Fix mrt.exe High CPU & RAM Usage (Windows)

If your Windows PC is suddenly sluggish and Task Manager shows mrt.exe (Microsoft Windows Malicious Software Removal Tool) eating up your CPU and RAM, this guide walks you through the actual causes and the exact steps to fix it. You’ll learn how to stop the current process, prevent unnecessary future runs, and verify your system is still protected.

What You’ll Need

Administrator access to your Windows PC (to change scheduled tasks and run commands).
About 10 minutes of time.
Internet connection (only if you need to run a manual update or a full offline scan).

Step-by-Step

Confirm it’s actually mrt.exe. Open Task Manager (Ctrl+Shift+Esc), go to the Details tab, and find mrt.exe. Check its path by right-clicking it and selecting Open file location. The legitimate file lives in C:\Windows\System32\mrt.exe. If it’s anywhere else, you may be dealing with malware, and you should skip to the Troubleshooting section.
Stop the current run. In Task Manager, right-click mrt.exe and select End task. It will stop within a few seconds. If it won’t stop, reboot your PC – the scan isn’t critical to finish.
Understand why it ran. Windows schedules this tool to run automatically via Task Scheduler, usually at 2:00 AM on the first Wednesday of each month. It also runs after certain Windows updates. The scan can take 15–60 minutes on older or heavily loaded machines, which is why you see the high usage.
Disable the scheduled task (optional but recommended). Press Win + R, type taskschd.msc, and press Enter. Navigate to Task Scheduler Library → Microsoft → Windows → RemovalTools. Right-click the task named Microsoft Windows Malicious Software Removal Tool and choose Disable. This stops automatic future runs. Your real antivirus (Windows Defender or a third-party one) is still fully active.
Run the tool manually only when you want it. If you still want to use it occasionally, open Command Prompt as Administrator (search “cmd�, right-click, Run as administrator) and type mrt.exe. It will launch in a GUI where you can choose a Quick, Full, or Custom scan. A full scan is the one that causes the high usage – a quick scan is usually fine.
Reduce its impact if you keep it enabled. If you prefer to leave the scheduled task enabled, you can change its trigger. In Task Scheduler, double-click the task, go to the Triggers tab, select the trigger, and click Edit. Change the start time to a time when you’re not using the computer (e.g., 3:00 AM) and check Stop task if it runs longer than – set it to 30 minutes. This limits how long it can hammer your system.
Check for a corrupted file. If mrt.exe is stuck in a loop or using 100% CPU constantly, the file may be corrupted. Open Command Prompt as Administrator and run sfc /scannow. This checks system files and repairs them if needed. Reboot afterwards.

Common Mistakes

Deleting mrt.exe. Don’t delete the file itself. Windows may re-download it, and you risk breaking system integrity. Disabling the scheduled task is the correct approach.
Confusing it with a virus. mrt.exe is a legitimate Microsoft tool. If your antivirus flags it, it’s usually a false positive, but verify the file path as in Step 1.
Disabling Windows Defender entirely. Some guides suggest turning off real-time protection. That’s dangerous. Only disable the mrt scheduled task, not your core antivirus.
Assuming it’s a one-time thing. If you don’t disable the task, it will come back every month. The high usage is normal during the scan, but if it’s happening daily, something else is wrong – check the Troubleshooting section.

Tips

Use the “Quick� scan option. It takes under 5 minutes and covers the most common infection points. The “Full� scan checks every file, which is overkill for routine maintenance.
Schedule it during idle time. If you keep the task enabled, set it to run when you’re asleep. The tool will use the CPU, but you won’t notice it.
Keep Windows updated. Microsoft updates the tool definition files via Windows Update. If your system is up to date, the scan will be faster and more effective.
Check your other startup programs. Sometimes mrt.exe isn’t the real problem – it’s just the one you notice. Use Task Manager’s Startup tab to disable unnecessary apps that are also eating resources.

Troubleshooting

mrt.exe won’t stop even after ending the task. Reboot your PC. If it starts again immediately after boot, you may have a scheduled task set to run at logon. Check Task Scheduler for any custom tasks with “mrt� in the name and disable them.

CPU usage stays at 100% even when mrt.exe is not running. Open Task Manager and sort by CPU. Look for other processes like MsMpEng.exe (Windows Defender) or SearchIndexer.exe. If Defender is scanning, wait a few minutes – it usually finishes. If not, run a full Defender scan manually to clear any pending scan state.

You see multiple mrt.exe processes. This is unusual. It could mean a previous scan is stuck. End all of them, then run sfc /scannow as described in Step 7. If the issue persists, run DISM /Online /Cleanup-Image /RestoreHealth in the same admin Command Prompt.

The file location is not System32. This is a red flag. Immediately run a full scan with Windows Defender (or your third-party antivirus). Do not open the file. If the scan finds nothing, you can delete the suspicious file after confirming your antivirus is clean.

mrt.exe runs every day. This is not normal. Check the Task Scheduler task’s triggers – it may have been modified. Also check if a third-party “optimizer� tool is calling it. Uninstall any system cleaner that you didn’t intentionally install.

Frequently Asked Questions

Is mrt.exe a virus?

No. The legitimate Microsoft Windows Malicious Software Removal Tool is a signed Microsoft executable. It’s not a virus, but malware can disguise itself with the same name. Always check the file path – it must be in C:\Windows\System32.

Can I delete mrt.exe?

Technically yes, but you shouldn’t. Windows will likely re-download it, and deleting system files can cause other issues. Disabling the scheduled task is safer and achieves the same result.

Why does mrt.exe use so much RAM?

During a full scan, it loads file signatures into memory and scans every file on your disk. On systems with many files or limited RAM (8GB or less), this can cause high memory usage. It’s temporary and stops when the scan finishes.

How long should mrt.exe run?

A quick scan takes 2–10 minutes. A full scan can take 30–60 minutes on a typical PC, and longer on older or heavily populated drives. If it runs for more than 2 hours, something is wrong – end the task and run sfc /scannow.

Will disabling the scheduled task leave me unprotected?

No. mrt.exe is a supplementary tool that only checks for specific, well-known malware. Your primary antivirus (Windows Defender or third-party) provides real-time protection. Disabling mrt’s schedule doesn’t affect that.

How do I run mrt.exe manually?

Press Win + R, type mrt, and press Enter. Or open Command Prompt as Administrator and type mrt.exe. Then choose your scan type.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →