iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If you suspect a Windows PC is infected, Microsoft’s free options serve different purposes: Microsoft Defender Offline and Safety Scanner are the tools Microsoft recommends for more comprehensive detection and removal, while the Malicious Software Removal Tool (MSRT) targets a limited set of prevalent, active threats. None is a replacement for real-time antivirus, and running a scan cannot guarantee that a computer is clean.
Which malware removal tool should you run first?
Choose based on the job, not a universal “best” ranking. For a more comprehensive scan, Microsoft recommends Defender Offline or Safety Scanner. Use MSRT as a narrower post-infection utility, not as your computer’s only security measure.
- For a more comprehensive detection and removal scan: Microsoft recommends Defender Offline or Safety Scanner.
- For a targeted check of prevalent, active malware: MSRT can help, but it covers a limited set of threats.
- For ongoing protection: use a real-time antivirus product. Microsoft says neither MSRT nor Safety Scanner replaces one.
This is a Windows-focused shortlist of documented Microsoft tools, not a claim that three utilities—or any list of eleven—have been tested against one another. The available evidence does not support a reliable product-by-product ranking of eleven dedicated cleanup tools.
Recommended Free Tools
What is the difference between a removal tool and antivirus?
A removal utility is generally run to look for or remove threats already present. Real-time antivirus is intended to provide continuing protection rather than waiting for you to launch a manual scan. Some security products may combine functions, but a tool’s name or “malware removal” label does not establish which protections it includes.
#1 Best Overall
Microsoft’s own description makes the distinction clear: MSRT is a post-infection tool for a limited set of prevalent threats, and Microsoft states, “The MSRT does not replace an antivirus product.” It focuses on active malware and does not remove spyware. Treat a clean MSRT result as limited to what the tool checks—not as proof that every kind of threat is absent.
What does each Microsoft tool do?
| Tool | Role supported by Microsoft guidance | How it runs | Important limit |
|---|---|---|---|
| Malicious Software Removal Tool (MSRT) | Post-infection removal for a limited set of prevalent threats; focuses on active malware | Microsoft generally releases it monthly | Not a general antivirus replacement; does not remove spyware |
| Safety Scanner | Manual scanning and removal; Microsoft recommends it for comprehensive detection and removal | Launched manually; Microsoft says it “only scans when manually triggered” | Does not provide real-time protection. Its download expires 10 days after download. |
| Microsoft Defender Offline | Microsoft recommends it for comprehensive detection and removal | Offline scan option | The available guidance here does not establish a comparative cleanup success rate or a ranking against other products. |
These tools are not interchangeable. MSRT’s limited threat scope makes it a poor choice as a sole response to a suspected infection. Safety Scanner is more flexible as a manually run scan, but its manual-only behavior means it is not continuously watching for new threats. Defender Offline is another Microsoft-recommended option when a more comprehensive scan is needed.
How do you use Safety Scanner without relying on an expired download?
Safety Scanner is a manual utility, and each download expires 10 days after it is downloaded. For a later scan, download a fresh copy so the tool uses current security intelligence.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- Download a fresh copy from Microsoft. Do this when you are ready to scan; a copy held for more than 10 days has expired.
- Launch the scanner manually. It does not scan automatically in the background.
- Choose and run the scan. Follow the prompts shown by the utility; the available guidance does not establish a universal duration or a single best scan choice for every case.
- Use a newly downloaded copy for a later scan. Do not assume an old saved download remains current after its 10-day validity period.
- Keep real-time protection in place separately. Safety Scanner is not a substitute for it.
Microsoft’s page describes the tool as manually triggered and time-limited; those details matter if you keep a copy for future emergencies. A download that worked for a scan today should not be treated as a permanently current rescue utility.
How should you choose a removal tool for your computer?
Before selecting any additional product, verify its current documentation for the operating system it supports, whether it removes existing infections or only blocks new ones, whether it offers an offline scan, and what remains available without payment. These details can change, and the product name alone is not enough to establish them.
Check platform support
Confirm the vendor explicitly supports your operating system and version. The tools described above are Microsoft options; this evidence does not establish which third-party products support Windows, macOS, Linux, or particular releases.
Separate cleanup from ongoing protection
Look for a clear statement about whether the tool can scan and remove an existing threat, provide real-time protection, or do both. A manual scanner may be useful for a one-time check but leave the computer without continuous protection.
Check scan modes and threat scope
Find out whether the product supports an offline scan and which threat types it addresses. MSRT illustrates why scope matters: it covers a limited set of prevalent, active threats and does not remove spyware.
Read the free-versus-paid boundary
Verify whether the free edition actually includes removal, whether real-time protection requires an upgrade, and whether any trial or download has an expiration. No current pricing or paid-feature details are established for a wider set of products here, so do not assume that “free scanner” means free ongoing protection.
Rank #4
What do independent antivirus test results tell you—and what don’t they tell you?
Independent security-suite tests can provide context about protection, performance, and usability, but they should not be presented as dedicated tests of removing an infection that is already on a computer. AV-TEST reports that it evaluated 15 home-user security products during July and August 2026 across those three categories.
AV-TEST assigns a maximum of 6 points in each category—protection, performance, and usability—for a maximum combined score of 18. Those scores describe the evaluation’s stated categories; they do not, by themselves, establish which product is best at cleaning an already-infected computer. Use such results as broader security-suite context, not as a cleanup ranking.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What should you do after a scan?
Follow the tool’s reported result and removal prompts, then use an appropriate real-time security product for continued protection. A scan result is bounded by that tool’s scope: for example, MSRT does not remove spyware. Do not treat one successful scan as a guarantee that a device is trustworthy or that every threat has been removed.
Frequently Asked Questions
Why do Microsoft pages show different MSRT version dates?
Version information can change as Microsoft releases updates, and surfaced pages may not show the same release. Check Microsoft’s live download page at the time you download the tool rather than relying on an older version number.
Does a high antivirus test score prove a product can clean an infected PC?
No. The July–August 2026 AV-TEST results described here assess protection, performance, and usability. Those categories are useful for evaluating security suites, but they do not establish a dedicated existing-infection cleanup result.
Can one malware scan prove that my computer is safe?
No. A scan only tells you what its particular tool detects within its scope; Microsoft describes MSRT as covering a limited set of prevalent threats, for example. A clean result should not be read as a universal guarantee.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
