Windows Defender Offline

How to Use Windows Defender Offline​

   Information

The former Microsoft Standalone System Sweeper (MSSS) BETA has been rebranded and available as Windows Defender Offline now.

Windows Defender Offline is a free standalone, bootable malware and virus remover from Microsoft that performs an offline scan of an infected PC to remove viruses, rootkits and other advanced malware.

This tutorial will show you how to update and use the Windows Defender Offline Tool to create a 32-bit or 64-bit Windows Defender Offline bootable CD/DVD, USB flash drive, or ISO file on any computer to help you start an infected 32-bit or 64-bit PC and perform an offline scan at boot to help identify and remove rootkits and other malicious malware. In addition, Windows Defender Offline can be used if you cannot install or start an antivirus program on your computer, or if the installed AV program can’t detect or remove malware on your computer.

The log files for Windows Defender Offline are stored in a MPLog-MM/DD/YYYY-HH/MM/SS .txt file in the folder below on the computer that was scanned at boot.
C:\Windows\Windows Defender Offline\Support
For Windows Defender Offline FAQ's, see: Windows Defender Offline: frequently asked questions

   Note

Minimum System Requirements:

For both the PC infected with a virus or malware, and the PC that you are creating the bootable media on, you'll need PCs with the following minimum requirements.

• Operating system:
  • Windows XP (Service Pack 3)
  • Windows Vista (RTM, Service Pack 1, or Service Pack 2, or higher)
  • Windows 7 (RTM, Service Pack 1, or higher)
  • Windows 8
• Processor:
  • Windows XP: 500 MHz or higher
  • Windows Vista, Windows 7, and Windows 8: 1.0 GHz or higher
• Memory:
  • Windows XP: 768 MB RAM or higher
  • Windows Vista, Windows 7, and Windows 8: 1 GB RAM or higher
• Video resolution: 800 × 600 or higher
• Available hard disk space: 500 MB

For the PC infected by a virus or malware:

• The PC must have the same Windows operating system (OS) architecture 32-bit or 64-bit as Windows Defender Offline. Bootable media created on any version of Windows can be run on any other version of Windows. The only thing that needs to match is the architecture of Windows Defender Offline and the OS of the infected machine.
• Internet connection: Only required to update the latest malware definitions for a Windows Defender Offline bootable USB flash drive.
• In addition, BitLocker must be disabled to use Windows Defender Offline Beta.

For the PC on which you create the bootable media:

• Administrator account: A user account with administrator privileges to create the bootable media.
• Internet connection: An Internet connection to install and download the latest virus and spyware definitions for Windows Defender Offline.
• Internet browser: Windows Internet Explorer 7.0 or higher, or Mozilla Firefox 3.0 or higher.
• Media: A CD, DVD, or USB flash drive with at least 250 MB of free space.

   Tip

If you get a Error Code 0x8004cc04, Error Code 0x8004cc05, or Error Code 0x8050800c while using Windows Defender Offline, then please see the same suggested solutions here for MSSS.

If you have UEFI, then Windows Defender Offline is now able to boot with Secure Boot ENABLED.

   Warning

For obvious reasons, the "Windows Defender Offline" bootable CD/DVD, USB flash drive, or ISO should be created on a different computer other than the one that you suspect may be infected with malware.

STEP ONE

To Create a "Windows Defender Offline" Bootable CD/DVD, USB Flash Drive, or ISO File

1. If you have not already, you will need to download the same 32-bit or 64-bit version of Windows Defender Offline Tool at the download link below for the same 32-bit or 64-bit Windows that is installed on the computer that you will be scanning at boot, and save the exe file to your desktop.

Download


2. Run the downloaded mssstool64.exe (64-bit) or mssstool32.exe (32-bit) file, and click on Next. (see screenshot below)

3. Click on the I accept button. (see screenshot below)
NOTE: You will only be prompted for this the first time that you run the Windows Defender Offline Tool.

4. Do step 5, 6, or 7 below for what type of bootable "Windows Defender Offline" CD/DVD, USB, or ISO that you would like to create to scan with. (see screenshot below)

5. To Create a"Windows Defender Offline" Bootable CD or DVD
A) Insert a blank unformatted CD or DVD into the CD/DVD drive.
NOTE: If a AutoPlay window opens afterwards, close it.

B) Select (dot) Use a blank CD or a DVD, and click on Next. (see screenshot below step 4)

C) If you have more than one DC/DVD drive, then select the CD/DVD drive with the blank CD/DVD in it, and click on Next. (see screenshot below)

D) When it's finished, click on Finish. (see screenshot below)
NOTE: Be sure to label the CD/DVD as being able to only be used on a 32-bit or 64-bit Windows computer at boot.

E) Go to step 8.
6. To Create a "Windows Defender Offline" Bootable USB Flash Drive

   Note

If you run the Windows Defender Offline Tool again on the same USB flash drive, and if the following conditions below are met, the tool will only download new updated malware definitions (approx. 69.48 MB) and update the USB drive without reformatting it.

• The USB flash drive has Windows Defender Offline previously installed on it.
• The Windows Defender Offline Tool version that was used to create the bootable USB flash drive the first run is the same as the one being used for the second run.
• Files on the USB flash drive are not damaged or missing (the tool will verify that).

A) Connect a USB flash drive that is not password protected to your computer.
WARNING: This USB drive will be formated during this process, so be sure to backup anything that you do not want to lose to another location first.

B) Select (dot) On a USB flash drive that is not password protected, and click on Next. (see screenshot below step 4)

C) If you have more than one USB drives connected, then select the one that you want to use, and click on Next. (see screenshot below)

D) When it's finished, click on Finish. (see screenshot below)

E) Go to step 8.
7. To Create a "Windows Defender Offline" Bootable ISO File
A) Select (dot) Create Standalone System Sweeper on an ISO File, and click on Next. (see screenshot below step 4)

B) Select (browse) where you would like to save the ISO file to, and click on Next. (see screenshots below)




C) When it's finished, click on Finish. (see screenshot below)

D) You can now use the ISO file to boot with in a virtual machine (ex: Windows Virtual PC), or use the free Windows 7 USB/DVD Download Tool to burn the ISO to a DVD or USB flash drive.

E) Continue on to step 8.
8. You will now be able to boot from the 32-bit or 64-bit CD/DVD, USB, or ISO that you created to run Windows Defender Offline on the same 32-bit or 64-bit computer as in the STEP TWO section below when you like.

STEP TWO

To Scan a Computer with the Bootable CD/DVD or USB Flash Drive

1. Insert or connect the same 32-bit or 64-bit Windows Defender Offline bootable CD/DVD or USB flash drive to the same type of 32-bit or 64-bit Windows computer that you want to scan at boot.
NOTE: For example, you can only use a created 32-bit USB on a 32-bit computer at boot, and you can only use a created 64-bit USB on a 64-bit computer at boot.

2. In your BIOS/UEFI Boot Menu (ex: F11) of the computer that you want to scan, select to temporarily boot from the CD/DVD or USB flash drive created in the STEP ONE section above, and boot from it.

   Note

Please consult your computer's or motherboard's manual for exact details on how to do this.

You do not need to change the boot priority order in the BIOS/UEFI settings for this. Use the Boot Menu instead to select to only temporarily boot from the DVD/USB instead.

3. This is what you will see while it's booting from the CD/DVD or USB flash drive.




4. When Windows Defender Offline has booted, you will be able to update the definitions and select what type of scan you would like to run on the computer. A Full Scan is recommended, and could take several hours to complete.
NOTE: You will only be able to update the definitions at boot if you are using a bootable USB flash drive with a internet connection, and not with a bootable CD/DVD.




5. When finished, close Windows Defender Offline to restart the computer back into Windows.
That's it,
Shawn

Related Tutorials

---

• How to Download and Use the Microsoft Windows Malicious Software Removal Tool
• Scan for Malware using Malwarebytes Anti-Malware Free
• Add an Explorer context menu 'Send to VirusTotal'
• Enhanced Mitigation Experience Toolkit (EMET)
• How to Install and Use Microsoft Security Essentials
• How to Use the Microsoft Safety Scanner
• How to Scan Suspicious Files using Online Scanners

 

[joe5181]

I ended up quickly borrowing another family member's 64bit laptop, and it all worked fine (had to do this because apparently you cant make the WDO disk while in safe mode).

Anyways, thanks for your help and input!

-Joe5181

 

[Brink]

That's great news Joe. Thank you for posting back about safe mode.

 

[bagavan]

are there any chances of corruption of defender offline itself when it is attached to the infected pc?

 

[Golden]

are there any chances of corruption of defender offline itself when it is attached to the infected pc?

No, none at all.

 

[ghoodguy]

When i attempt to run windows defender offline i get a and something that says there was an error and it needed to restart, this goes in an endless loop now

 

[Brink]

Hello ghoodguy, and welcome to Seven Forums.

Do you know the exact full error message?

For now, it may be related to your BSOD issue you posted. I would get that solved first.

 

[ghoodguy]

It force restarts the computer too fast for me to read the whole thing but it says something a long the lines of it needs more information to run and will restart, but it says the same thing every time. And I am not entirely sure how it would relate to my other issue, and this was a suggestion to try in an attempt to solve my other problem which is why I came here.

 

[Brink]

If it's a hardware issue causing the BSOD, then it may also be causing WD Offline to fail to boot as well. Let's get the BSOD issue sorted first.

 

[macnab]

You might like to add:
1) When changing the boot device in the problem PC, make a note of the current boot device.
2) Final step, set the problem PC to boot from the original device.

 

[Brink]

Hello Macnab,

I've updated step 2 in the STEP TWO section to help with and avoid that.

 

[jonnyhotchkiss]

Hi. I downloaded the ISO, and made a bootable copy (easyBCD).

My OS is native VHD, so when I select it from the boot menu, the VHD containing the OS is mounted and booted.


When I run windefenderoffline, it doesn't see any OS, cause none is attached (cause I've booted to defenderoffline, not my OS).


My question:


How do you use windows defender offline with a native virtual hard-disk?
Add a Native-Boot Virtual Hard Disk to the Boot Menu

 

[thebladeroden]

Operating system:

• Windows XP (Service Pack 3)

I tried it on XP SP3 but it says my operating system isn't supported

 

[Brink]

Hello Bladeroden,

It still claims it is at the Microsoft link below. Does your XP computer meet the other requirements, and have all Windows Updates installed?

Windows Defender Offline System Requirements - Windows Help

 

[Mimicry]

To Brink ~

I owe you a world of thanks for this very informative and helpful post.
On Saturday (March 12, 2016), my mother's computer caught that oh
so joyful case of windows kept rebooting, no log in screen, no safe
mode, etc. I tried ever so many things. I wasn't giving up even last night
when my mother said she was ready for me quit, and she to suffer the
cost of buying a brand new computer. Tired, exhausted, mentally going
crazy with all forms of dos entry command lines going through my head,
I told her no. Then late this afternoon (Tuesday, March 15, 2016), I came
across this page in all my researching. Opps. I had the incorrect belief Windows
Defender could only be run after signing into windows...

I was happily proven wrong.

Using my computer, I did as instructed on a USB. Took about seven hours but,
it worked. My mother's computer is fully operational and more now.

So to you, Brink. Thank you ever so much.

 

[Brink]

You're most welcome Mimicry, and welcome to Seven Forums. I'm glad it could help.

 

[DaveU]

I’ve used Windows Defender Offline on a flash drive for about a year, now suddenly it’s giving me problems. In the past, I’ve executed mssstool64.exe, selected the USB flash drive option, which would then download and update the definitions. Then I would reboot from the flash drive, and Windows Defender would launch and start scanning.

But now after I reboot, Defender takes me to a red screen with “This app requires up-to-date virus and spyware definitions. . .” So consequently I can’t scan. But if I wait about a minute, the updates start to download automatically. I don’t have any onscreen indication, but I can tell that this is happening from the flashing lights on my router and HD. And after a few minutes, the screen changes to green, definitions are up-to-date and I can proceed to scan.

But something is not getting updated on the flash drive, because when I try to run it again, I’m taken back to the red screen “This app requires up-to-date virus and spyware definitions. . .”, and have to wait for the updates to download again.

I’ve reformatted the flash drive, and tried this on a few computers, so I’m confident that something has changed with Defender Offline. Does anyone have any ideas/suggestions?
Thank you.
Dave

 

[Brink]

Hello Dave,

You can run the tool again using step 6 to only update the USB with the latest definitions. The blue note box under step 6 can give you more details about this.

Please let me know if you have any questions.

 

[DaveU]

Hi Brink,

Thanks for your reply.

I am following step 6, and the updates are being downloaded, the mpam-fex64.exe file is getting updated on the flash drive. However, it still reboots to the "red" screen, and I have to wait for the updates to download again, automatically, with no input from me. It's almost like Defender doesn't recognize that the flash drive has been updated.

As I mentioned, I've been using Defender Offline for approx 1 year, so I am familiar with the update procedure (step 6). But something seems to have changed since I last used it about one month ago.

Regards
Dave

 

[SIW2]

If you have 32 bit support in your winpe, you can run the free eset online scanner:
View attachment Eset.zip

 

[Brink]

Dave,

If you haven't already, you might try starting over, and create the WD offline USB again to see if that may help.