Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. debug
  4. mrt.log
LogRisk: Caution

mrt.log C:\Windows\debug\mrt.log

mrt.log: log of the Windows Malicious Software Removal Tool (MSRT), run monthly through Windows Update, with a summary of each scan.

Updated on By AltF4 Formation

What it’s for

mrt.log is the log of Microsoft’s Malicious Software Removal Tool (MSRT, mrt.exe, delivered through Windows Update as KB890830). The tool runs silently every month and records the outcome of each pass here. The file answers one question: did the MSRT find anything?

What it contains

  • One header per run: tool version, start date and time.
  • The run mode and a Results Summary block: “No infection found.”, or the list of malware families detected and cleaned.
  • The tool’s return code (Return code).

Risks and best practices

  • It is not a full security log. It does not replace Microsoft Defender history or an EDR, since the MSRT only targets a short list of widespread families.
  • Deleting it has no functional effect, but it wipes the record of past detections. Copy it first if it may serve as evidence.
  • It can quote paths of infected files, so review it before sending it to a third party.

Useful commands

Fenêtre de terminal
# Last lines
Get-Content "$env:windir\debug\mrt.log" -Tail 40


# Headers, summaries and return codes of every run
Select-String -Path "$env:windir\debug\mrt.log" -Pattern 'Started On|Results Summary|Return code' -Context 0,2


# Date of the last run
(Get-Item "$env:windir\debug\mrt.log").LastWriteTime

Format

Plain text. Each run starts with a header (tool name and version, date) and ends with the results summary block.

Rotation and archiving

Archive the file before emptying it if you want to keep the detection history.

How to read it

Jump to the last Results Summary block: it says whether malware was detected. If it names one, match its date against the Windows Update log and the Microsoft Defender history.

Report a mistake