Where Is the Malicious Software Removal Tool Log?
The Malicious Software Removal Tool appends every monthly run to mrt.log in the Windows debug folder.
Last updated
Windows runs the Malicious Software Removal Tool silently with monthly updates, and it logs to %windir%\debug\mrt.log (usually C:\Windows\debug). The newest entry sits at the end of the file. Microsoft's own troubleshooting guide starts there, which tells you it is the authoritative record.
The log is append-only and English-only, accumulating one entry per run. It records detections, removals, and error codes, not full antivirus history. For that, Defender keeps its own separate logs. Mrt.log answers one question well: what did this month's MSRT pass do.
Where Windows stores this, by platform
%windir%\debug\mrt.log
Open via Win+R with %systemroot%\debug, then double-click mrt.log. Newest entry last. Unicode since 2005; ancient ANSI copies became Mrt.log.old.
Frequently asked questions
How do I run the Malicious Software Removal Tool manually?
Press Win+R, type %windir%\System32\MRT.exe, and run it. It is the same monthly scanner Windows Update runs silently, with a visible progress bar and a results report at the end.
Did MSRT actually scan my PC this month?
Check mrt.log first. An empty result section with a recent timestamp means it ran clean. Pair it with Defender's own scan history for full coverage, since MSRT targets only prevalent families.
Notice an outdated path? Let us know.