Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why does Windows Vista have two programs to remove viruses:

Windows Defender and Microsoft Windows Malicious Software Removal Tool (MRT)

share|improve this question
up vote 8 down vote accepted

Windows Defender runs in the background as real-time protection, looking for suspicious activities on your computer in order to prevent a break-out.

Windows Defender is software that helps protect your computer against pop-ups, slow performance, and security threats caused by spyware and other unwanted software by detecting and removing known spyware from your computer. Windows Defender features Real-Time Protection, a monitoring system that recommends actions against spyware when it's detected, minimizes interruptions, and helps you stay productive.

Main features:

  • Spyware detection and removal
  • Improved Internet browsing safety
  • Protection against the latest threats (MS researchers and a voluntary, worldwide network gather information ybout security threads

You can use the Malicious Software Removal Tool (mrt.exe) to scan for malicous software which has already infected your computer.

The Microsoft Windows Malicious Software Removal Tool checks computers running Windows Vista, Windows XP, Windows 2000, and Windows Server 2003 for infections by specific, prevalent malicious software—including Blaster, Sasser, and Mydoom—and helps remove any infection found. When the detection and removal process is complete, the tool displays a report describing the outcome, including which, if any, malicious software was detected and removed.

share|improve this answer

Windows Defender is an "active" running program. It is designed to detect and block entry of malicious programs before you have a security issue.

Malicious Software Removal Tool is designed to run after the fact. If your system is breached, you'll run this instead.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.