will likely get the latest MSRT each time an update cycle runs. The tool is intended for such automatic use, and ages past its freshness date fairly quickly thereafter. Because MSERT is updated at 10-day intervals, it is preferable to MSRT once Patch Tuesday (or the latest in-house update) has come and gone.

This doesn’t mean that MSERT is better or more capable than MSRT. It simply means that it works from more current threat intelligence and is thus able to handle more (and more recent) malware that it might encounter on a Windows PC.

I’m a bit bemused that the names of the two tools differ only by the letter “E” in middle of the name string. That said, they are different tools. Though they serve essentially the same purpose, if readers need to run a manual virus-scan-and-repair tool on a potentially infected PC, it makes sense to use the Microsoft Safety Scanner for that purpose. To that end, please remember to download the latest version from its Microsoft Docs page any time you wish to use it, in line with Microsoft’s own recommendation.