FRST (Farbar Recovery Scan Tool) is a free third-party tool that can be used for diagnostics and malware removal.
You can download FRST from one of the following links (the files will be downloaded from BleepingComputer.com), and then follow the instructions below to run it. After clicking the download link, do not click anything on the web page that appears. Wait for the download to start, usually less than 10 seconds. Save the file before running it instead of immediately clicking run.
- If you’re not certain which version of FRST to download, then download both of them.
- Since most web browsers save all downloads in your Downloads folder, we recommend copying it to your Desktop before proceeding. Please do not click ‘Run’ in your web browser since this may cause trouble for you later in the support process. Instead, click ‘Save’ or ‘Save as’ if presented with the option.
- With FRST saved to or moved to your Desktop, right-click on the icon and choose run as administrator. If both versions of FRST were downloaded, note that only one of them will work on your computer. Try each of them, starting with FRST64, as it is the most common. It will tell you if it cannot run on your computer, at which time try the other one. Otherwise, continue. A few notes:
- FRST is safe if downloaded from the links given above. Some programs, even ours, may see FRST as potentially bad due to its nature, but please allow it to run regardless of warnings. In Emsisoft Anti-Malware, if it alerts, click “Wait, I think this is safe”.
- On Windows 10, when you run FRST you may see a SmartScreen notice that Windows has protected your computer. If you do, then please click More info and select to allow FRST.
- When you run the correct version of FRST for the first time, it will show you a disclaimer. You will need to click Yes to continue. The program’s main interface will appear, looking like the following image. Leave all options exactly as they are seen here unless specifically requested by the support representative:
- Once the disclaimer closes, click on the Scan button on the left to start the scan. The scan may take a while, typically being 1-5 minutes. If it appears the computer is locked up, please wait. Note the green progress bar and changing text above the Search box that shows progress. If the program locks up for more than 40 minutes, please let us know what it says above the Search box, and close the program if possible. If Emsisoft Anti-Malware alerts when FRST is run, it will probably alert again during the scan. Please remain at the computer so that alert can also be responded to with “Wait, I think this is safe”.
- When the scan is done, it will show dialogs telling you that it saved files named FRST.txt and Addition.txt, and will open Notepad showing you the contents of these files. Please wait until both of these dialogs have appeared and you have pressed OK to close them before continuing. Here is an example:
- Close both of the Notepad windows that open, without saving, since both files are already saved at this point, then close the FRST program using the X in the upper-right corner.
- There will be two log files on your Desktop (or wherever you ran FRST from). On most computers those log files will look similar to the following:
Please send a reply to the support representative who asked you to run FRST, and attach the FRST and Addition log files to your reply.
If you were in contact with our support team via e-mail, but are not used to attaching files to e-mails, then just look for a button or link in the toolbar above where you write your message that has a paperclip icon, and clicking that should allow you to attach files to your e-mail.