Microsoft Safety Scanner (MSERT) is a portable, manually launched malware detector and removal tool for Windows. Download a fresh copy from Microsoft, run msert.exe, choose a Quick, Full, or Customized scan, then review the result and %SYSTEMROOT%debugmsert.log. It is a useful second opinion, but it does not provide continuous protection and does not replace Microsoft Defender Antivirus.
What Microsoft Safety Scanner does
MSERT runs directly from the downloaded executable; it does not install like a normal application, add a Start-menu entry, or create a desktop shortcut. It can detect malware and attempt to remove it or reverse changes made by identified threats.
As an Amazon Associate I earn from qualifying purchases.
Each downloaded copy expires 10 days after download. Download a new copy before a later scan rather than reusing an old executable. Microsoft says the current utility is exclusively SHA-2 signed, so older Windows installations may require the appropriate SHA-2 signing support. The official download page lists Windows 10, Windows 11, several older Windows releases, and Windows Server editions; a listed legacy system is not necessarily still within Microsoft’s normal product-support lifecycle.
Do not confuse these products:
- Microsoft Safety Scanner (MSERT): a portable, on-demand scanner.
- Microsoft Defender Antivirus: the built-in, continuously operating protection on supported Windows editions.
- Microsoft Defender Offline: a restart-based scan that runs from the Windows Recovery Environment.
- Windows Malicious Software Removal Tool (MSRT): a separate Microsoft tool distributed through Windows Update and the Download Center.
Microsoft describes MSERT as a detection and removal utility, not a guarantee that every compromise will be found or completely remediated.
#1 Best Overall
Before you start
- Save work and close applications that may lock files.
- Use an account that can approve administrator prompts. Elevated access helps the scanner inspect protected locations.
- Decide whether you need a fast check, a broad scan, or one particular folder, drive, or USB device.
- For a business computer, follow your organization’s incident-response process before deleting evidence or disconnecting equipment.
- If ransomware, credential theft, or active data theft is suspected, be prepared to disconnect the computer from sensitive networks and use a clean device for account changes.
Download the correct MSERT executable
- Open Microsoft’s Microsoft Safety Scanner download page.
- Choose the 32-bit or 64-bit download that matches the installed Windows operating system.
- Save the file in
Downloadsor a dedicated folder such asC:ToolsMSERT. The file is normally namedmsert.exe. - Use only Microsoft’s hosted download. Avoid third-party “MSERT” sites, file-sharing links, and repackaged executables.
Check whether Windows is 32-bit or 64-bit
On Windows 10 or 11, open Settings → System → About and read System type. Choose according to the architecture of Windows that is installed, not merely the processor brand. On systems that still provide it, Command Prompt can also report the architecture:
wmic os get osarchitecturewmic is unavailable on some newer Windows installations, so the Settings path is the dependable method.
Run MSERT from its graphical interface
- Open the downloaded
msert.exe. If Windows requests elevation, right-click it, select Run as administrator, and approve the prompt. - Accept the license terms.
- Select Quick scan, Full scan, or Customized scan.
- For a Customized scan, choose the specific folder or drive when prompted.
- Start the scan and leave the computer powered on. Do not move or delete files while it is running; a progress display can appear to pause while a large file or archive is inspected.
- Read the result shown when the scan finishes.
- Open the detailed report at
%SYSTEMROOT%debugmsert.log. On most installations this isC:Windowsdebugmsert.log.
Choose the right scan type
| Scan | Use it when | Important qualification |
|---|---|---|
| Quick scan | You need a fast first check or a second opinion. | A clean Quick scan does not prove that the computer is malware-free. |
| Full scan | There is a known or strongly suspected infection, or a deeper follow-up is warranted. | It can take considerably longer and may inspect large drives, archives, backups, and inactive files. |
| Customized scan | You need to check a particular folder, user profile, local drive, USB device, or download directory. | It avoids spending time on unrelated locations, but it does not assess the rest of the computer. |
A detection in an archive or backup may represent an inactive file rather than evidence that the file executed. Interpret the path and remediation result, not a detection count alone.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRun MSERT from Command Prompt
Change to the folder containing the executable, then launch it:
Rank #3
cd /d "%USERPROFILE%Downloads"
msert.exeMicrosoft Q&A guidance describes these examples:
msert.exe /q
msert.exe /quiet
msert.exe /f
msert.exe /f /q
msert.exe /n/qor/quietrequests quiet mode in that guidance./frequests a full scan./nhas been described as detect-only mode; it may not remediate threats and is unsuitable when you need normal removal.
The current download page does not publish a complete switch reference. Treat these options as version-sensitive and check the executable you downloaded:
msert.exe /?For ordinary remediation, the interactive scan is the least ambiguous choice.
Read and preserve the MSERT log
Open %SYSTEMROOT%debugmsert.log (usually C:Windowsdebugmsert.log) in a text editor. The log can show the scan mode, start and completion times, malware names, file paths, remediation actions, return codes, and errors. Microsoft’s troubleshooting procedure recommends checking entries that commonly begin with 0x.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →When giving the result to IT or an incident-response team, preserve the log before cleaning up the executable. Record the exact detection name, path, and whether removal succeeded. Do not manually delete a system file solely because its filename looks suspicious.
Best Value
What to do when MSERT finds malware
- Let the scan finish and save the detection details from the screen or log.
- Restart Windows if MSERT or Windows Security requests it.
- Run another scan after remediation, then update and run Microsoft Defender Antivirus.
- If a threat remains active, disconnect the computer from networks where practical. Change potentially exposed passwords from a known-clean device.
- For a work computer, preserve logs and use the organization’s response procedure rather than improvising deletion.
For malware inside a ZIP or another container, Microsoft notes that you may need to identify the archive and remove the malicious item manually; deleting a random system file is not an equivalent fix.
Troubleshoot common MSERT failures
Microsoft documents these mappings in its Safety Scanner troubleshooting guidance:
| Error | Meaning | Response |
|---|---|---|
0x80508019 |
The scan destination file or drive does not exist. | Choose a different file, folder, or drive; a Customized scan can change the target. |
0x80508007 |
Insufficient system memory. | Download the scanner again and retry after closing unnecessary programs. |
0x80508025 |
A user procedure or system-setting change is required. | Read the log for the specific instruction. |
0x80508024 |
A full scan must complete before the operation can finish. | Run a Full scan. |
0x80508026 |
A resource is inside a container such as an archive. | Identify the container and remove the malicious item manually. |
For other failures, download a fresh copy, verify the architecture, restart Windows, run as administrator, confirm that the target drive is mounted and accessible, and check whether security software is blocking execution. If malware prevents normal Windows tools from running, use Microsoft Defender Offline or a clean administrative environment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When Defender or Defender Offline is a better choice
| Situation | Best first choice |
|---|---|
| Routine, ongoing protection | Microsoft Defender Antivirus |
| Quick additional check | MSERT Quick scan |
| Known infection or broad investigation | MSERT Full scan |
| One folder, USB drive, or local disk | MSERT Customized scan |
| Persistent malware that may hide in normal Windows | Microsoft Defender Offline |
| Managed enterprise incident | Your EDR and incident-response process, with MSERT only as a supplement |
Microsoft Defender Offline restarts the PC, loads in the Windows Recovery Environment, scans outside the normal Windows session, and restarts again. Results appear in Windows Security under Protection history. See Microsoft’s Windows Security virus and threat protection guidance.
MSERT’s limits
- It does not monitor files or processes continuously.
- It does not automatically refresh its downloaded package during a scan.
- The executable expires after 10 days, so its copy and detection content can become stale.
- A clean result is evidence from that scan, not proof that no compromise exists.
- It is not an enterprise investigation platform and is not sufficient by itself for ransomware, credential theft, data exfiltration, or a wider business compromise.
Delete the executable after use if you do not need to retain it. Before a future scan, return to Microsoft’s download page and obtain a new copy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
