Sunday, April 17, 2011

How to Use the New Microsoft Safety Scanner

The newly released Microsoft Safety Scanner is a replacement for the Windows Live OneCare Scanner.  The Windows Live OneCare Scanner was eliminated when support ended for Windows Live OneCare. 

If you think your computer has a virus that your current antivirus software missed or is unable to remove, the Security Scanner helps remove viruses, spyware, and other malicious software. The Microsoft Security Scanner will work with your existing antivirus software but it is not a replacement for a resident antivirus software program. There is no charge to use the Microsoft Safety Scanner.


The Microsoft Safety Scanner expires ten (10) days after being downloaded. In order to scan after that time, download the Microsoft Safety Scanner again in order to get the latest anti-malware definitions.

As illustrated by the following images, the scanner is easy to use.  You can download the Microsoft Safety Scanner for running on your own computer or to removable media (i.e., a thumb drive) and transport it to another computer that is infected.


Clicking the "Download" button, provides a prompt to select the 32-bit or 64-bit version. 

If you are downloading the scanner for use on a different computer, be sure you know the correct operating system (32- or 64-bit)

Save the file to a convenient location.  When launching, Windows 7 and Windows Vista users will be asked to approve a UAC prompt.

After launching, you are presented with an end user license agreement.  The terms must be accepted in order to run the scan.


One more Next click to get to the point of selecting the type of scan you want the scanner run.

Knowing my computer is not infected, I selected a Quick scan. 

To provide "breathing space" on an infected computer, run a Quick Scan first and then follow with a Full scan.  If you have a lot of files, the scan may take up to several hours to complete.  Allow plenty of time for the scan to run to completion. 

The Quick Scan was indeed fast and only took a few minutes to complete.

After the scan has completed click Finish to close the program.

Remember, the Microsoft Safety Scanner is not a substitute for a resident antivirus software program.  It expires ten (10) days after being downloaded. In order to scan after that time, download the Microsoft Safety Scanner again in order to get the latest anti-malware definitions.

Should you need to re-examine the log, it is located at C:\Windows\Debug\msert.log.  If errors were found during the scan see Microsoft Safety Scanner Troubleshooting.

DownloadMicrosoft Safety Scanner

If you are confused about the difference between the Microsoft Security Scanner and the other anti-malware tools provided by Microsoft, my follow-up article, Understanding Microsoft Anti-Malware Software, should  help clear up the confusion.

Updated Information at Understanding Microsoft Anti-Malware Software 2012.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...


Buffet said...

More microsoft rubbish? Let me guess - it doesn't work with XP? Useless.

Corrine said...

Hi, Buffet.

The Microsoft Safety Scanner does indeed work with Windows XP.

Anonymous said...

Corrine, An excellent presentation. I want to be 100% sure of following: Can I download on any system, 32 or 64 bit, both the 32 bit and the 64 bit versions, put same on a USB stick and take to another computer,copy over and run the correct version for the destination machine?

Corrine said...

Hi, jinglehammerschmidt. Thank you.

I suggest that you create a separate folder for each version of the download as both the 32-bit and 64-bit versions are named the same, as msert.exe.

Remember, you'll want to regularly download fresh versions since it isn't self-updating.

Anonymous said...

I have now downloaded the msert.exe file 4 times (twice using firefox and twice using IE. When I try to run the file I get the following message:
"This application has failed to start because the application configuration is incorrect. Reinstalling the application may fix this problem"
Bit hard to reinstall if you can't install it in the first place!!!

Corrine said...

First delete the four previous downloads of msert.exe an empty your recycle bin.

Next, make certain you are downloading the correct version for your operating system (32-bit or 64-bit).

If you are still unable to run msert.exe, try running the Malicious Software Removal Tool and/or the Microsoft Standalone System Sweeper Beta.

Rasp said...

Did all you said Corrine, but with no success. The Microsoft Standalone System Sweeper Beta won't create the CD/DVD (it just says error)so I went with the image file, used Nero to burn it to CD but am unable to boot from the cd

Corrine said...

Hi, Rasp.

Have you tried the troubleshooting steps in this KB article: How to troubleshoot an error when you run the Microsoft Safety Scanner?

If you are still having problems, free Microsoft Customer Support Services is available by submitting a support case.

Anonymous said...

Realy many thanks from Sweden for your tutorial to understand what tools Ms has and the difference!!!

Very clear and understandable info.

Corrine said...

You're welcome. I'm glad you found the information helpful.

password usb said...

Nice post. you made my work simpler. thank you.

Anonymous said...

Hi, I wonder where do the deleted files end up at?


Anonymous said...

Hi, I wonder where do the deleted files end up at?


Corrine said...

The removed malware is quarantined. A log of what was found is available at C:\Windows\Debug\msert.log

Unknown said...

Hi Corrine. I have recently acquired a persistent Conduit bug, and have run Malwarebytes 6 times to try and remove it. Each time mbam says: '2x files found.' I always check the quarantine box. But when I read the final report, it says 'Conduit replaced'. Each time I run malwarebytes, conduit is always found on my system, but mbam seems powerless to effectively remove it. If I do try the Microsoft Safety Tool scan, how can I be sure, even if the m/soft report says it has been found and quarantined, that it is not still left lurking in a file?

Corrine said...

Hi, Bertie.

I can't help you here but if you would like me to review logs and see if I can assist that way, please register at LandzDown Forum and follow the Log Posting Instructions.