Malware Removal Tool Download: Detect and Remove Threats

Scanners detect threats two main ways: signature-based detection matches files against a database of known malware, and behavior or heuristic analysis flags suspicious actions even from unknown threats. After scanning, the tool isolates detected items in quarantine so they can't run, then lets you delete them.

Keeping the tool's definitions updated is essential, since new malware appears daily and an outdated scanner misses recent threats.

Real-time antivirus, like the built-in Microsoft Defender, runs continuously and blocks threats as they appear. On-demand scanners are run manually for cleanup or a second opinion and generally don't conflict with your main antivirus. Running a reputable second-opinion scanner is a smart way to catch something your primary tool missed.

• Always on: your main antivirus (e.g., Microsoft Defender).
• On demand: a scanner like Malwarebytes or ESET Online Scanner for cleanup.

These free tools come from established security vendors. What each one does, according to its own vendor page:

• Microsoft Defender Antivirus is built into Windows and runs all the time. In the Windows Security app you can run a quick, full or custom scan, or a Microsoft Defender Antivirus (offline scan), which restarts the PC and scans without loading Windows so that persistent malware has fewer places to hide. Microsoft notes that if you install a compatible non-Microsoft antivirus, Defender Antivirus turns itself off.
• Microsoft Safety Scanner is a free on-demand tool for Windows in 32-bit and 64-bit versions. Microsoft says it expires 10 days after download, so fetch a fresh copy each time, and that it does not replace your anti-malware product. Results are logged to %SYSTEMROOT%\debug\msert.log.
• Malwarebytes Free scans your device when you run it and removes the threats it finds. Malwarebytes says there is no real-time protection between scans in the free version; that requires Premium.
• AdwCleaner, also from Malwarebytes, is a free Windows tool aimed at adware, bloatware, unwanted toolbars, browser hijackers and other potentially unwanted programs.
• ESET Online Scanner is a free one-time scanner for Windows PCs. ESET states that it does not provide ongoing real-time protection.

Stick to these established names rather than unfamiliar tools advertised in pop-ups. For always-on protection rather than a one-off cleanup, see our antivirus software guide.

If you suspect an active infection, disconnect from the internet to stop data theft. Update your scanner and run a full scan. If the malware blocks your security tools or keeps coming back, run the Microsoft Defender offline scan from Windows Security, or boot into Safe Mode and scan from there. Quarantine and remove detections, then reboot and scan again with a second tool, such as Microsoft Safety Scanner or ESET Online Scanner, to confirm the PC is clean.

After cleanup, change important passwords from a known-clean device, since credentials may have been stolen. If the PC still misbehaves, back up your documents and consider resetting Windows.

Older guides often recommend the Kaspersky Virus Removal Tool. If you are in the United States, note that the US Commerce Department has prohibited Kaspersky from entering into new agreements with US persons since 20 July 2024 and from providing anti-virus signature and codebase updates to US users since 29 September 2024. A scanner that cannot update misses new threats, so US users should choose one of the tools above. Outside the US, check your own government's guidance.

Scareware pop-ups claiming "Your PC is infected, download now!" are themselves malware. Never install security tools from such prompts. Download only from the official domains: microsoft.com and learn.microsoft.com for Microsoft's tools, malwarebytes.com for Malwarebytes and AdwCleaner, and eset.com for ESET. On Windows, check the publisher shown in the installer's digital signature before running it.

If a site uses high-pressure warnings and countdown timers to make you download, close it immediately. Our guide to avoiding fake download buttons shows the common tricks.