{"id":77920,"date":"2025-02-17T21:30:53","date_gmt":"2025-02-17T16:00:53","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=77920"},"modified":"2026-02-28T23:23:02","modified_gmt":"2026-02-28T17:53:02","slug":"farbar-recovery-scan-tool","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/farbar-recovery-scan-tool\/","title":{"rendered":"How to Run a Scan using Farbar Recovery Scan Tool"},"content":{"rendered":"<p>The Farbar Recovery Scan Tool (FRST) is an advanced tool for a detailed system inspection, fixing misconfiguration, and removing active malware. The\u00a0<a href=\"https:\/\/www.bleepingcomputer.com\/forums\/t\/781976\/frst-tutorial-how-to-use-farbar-recovery-scan-tool\/\" target=\"_blank\" rel=\"noopener\">FRST Tutorial is available<\/a>\u00a0on BleepingComputer.com.<\/p>\n<h2>Here&#8217;s how to run a scan using FRST<\/h2>\n<h3>Method 1: Download and run a scan manually<\/h3>\n<p><em><strong>Note:<\/strong> When you scan using FRST, it doesn&#8217;t modify or fix anything on your system. Instead, the tool gathers various settings and outputs the results to two log files, FRST.txt and Addition.txt. These logs may not be user-friendly, but they contain helpful information for troubleshooting. An expert will analyze the logs and prescribe the fix (i.e., a &#8220;fixlist.txt&#8221; script) for that system.<\/em><\/p>\n<ol>\n<li>Download Farbar Recovery Scan Tool 64-bit (FRST64.exe) from BleepingComputer.com.\n<ul>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/download\/farbar-recovery-scan-tool\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.bleepingcomputer.com\/download\/farbar-recovery-scan-tool\/<\/a><\/li>\n<\/ul>\n<div class=\"qt\">\n<p><strong>Note:<\/strong>If Microsoft Edge or Chrome mislabels the Farbar Scanner executable as PUA\/malware, choose to keep it by tapping \u2026 in the bottom bar, choosing Keep, and then choosing Keep anyway in the dialog that appears.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-77744\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2025\/01\/frst-keep-edge.png\" alt=\"farbar scanner - blocked by edge\" width=\"441\" height=\"345\" \/><\/p>\n<p>You may see the message &#8220;Make sure you trust FRST64.exe before you open it.&#8221; Expand &#8220;Show more&#8221; in that flyout menu and click &#8220;Keep anyway.&#8221;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-77743\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2025\/01\/frst-keep-edge-2.png\" alt=\"farbar scanner - blocked by edge\" width=\"431\" height=\"643\" \/><\/p>\n<p><em>(It&#8217;s a safe tool used in most antimalware forums, including the Malwarebytes support forums. The author updates the tool regularly.)<\/em><\/p>\n<\/div>\n<\/li>\n<li>If the OS language is non-English, rename FRST64.exe to FRST64English.exe.<\/li>\n<li>Run the program. The program updates itself and relaunches automatically.<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-77746\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2025\/01\/frst64.png\" alt=\"FRST UI\" width=\"551\" height=\"348\" \/><\/li>\n<li>Don&#8217;t check or uncheck any options unless you are instructed to do so. Click &#8220;<strong>Scan<\/strong>&#8220;.<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-77749\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2025\/01\/frst64-scanning.png\" alt=\"FRST - scanning\" width=\"551\" height=\"348\" \/><\/li>\n<li>It outputs the two logs, <strong>FRST.txt<\/strong> and <strong>Addition.txt<\/strong> to the same folder where FRST64.exe is. Zip the two logs and upload them to your OneDrive or a free file-sharing service like wetransfer.com. Then, share the link with the support personnel.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-77750\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2025\/01\/frst-logs.png\" alt=\"FRST.txt and Addition.txt logs\" width=\"625\" height=\"130\" \/><\/li>\n<\/ol>\n<hr \/>\n<h3>Method 2: Download and run a scan using command-line<\/h3>\n<p>Using PowerShell, you can automate the above process: i.e., download of the Farbar Scanner,\u00a0run the scan, and zip the logs to your desktop.<\/p>\n<p>Open <strong>admin<\/strong> PowerShell and run these commands one by one:<\/p>\n<pre class=\"powershell\" style=\"font-size:75%\">md C:\\Tools\n\nIWR https:\/\/downloads.malwarebytes.com\/file\/mbst-frst64 -OutFile C:\\Tools\\FRST64English.exe\n\nC:\\Tools\\FRST64English.exe -scan | Out-Null\n\nCompress-Archive 'C:\\Tools\\*.txt' -f (join-path ([environment]::GetFolderPath('Desktop')) \\FRST.zip)<\/pre>\n<p>The above commands download the Farbar Scanner from the Malwarebytes server to the &#8220;C:\\Tools&#8221; directory. It then runs a scan, saves the logs, and adds the log files to a zip folder (FRST.zip) on your desktop.<\/p>\n<p><em>(The third command runs the scan. It can take a few minutes to complete. Once it&#8217;s completed, run the last command.)<\/em><\/p>\n<p>Share the .zip file to the expert via OneDrive or wetransfer.com and send them the link.<\/p>\n<hr \/>\n<h3>Sharing the files on OneDrive<\/h3>\n<p>To share the files on OneDrive, please see \u2192 <a href=\"https:\/\/support.microsoft.com\/en-us\/office\/share-onedrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07\" target=\"_blank\" rel=\"noopener\">How-To: Share OneDrive files and folders &#8211; Microsoft Support<\/a>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-77748\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2025\/01\/onedrive-share-anyone.png\" alt=\"OneDrive sharing options\" width=\"482\" height=\"534\" \/><\/p>\n<p>In the OneDrive share options, choose &#8220;<strong>Anyone<\/strong>&#8221; and &#8220;<strong>Can view<\/strong>&#8221; options, and click <strong>Apply<\/strong>. It generates a download URL for the shared file.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Farbar Recovery Scan Tool (FRST) is an advanced tool for a detailed system inspection, fixing misconfiguration, and removing active malware. The\u00a0FRST Tutorial is available\u00a0on BleepingComputer.com. Here&#8217;s how to run a scan using FRST Method 1: Download and run a scan manually Note: When you scan using FRST, it doesn&#8217;t modify or fix anything on &#8230; <a title=\"How to Run a Scan using Farbar Recovery Scan Tool\" class=\"read-more\" href=\"https:\/\/www.winhelponline.com\/blog\/farbar-recovery-scan-tool\/\" aria-label=\"Read more about How to Run a Scan using Farbar Recovery Scan Tool\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[6],"tags":[983],"class_list":["post-77920","post","type-post","status-publish","format-standard","hentry","category-utilities","tag-farbar"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":31098,"url":"https:\/\/www.winhelponline.com\/blog\/collect-diagnostic-logs-windows\/","url_meta":{"origin":77920,"position":0},"title":"How to Collect Diagnostic Logs in Windows","author":"Ramesh","date":"December 21, 2022","format":false,"excerpt":"There are many different types of diagnostic logs in Windows. Each log is to diagnose a specific component. The Windows Update client creates the Windows Update ETL or Windows Update log files, the Component-Based Servicing uses \"cbs.log\", and the DISM tool writes to \"dism.log\", etc. Besides the native logs, you\u2026","rel":"","context":"In &quot;Utilities&quot;","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"Farbar Recovery Scan Tool - FRST - FRST64.exe","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/farbar.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/farbar.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/farbar.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":37787,"url":"https:\/\/www.winhelponline.com\/blog\/unremovable-apps-extension-edge-chrome\/","url_meta":{"origin":77920,"position":1},"title":"Fix: Unremovable &#8220;Apps&#8221; Extension in Edge or Chrome","author":"Ramesh","date":"April 11, 2023","format":false,"excerpt":"Of late, many users are facing a problem where a rogue browser extension named \"Apps\" appears in Chrome or Edge. Also, the user is unable to remove the extension. Attempting to remove the extension via the registry or deleting the extension folder doesn't help, as the extension is automatically installed\u2026","rel":"","context":"In &quot;General&quot;","block_context":{"text":"General","link":"https:\/\/www.winhelponline.com\/blog\/category\/general\/"},"img":{"alt_text":"Farbar scanner - FRST","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/04\/frst-dashboard.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/04\/frst-dashboard.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/04\/frst-dashboard.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":59512,"url":"https:\/\/www.winhelponline.com\/blog\/common-language-runtime-native-compiler-100-cpu\/","url_meta":{"origin":77920,"position":2},"title":"Microsoft Common Language Runtime Native Compiler 100% CPU Usage","author":"Ramesh","date":"July 18, 2023","format":false,"excerpt":"When you open Task Manager, you may see that the module \"Microsoft common language runtime native compiler\" may use 100% of the CPU and hamper the device's performance. If the task is ended manually, it starts up automatically after about 10-20 minutes. You may wonder what causes this issue and\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":80414,"url":"https:\/\/www.winhelponline.com\/blog\/powershell-license-ok-message-at-startup\/","url_meta":{"origin":77920,"position":3},"title":"PowerShell &#8220;License OK&#8221; message at Startup","author":"Ramesh","date":"March 9, 2026","format":false,"excerpt":"When you log in to your account, PowerShell may automatically open and display the message \"License OK\" in the console. Here's the full output. Running the environment check. Please wait... License OK Running the environment check. Please wait... License OK IsPublic IsSerial Name BaseType -------- -------- ---- -------- True False\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"powershell license ok error at startup","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2026\/03\/powershell-license-ok-error.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2026\/03\/powershell-license-ok-error.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2026\/03\/powershell-license-ok-error.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":61566,"url":"https:\/\/www.winhelponline.com\/blog\/temp-files-folders-at-logon\/","url_meta":{"origin":77920,"position":4},"title":"[Fix] Temporary Files and Folders Pop Up at Logon","author":"Ramesh","date":"September 11, 2023","format":false,"excerpt":"When you log in to your computer, several files and folders may open at startup. A few text-based files by the names \"StructuredQuery\", \"MSI67784\", \"cv_bug,\" and lastly, \"chrome_installer\" may open. If you run Autoruns (from Microsoft Sysinternals) to inspect your startup entries, the Logon tab lists all files from the\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"Autoruns temporary files in the logon tab","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/09\/temp-files-open-startup-1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/09\/temp-files-open-startup-1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/09\/temp-files-open-startup-1.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/09\/temp-files-open-startup-1.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":54263,"url":"https:\/\/www.winhelponline.com\/blog\/windows-script-host-error-run-vbs\/","url_meta":{"origin":77920,"position":5},"title":"Windows Script Host error in AppData\\Local\\Updates\\Run.vbs. The System cannot find the file specified","author":"Ramesh","date":"June 17, 2023","format":false,"excerpt":"When you login to your account,\u00a0you may see a Windows Script Host error similar to the following: Windows Script Host Script: C:\\Users\\{username}\\AppData\\Local\\Updates\\Run.vbs Line: 31 Char: 1 Error: The system cannot find the file specified. Code: 80070002 Source: (null) Additionally, on some systems, you may see a WindowsService.exe popup window that\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"windowsservice.exe malware","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=700%2C400&ssl=1 2x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/77920","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=77920"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/77920\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=77920"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=77920"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=77920"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}