Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Windows Defender Offline

Windows Defender Offline

How to Use Windows Defender Offline
Published by Brink
31 May 2011
Published by

How to Use Windows Defender Offline

information   Information
The former Microsoft Standalone System Sweeper (MSSS) BETA has been rebranded and available as Windows Defender Offline now.

Windows Defender Offline is a free standalone, bootable malware and virus remover from Microsoft that performs an offline scan of an infected PC to remove viruses, rootkits and other advanced malware.

This tutorial will show you how to update and use the Windows Defender Offline Tool to create a 32-bit or 64-bit Windows Defender Offline bootable CD/DVD, USB flash drive, or ISO file on any computer to help you start an infected 32-bit or 64-bit PC and perform an offline scan at boot to help identify and remove rootkits and other malicious malware. In addition, Windows Defender Offline can be used if you cannot install or start an antivirus program on your computer, or if the installed AV program canít detect or remove malware on your computer.

The log files for Windows Defender Offline are stored in a MPLog-MM/DD/YYYY-HH/MM/SS .txt file in the folder below on the computer that was scanned at boot.
C:\Windows\Windows Defender Offline\Support
For Windows Defender Offline FAQ's, see: Windows Defender Offline: frequently asked questions

Note   Note
Minimum System Requirements:

For both the PC infected with a virus or malware, and the PC that you are creating the bootable media on, you'll need PCs with the following minimum requirements.
  • Operating system:
    • Windows XP (Service Pack 3)
    • Windows Vista (RTM, Service Pack 1, or Service Pack 2, or higher)
    • Windows 7 (RTM, Service Pack 1, or higher)
    • Windows 8
  • Processor:
    • Windows XP: 500 MHz or higher
    • Windows Vista, Windows 7, and Windows 8: 1.0 GHz or higher
  • Memory:
    • Windows XP: 768 MB RAM or higher
    • Windows Vista, Windows 7, and Windows 8: 1 GB RAM or higher
  • Video resolution: 800 ◊ 600 or higher
  • Available hard disk space: 500 MB
For the PC infected by a virus or malware:
  • The PC must have the same Windows operating system (OS) architecture 32-bit or 64-bit as Windows Defender Offline. Bootable media created on any version of Windows can be run on any other version of Windows. The only thing that needs to match is the architecture of Windows Defender Offline and the OS of the infected machine.
  • Internet connection: Only required to update the latest malware definitions for a Windows Defender Offline bootable USB flash drive.
  • In addition, BitLocker must be disabled to use Windows Defender Offline Beta.
For the PC on which you create the bootable media:
  • Administrator account: A user account with administrator privileges to create the bootable media.
  • Internet connection: An Internet connection to install and download the latest virus and spyware definitions for Windows Defender Offline.
  • Internet browser: Windows Internet Explorer 7.0 or higher, or Mozilla Firefox 3.0 or higher.
  • Media: A CD, DVD, or USB flash drive with at least 250 MB of free space.
Tip   Tip
If you get a Error Code 0x8004cc04, Error Code 0x8004cc05, or Error Code 0x8050800c while using Windows Defender Offline, then please see the same suggested solutions here for MSSS.

If you have UEFI, then Windows Defender Offline is now able to boot with Secure Boot ENABLED.

warning   Warning
For obvious reasons, the "Windows Defender Offline" bootable CD/DVD, USB flash drive, or ISO should be created on a different computer other than the one that you suspect may be infected with malware.





STEP ONE
To Create a "Windows Defender Offline" Bootable CD/DVD, USB Flash Drive, or ISO File
1. If you have not already, you will need to download the same 32-bit or 64-bit version of Windows Defender Offline Tool at the download link below for the same 32-bit or 64-bit Windows that is installed on the computer that you will be scanning at boot, and save the exe file to your desktop.
download
2. Run the downloaded mssstool64.exe (64-bit) or mssstool32.exe (32-bit) file, and click on Next. (see screenshot below)
Name:  Step1.jpg
Views: 27264
Size:  87.7 KB
3. Click on the I accept button. (see screenshot below)
NOTE: You will only be prompted for this the first time that you run the Windows Defender Offline Tool.
Name:  Step2.jpg
Views: 27082
Size:  90.6 KB
4. Do step 5, 6, or 7 below for what type of bootable "Windows Defender Offline" CD/DVD, USB, or ISO that you would like to create to scan with. (see screenshot below)
Name:  Step3.jpg
Views: 27119
Size:  55.7 KB
5. To Create a"Windows Defender Offline" Bootable CD or DVD
A) Insert a blank unformatted CD or DVD into the CD/DVD drive.
NOTE: If a AutoPlay window opens afterwards, close it.

B) Select (dot) Use a blank CD or a DVD, and click on Next. (see screenshot below step 4)

C) If you have more than one DC/DVD drive, then select the CD/DVD drive with the blank CD/DVD in it, and click on Next. (see screenshot below)
Name:  DVD-1.jpg
Views: 27051
Size:  48.1 KB
D) When it's finished, click on Finish. (see screenshot below)
NOTE: Be sure to label the CD/DVD as being able to only be used on a 32-bit or 64-bit Windows computer at boot.
Name:  DVD-2.jpg
Views: 27025
Size:  79.6 KB
E) Go to step 8.
6. To Create a "Windows Defender Offline" Bootable USB Flash Drive


Note   Note
If you run the Windows Defender Offline Tool again on the same USB flash drive, and if the following conditions below are met, the tool will only download new updated malware definitions (approx. 69.48 MB) and update the USB drive without reformatting it.
  • The USB flash drive has Windows Defender Offline previously installed on it.
  • The Windows Defender Offline Tool version that was used to create the bootable USB flash drive the first run is the same as the one being used for the second run.
  • Files on the USB flash drive are not damaged or missing (the tool will verify that).
A) Connect a USB flash drive that is not password protected to your computer.
WARNING: This USB drive will be formated during this process, so be sure to backup anything that you do not want to lose to another location first.

B) Select (dot) On a USB flash drive that is not password protected, and click on Next. (see screenshot below step 4)

C) If you have more than one USB drives connected, then select the one that you want to use, and click on Next. (see screenshot below)
Name:  USB-1B.jpg
Views: 27004
Size:  54.3 KB
D) When it's finished, click on Finish. (see screenshot below)
Name:  USB-2.jpg
Views: 26960
Size:  77.5 KB
E) Go to step 8.
7. To Create a "Windows Defender Offline" Bootable ISO File
A) Select (dot) Create Standalone System Sweeper on an ISO File, and click on Next. (see screenshot below step 4)

B) Select (browse) where you would like to save the ISO file to, and click on Next. (see screenshots below)
Name:  ISO-1.jpg
Views: 26912
Size:  59.9 KB

Windows Defender Offline-iso-2.jpg

C) When it's finished, click on Finish. (see screenshot below)
Name:  ISO-3.jpg
Views: 26876
Size:  80.7 KB
D) You can now use the ISO file to boot with in a virtual machine (ex: Windows Virtual PC), or use the free Windows 7 USB/DVD Download Tool to burn the ISO to a DVD or USB flash drive.

E) Continue on to step 8.
8. You will now be able to boot from the 32-bit or 64-bit CD/DVD, USB, or ISO that you created to run Windows Defender Offline on the same 32-bit or 64-bit computer as in the STEP TWO section below when you like.



STEP TWO
To Scan a Computer with the Bootable CD/DVD or USB Flash Drive
1. Insert or connect the same 32-bit or 64-bit Windows Defender Offline bootable CD/DVD or USB flash drive to the same type of 32-bit or 64-bit Windows computer that you want to scan at boot.
NOTE: For example, you can only use a created 32-bit USB on a 32-bit computer at boot, and you can only use a created 64-bit USB on a 64-bit computer at boot.

2. In your BIOS/UEFI Boot Menu (ex: F11) of the computer that you want to scan, select to temporarily boot from the CD/DVD or USB flash drive created in the STEP ONE section above, and boot from it.

Note   Note
Please consult your computer's or motherboard's manual for exact details on how to do this.

You do not need to change the boot priority order in the BIOS/UEFI settings for this. Use the Boot Menu instead to select to only temporarily boot from the DVD/USB instead.



3. This is what you will see while it's booting from the CD/DVD or USB flash drive.
Windows Defender Offline-restart-1.jpg

Windows Defender Offline-restart-2.jpg

4. When Windows Defender Offline has booted, you will be able to update the definitions and select what type of scan you would like to run on the computer. A Full Scan is recommended, and could take several hours to complete.
NOTE: You will only be able to update the definitions at boot if you are using a bootable USB flash drive with a internet connection, and not with a bootable CD/DVD.
Windows Defender Offline-update.jpg

Windows Defender Offline-scan.jpg

5. When finished, close Windows Defender Offline to restart the computer back into Windows.
That's it,
Shawn






31 May 2011   #1
beauparc

Windows 7 64 bit
 
 

Another excellent tutorial, Brink. Thanks.

One question....stated at the bottom of the download page is the message that your computer must be able to run Microsoft Security Essentials. Does this mean that MSE will be installed and will this conflict with Norton 360 version 5 which I currently use? I have always thought that one should never have two AV programmes installed since they may interfere with each other, and Windows doesn't like it.


My System SpecsSystem Spec
31 May 2011   #2
Airbot

Windows 7 Ultimate x64 SP1
 
 

No, it won't install MSE.
My System SpecsSystem Spec
31 May 2011   #3
Brink
Microsoft MVP

64-bit Windows 8.1 Enterprise
 
 

Quote   Quote: Originally Posted by beauparc View Post
Another excellent tutorial, Brink. Thanks.

One question....stated at the bottom of the download page is the message that your computer must be able to run Microsoft Security Essentials. Does this mean that MSE will be installed and will this conflict with Norton 360 version 5 which I currently use? I have always thought that one should never have two AV programmes installed since they may interfere with each other, and Windows doesn't like it.
Hello Steve,

No, Microsoft Security Essentials (MSE) or anything else will not be installed. It was just a reference as an optional separate program that you could install on the computer and use if you did not already have a antivirus program installed on your computer.

Microsoft Standalone System Sweeper is a standalone program that runs at boot from the created CD/DVD, USB, or ISO instead, and does not install anything on your computer.
My System SpecsSystem Spec
.


31 May 2011   #4
Dwarf

Windows 8.1 Pro RTM x64
 
 

No, that does not mean that MSE will be installed. It's just a suggestion for those using this tool who don't already have an alternative installed.
My System SpecsSystem Spec
31 May 2011   #5
gmorphus

Windows 7 Enterprise x64 SP1
 
 

Great article Brink!

Another tip regarding update definitions -

Update definition on a USB thumb drive
(instructions below are relevant for version 1.0.856.0)

When running the tool again, if the following conditions are met, it will only download definitions (approx. 60MB) and update the USB drive without reformatting it:
  1. A USB thumb drive media is selected.
  2. The USB drive being has a previously installed Standalone System Sweeper.
  3. The version that was used to create the bootable media is the same as being used at the second run.
  4. Files on the USB drive were not damanged or missing (the tool will verify that).
Enjoy!
Guy Arad.
My System SpecsSystem Spec
31 May 2011   #6
Brink
Microsoft MVP

64-bit Windows 8.1 Enterprise
 
 

Hello Guy Arad, and welcome to Seven Forums.

Thank you. Added.
My System SpecsSystem Spec
01 Jun 2011   #7
Dave76

Microsoft Community Contributor Award Recipient

Windows 7 Ult x64 - SP1/ Windows 8 Pro x64
 
 

Great tut, again thanks.

As soon as I saw this, was hoping it was available in an ISO file.
Will add this to my rescue USB tool.
My System SpecsSystem Spec
01 Jun 2011   #8
gmorphus

Windows 7 Enterprise x64 SP1
 
 

Quote   Quote: Originally Posted by Dave76 View Post
Great tut, again thanks.

As soon as I saw this, was hoping it was available in an ISO file.
Will add this to my rescue USB tool.
I'm glad you are happy with the ISO option. We were hoping it would be of use.
However, if you prepare the ISO now and keep it aside, it will not be up-to-date by the time you are using it (hopefully never ).

I have two suggestions for you:
  1. Since the tool will reformat your USB, backup your rescue USB drive and create a bootable USB using the tool (you can then copy your data back onto the USB drive), and add the tool binary as well. By the time you have to use, it run the tool again with the same USB drive. The tool will detect the already installed product and will only update the definitions (without reformatting or altering your data).
  2. The second option is indeed to keep an ISO and when the day comes use Brink's option #1 of manually updating the definitions.
    Please keep in mind that the latter option is not currently supported or intended by Microsoft. Use it at your own risk.
Thanks,
Guy.
My System SpecsSystem Spec
01 Jun 2011   #9
Brink
Microsoft MVP

64-bit Windows 8.1 Enterprise
 
 

I found the ISO useful to run at boot on a virtual machine (ex: Windows Virtual PC) to scan it. You can just select the ISO file to act as a "DVD Drive" in the VM's settings to boot from.
My System SpecsSystem Spec
Comment

 Windows Defender Offline




Tutorial Tools




Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 01:30 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33