The Windows Malicious Software Removal Tool (MSRT) and the Microsoft Safety Scanner (MSERT.exe) do more or less the same thing: scan for and remove Windows malware. We explore and explain the differences. Credit: Thinkstock/Microsoft Microsoft provides Windows users with two tools that offer malware scanning and repair services, should those scans turn up anything in need of fixing. One is named MSRT; the other runs an executable called MSERT. Naturally, this overlap raised my curiosity, and led me to explore these two tools to suss out their similarities and differences. IDG Figure 1: MSRT appears in File Explorer as a Windows Knowledge Base download, while MSERT comes from Microsoft Docs documentation. Meet the Windows Malicious Software Removal Tool (MSRT) Like clockwork, Microsoft issues Windows security and bug-fix updates on the second Tuesday of each month. Over time, this day of the month has become known as “Patch Tuesday” or “Update Tuesday.” Those updates flow through the Windows Update (WU) facility that is built into all modern Windows versions. Invariably, each Patch Tuesday includes an item named Windows Malicious Software Removal Tool, a.k.a. MSRT. Here’s how Microsoft describes MSRT on its Download Center page: Windows Malicious Software Removal Tool (MSRT) helps keep Windows computers free from prevalent malware. MSRT finds and removes threats and reverses the changes made by these threats. MSRT is generally released monthly as part of Windows Update or as a standalone tool available here for download. Figure 2 features a screencap from Windows 10 showing a fairly recent MSRT release: IDG Figure 2: Notice that the WU download uses the same KB and version numbers as the File Explorer item in Figure 1. As part of the normal update drill for most Windows users — except those who get their updates through their organization’s own update servers, on their own calendars — the MSRT gets run every Tuesday as a matter of routine. This means that many, if not most, Windows desktops get an obligatory malware check-and-repair run at least once a month. MSRT can be run on its own, but is not used in that way very often. That said, the download page is always there, updated monthly, ready for access. Meet the Microsoft Safety Scanner (MSERT.exe) MSERT, on the other hand, was once an acronym for the Microsoft Emergency Response Tool. These days, Microsoft calls this scan tool the Microsoft Safety Scanner instead. You can read all about it on its Microsoft Docs page, where you can also grab a 32- or 64-bit version of that download. Here’s the brief explainer for MSERT.exe from the head of that page: Microsoft Safety Scanner is a scan tool designed to find and remove malware from Windows computers. Simply download it and run a scan to find malware and try to reverse changes made by identified threats. Careful comparison of the two descriptions shows them to be more alike than different. Further perusal of the Docs page, however, helps to zero on an important difference. It reads: Safety Scanner only scans when manually triggered and is available for use 10 days after being downloaded. We recommend that you always download the latest version of this tool before each scan. One major difference between MSRT and MSERT is currency. By the third week of the month, a new version of MSERT should be available, whereas MSRT changes only once a month. Thus, I concur with Microsoft that one should “always download the latest version of [MSERT.exe] before each scan.” I also think this spells a key difference between the two tools. Run MSRT through WU, use MSERT manually Windows PCs subject to regular updates via WU or a company-run substitute will likely get the latest MSRT each time an update cycle runs. The tool is intended for such automatic use, and ages past its freshness date fairly quickly thereafter. Because MSERT is updated at 10-day intervals, it is preferable to MSRT once Patch Tuesday (or the latest in-house update) has come and gone. This doesn’t mean that MSERT is better or more capable than MSRT. It simply means that it works from more current threat intelligence and is thus able to handle more (and more recent) malware that it might encounter on a Windows PC. I’m a bit bemused that the names of the two tools differ only by the letter “E” in middle of the name string. That said, they are different tools. Though they serve essentially the same purpose, if readers need to run a manual virus-scan-and-repair tool on a potentially infected PC, it makes sense to use the Microsoft Safety Scanner for that purpose. To that end, please remember to download the latest version from its Microsoft Docs page any time you wish to use it, in line with Microsoft’s own recommendation. Related content news analysis Apple confirms it will open up the iPad in Europe this fall The latest efforts to comply with Europe’s Digital Markets Act mean developers can offer to side load apps to both iPhones and iPads in the EU. Apple has also taken steps to improve what it offers to smaller and non-commercial developers in the By Jonny Evans May 02, 2024 6 mins iPad Apple Mobile Apps news Udacity offers laid-off US workers free access to its courses for 30 days Sign-ups will be available over the next 30 days By Lucas Mearian May 02, 2024 4 mins Technology Industry IT Jobs IT Skills opinion Why you’ll soon have a digital clone of your own AI isn’t going to replace you at work. You will. By Mike Elgan May 02, 2024 7 mins Augmented Reality Generative AI Virtual Reality news analysis Workers with these AI skills are getting cash premiums As AI deployments become more critical to digital transformation projects, organizations are struggling to find skilled workers to support the new technology, so they're paying premiums for prospective hires or current employees who obtain the n By Lucas Mearian May 01, 2024 7 mins Generative AI IT Jobs IT Skills Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe