Windows Defender Offline

How to Use Windows Defender Offline​

   Information

The former Microsoft Standalone System Sweeper (MSSS) BETA has been rebranded and available as Windows Defender Offline now.

Windows Defender Offline is a free standalone, bootable malware and virus remover from Microsoft that performs an offline scan of an infected PC to remove viruses, rootkits and other advanced malware.

This tutorial will show you how to update and use the Windows Defender Offline Tool to create a 32-bit or 64-bit Windows Defender Offline bootable CD/DVD, USB flash drive, or ISO file on any computer to help you start an infected 32-bit or 64-bit PC and perform an offline scan at boot to help identify and remove rootkits and other malicious malware. In addition, Windows Defender Offline can be used if you cannot install or start an antivirus program on your computer, or if the installed AV program can’t detect or remove malware on your computer.

The log files for Windows Defender Offline are stored in a MPLog-MM/DD/YYYY-HH/MM/SS .txt file in the folder below on the computer that was scanned at boot.
C:\Windows\Windows Defender Offline\Support
For Windows Defender Offline FAQ's, see: Windows Defender Offline: frequently asked questions

   Note

Minimum System Requirements:

For both the PC infected with a virus or malware, and the PC that you are creating the bootable media on, you'll need PCs with the following minimum requirements.

• Operating system:
  • Windows XP (Service Pack 3)
  • Windows Vista (RTM, Service Pack 1, or Service Pack 2, or higher)
  • Windows 7 (RTM, Service Pack 1, or higher)
  • Windows 8
• Processor:
  • Windows XP: 500 MHz or higher
  • Windows Vista, Windows 7, and Windows 8: 1.0 GHz or higher
• Memory:
  • Windows XP: 768 MB RAM or higher
  • Windows Vista, Windows 7, and Windows 8: 1 GB RAM or higher
• Video resolution: 800 × 600 or higher
• Available hard disk space: 500 MB

For the PC infected by a virus or malware:

• The PC must have the same Windows operating system (OS) architecture 32-bit or 64-bit as Windows Defender Offline. Bootable media created on any version of Windows can be run on any other version of Windows. The only thing that needs to match is the architecture of Windows Defender Offline and the OS of the infected machine.
• Internet connection: Only required to update the latest malware definitions for a Windows Defender Offline bootable USB flash drive.
• In addition, BitLocker must be disabled to use Windows Defender Offline Beta.

For the PC on which you create the bootable media:

• Administrator account: A user account with administrator privileges to create the bootable media.
• Internet connection: An Internet connection to install and download the latest virus and spyware definitions for Windows Defender Offline.
• Internet browser: Windows Internet Explorer 7.0 or higher, or Mozilla Firefox 3.0 or higher.
• Media: A CD, DVD, or USB flash drive with at least 250 MB of free space.

   Tip

If you get a Error Code 0x8004cc04, Error Code 0x8004cc05, or Error Code 0x8050800c while using Windows Defender Offline, then please see the same suggested solutions here for MSSS.

If you have UEFI, then Windows Defender Offline is now able to boot with Secure Boot ENABLED.

   Warning

For obvious reasons, the "Windows Defender Offline" bootable CD/DVD, USB flash drive, or ISO should be created on a different computer other than the one that you suspect may be infected with malware.

STEP ONE

To Create a "Windows Defender Offline" Bootable CD/DVD, USB Flash Drive, or ISO File

1. If you have not already, you will need to download the same 32-bit or 64-bit version of Windows Defender Offline Tool at the download link below for the same 32-bit or 64-bit Windows that is installed on the computer that you will be scanning at boot, and save the exe file to your desktop.

Download


2. Run the downloaded mssstool64.exe (64-bit) or mssstool32.exe (32-bit) file, and click on Next. (see screenshot below)

3. Click on the I accept button. (see screenshot below)
NOTE: You will only be prompted for this the first time that you run the Windows Defender Offline Tool.

4. Do step 5, 6, or 7 below for what type of bootable "Windows Defender Offline" CD/DVD, USB, or ISO that you would like to create to scan with. (see screenshot below)

5. To Create a"Windows Defender Offline" Bootable CD or DVD
A) Insert a blank unformatted CD or DVD into the CD/DVD drive.
NOTE: If a AutoPlay window opens afterwards, close it.

B) Select (dot) Use a blank CD or a DVD, and click on Next. (see screenshot below step 4)

C) If you have more than one DC/DVD drive, then select the CD/DVD drive with the blank CD/DVD in it, and click on Next. (see screenshot below)

D) When it's finished, click on Finish. (see screenshot below)
NOTE: Be sure to label the CD/DVD as being able to only be used on a 32-bit or 64-bit Windows computer at boot.

E) Go to step 8.
6. To Create a "Windows Defender Offline" Bootable USB Flash Drive

   Note

If you run the Windows Defender Offline Tool again on the same USB flash drive, and if the following conditions below are met, the tool will only download new updated malware definitions (approx. 69.48 MB) and update the USB drive without reformatting it.

• The USB flash drive has Windows Defender Offline previously installed on it.
• The Windows Defender Offline Tool version that was used to create the bootable USB flash drive the first run is the same as the one being used for the second run.
• Files on the USB flash drive are not damaged or missing (the tool will verify that).

A) Connect a USB flash drive that is not password protected to your computer.
WARNING: This USB drive will be formated during this process, so be sure to backup anything that you do not want to lose to another location first.

B) Select (dot) On a USB flash drive that is not password protected, and click on Next. (see screenshot below step 4)

C) If you have more than one USB drives connected, then select the one that you want to use, and click on Next. (see screenshot below)

D) When it's finished, click on Finish. (see screenshot below)

E) Go to step 8.
7. To Create a "Windows Defender Offline" Bootable ISO File
A) Select (dot) Create Standalone System Sweeper on an ISO File, and click on Next. (see screenshot below step 4)

B) Select (browse) where you would like to save the ISO file to, and click on Next. (see screenshots below)




C) When it's finished, click on Finish. (see screenshot below)

D) You can now use the ISO file to boot with in a virtual machine (ex: Windows Virtual PC), or use the free Windows 7 USB/DVD Download Tool to burn the ISO to a DVD or USB flash drive.

E) Continue on to step 8.
8. You will now be able to boot from the 32-bit or 64-bit CD/DVD, USB, or ISO that you created to run Windows Defender Offline on the same 32-bit or 64-bit computer as in the STEP TWO section below when you like.

STEP TWO

To Scan a Computer with the Bootable CD/DVD or USB Flash Drive

1. Insert or connect the same 32-bit or 64-bit Windows Defender Offline bootable CD/DVD or USB flash drive to the same type of 32-bit or 64-bit Windows computer that you want to scan at boot.
NOTE: For example, you can only use a created 32-bit USB on a 32-bit computer at boot, and you can only use a created 64-bit USB on a 64-bit computer at boot.

2. In your BIOS/UEFI Boot Menu (ex: F11) of the computer that you want to scan, select to temporarily boot from the CD/DVD or USB flash drive created in the STEP ONE section above, and boot from it.

   Note

Please consult your computer's or motherboard's manual for exact details on how to do this.

You do not need to change the boot priority order in the BIOS/UEFI settings for this. Use the Boot Menu instead to select to only temporarily boot from the DVD/USB instead.

3. This is what you will see while it's booting from the CD/DVD or USB flash drive.




4. When Windows Defender Offline has booted, you will be able to update the definitions and select what type of scan you would like to run on the computer. A Full Scan is recommended, and could take several hours to complete.
NOTE: You will only be able to update the definitions at boot if you are using a bootable USB flash drive with a internet connection, and not with a bootable CD/DVD.




5. When finished, close Windows Defender Offline to restart the computer back into Windows.
That's it,
Shawn

Related Tutorials

---

• How to Download and Use the Microsoft Windows Malicious Software Removal Tool
• Scan for Malware using Malwarebytes Anti-Malware Free
• Add an Explorer context menu 'Send to VirusTotal'
• Enhanced Mitigation Experience Toolkit (EMET)
• How to Install and Use Microsoft Security Essentials
• How to Use the Microsoft Safety Scanner
• How to Scan Suspicious Files using Online Scanners

 

[SIW2]

I need to look at it again when I get a moment.

It appeared to only run if you could update it.

What if you can't connect to the net - i assume only wired connections are supported.

You have to d/l definitions onto removable media on another machine - then browse to those.

Could it update itself as you are making it ? I ran it straight after creating it - still it wanted to update .

 

[mjf]

Running with the most current definition files is obviously desirable. Can't you see the criticism now "I ran this tool and it missed a known virus....".

Maybe MS can consider, moving beyond Beta, a run option without update displaying in highlighted text
"Warning you are running this tool without update Virus checking..." or something similar.

This would be the way to go even for the self booting configuration MS envisage.

 

[karlsnooks]

Shawn,

Before I get to far into this:

Using Firefox, I wrote a lengthy reply and then got rejected with this error msg:
The message you have entered is too short. Please lengthen your message to at least 3 characters

If anyone knows what is happening here, let me know. Am using IE to send this.

Now to the heart of the matter.

Here are my experiences with System Sweeper:
1. downloaded and ran 32 bit version with install to USB.
2. There were four steps of which step one was a download of about 200 mb.
3. after completion of four steps:
ran the install program again (without shutdown or restart)
4. This time three steps and a 60 mb "update" download.
5. After completion, once again ran the install program and once again a 60 mb download.
6. No matter how many times I ran the install program, it insisted upon a 60 mb download.

Finally, shutdown and booted from usb.

Help |update | manual | browse to mpam-fe.exe | OK button

Finally, Sweeper says I'm up-to-date and , true, the version had been updated to the latest and greatest.

Run time experience:
I have many .wim, .iso, .vhd files on disk. Consequently, full scan was just under 4 hours. A later quick scan took just under 3 minutes.

I do feel that update procedure could be improved.

I did not have any success trying to follow directions for the "download" update.

This is a true standalone laptop with only wireless connectivity and all at a coffee house.

 

[steve6375]

MSSweeper as ISO on grub4dos USB stick

I tried this by placing both ISOs (32 & 64) on a USB stick with grub4dos.
It boots to WinPE fine, but then gives a Sweeper cannot be started error 0x8004cc04 error - guess it is looking for files on a CD/USB flat file structure? (I see MS still haven't quite got the hang of helpful error messages after 20 years!). Investigation shows it needs to see the FilesListxx.dll and the mpam-fe.exe files in the root of the drive before it will run successfully.

Also, it would be better if we could just have the option to refresh just the new definitions and dll - at the moment if you make a multi-boot iso USB pen to run either 32 or 64 versions, you can have the dll and mpam-fe.exe on the USB stick and the installer will not format the stick - but if you have no boot files/folders on the stick that the installer can see, it will integrity check after the update and force you to format the stick - at this point an option for 'No - just update the definitions on USB drive' would be very useful.
That would mean we could update a multi-boot stick using the installer utility without destroying the whole USB drive contents!

 

[gmorphus]

Shawn,

Before I get to far into this:

Using Firefox, I wrote a lengthy reply and then got rejected with this error msg:
The message you have entered is too short. Please lengthen your message to at least 3 characters

If anyone knows what is happening here, let me know. Am using IE to send this.

Now to the heart of the matter.

Here are my experiences with System Sweeper:
1. downloaded and ran 32 bit version with install to USB.
2. There were four steps of which step one was a download of about 200 mb.
3. after completion of four steps:
ran the install program again (without shutdown or restart)
4. This time three steps and a 60 mb "update" download.
5. After completion, once again ran the install program and once again a 60 mb download.
6. No matter how many times I ran the install program, it insisted upon a 60 mb download.

Finally, shutdown and booted from usb.

Help |update | manual | browse to mpam-fe.exe | OK button

Finally, Sweeper says I'm up-to-date and , true, the version had been updated to the latest and greatest.

Run time experience:
I have many .wim, .iso, .vhd files on disk. Consequently, full scan was just under 4 hours. A later quick scan took just under 3 minutes.

I do feel that update procedure could be improved.

I did not have any success trying to follow directions for the "download" update.

This is a true standalone laptop with only wireless connectivity and all at a coffee house.

karlsnooks, thanks for taking the time testing out our new Microsoft Standalone System Sweeper Beta!

As for the update scenario - the rational was that if you opt to run the tool again on a recently created USB you are interested in updating it. Hence, the definitions are downloaded regardless of the date they were created. Do you think that given that rational the behavior should be different?
As for the manual update you performed - why did you do that?
I mean, when you boot from a USB drive created by the tool (without modifying it), when the Standalone System Sweeper start in the offline environment, the definitions should be updated. Did you have a different experience?

Regarding the directions you unsuccessfully followed - what directions exactly were you trying to follow? and what exactly were you trying to do?

Thanks,
Guy Arad.

 

[gmorphus]

I tried this by placing both ISOs (32 & 64) on a USB stick with grub4dos.
It boots to WinPE fine, but then gives a Sweeper cannot be started error 0x8004cc04 error - guess it is looking for files on a CD/USB flat file structure? (I see MS still haven't quite got the hang of helpful error messages after 20 years!). Investigation shows it needs to see the FilesListxx.dll and the mpam-fe.exe files in the root of the drive before it will run successfully.

Also, it would be better if we could just have the option to refresh just the new definitions and dll - at the moment if you make a multi-boot iso USB pen to run either 32 or 64 versions, you can have the dll and mpam-fe.exe on the USB stick and the installer will not format the stick - but if you have no boot files/folders on the stick that the installer can see, it will integrity check after the update and force you to format the stick - at this point an option for 'No - just update the definitions on USB drive' would be very useful.
That would mean we could update a multi-boot stick using the installer utility without destroying the whole USB drive contents!

Hi Steve,
I'd like to begin my answer with stating that this is a beta product.
The error you got was about missing definitions.
Seems like you were trying an unsupported scenario, so there's nothing much I could help you with, except for suggesting that you run a "normal" USB drive creation.

As for your suggestion, there is an option to only refresh defintions supported by the tool. If you run the tool and select the USB drive option, your USB drive will be reformatted and a Standalone System Sweeper will be installed on the USB drive which will be converted to a bootable USB drive.
If you run the tool again, selecting USB drive creation and select the same USB drive, it will not be reformatted and new definitions will be copied onto the drive.
This will happen given you are using the same USB drive, same version of the tool that was used to create the bootable USB drive and files on the USB drive are not damaged or missing (the tool verifies their integrity).

Please note that your USB drive will not be reformatted without specifically issuing a message saying so, so you don't have to worry running the tool against any USB drive (expecting only for an update). Make sure to read the information displayed on the screens.

Please note that this is not an official support forum for the Microsoft Standalone System Sweeper tool. Solutions to issues with Microsoft products can be found here.
The information I provided in this post is relevant for version 1.0.856.0 of the tool.
I just happen to pass through this forum and providing assistance out of good will.
I'd like to thank you all for trying out Microsoft's beta release of this tool - it's greatly appreciated.
This tool's official beta page can be found at Microsoft's Connect site.

Thanks,
Guy Arad.

 

[steve6375]

Hi Morphus
Thanks for the reply. The update does work as you say, but it also checks ALL files (including /bootmgr presence) and if missing offers to reformat or cancel. This means you cannot refresh a multi-boot USB pen drive (which many people use) and thus carry both the 32 and 64 bit ISOs on a USB stick and refresh it before use. The only way it will refresh is to have ALL the files present. A small change to the GUI would make this a much more useful tool.
cheers
Steve

PS The beta page has no feedback/forum??
The Microsoft Solutions page does not know about Sweeper (as it is beta) - so where should we give feedback to?

 

[mjf]

Hi Morphus
Thanks for the reply. The update does work as you say, but it also checks ALL files (including /bootmgr presence) and if missing offers to reformat or cancel. This means you cannot refresh a multi-boot USB pen drive (which many people use) and thus carry both the 32 and 64 bit ISOs on a USB stick and refresh it before use. The only way it will refresh is to have ALL the files present. A small change to the GUI would make this a much more useful tool.
cheers
Steve

PS The beta page has no feedback/forum??
The Microsoft Solutions page does not know about Sweeper (as it is beta) - so where should we give feedback to?

What do you mean by "ALL files". I have bootmgr and [Boot] on my grub4dos usb because I boot the Windows Repair disk iso.

It's looking easier to stick with 3rd party tools - yet again.

 

[danawr]

Error Code 0x8004cc01

Hello,

I downloaded the 32bit version today, Friday, June 3, 2011 from a 64bit computer. I ran MSSStool32.exe with the option to burn to a cd. The cd creation was successful.

When I boot my 32bit computer with the System Sweeper cd I get the error code 0x8004cc01.

My search using Bing for System Sweeper or the error code only led me to this forum or MS' System Sweeper page.

I understand that this is not an official MS forum. I could not find a MS support forum for the System Sweeper tool.

I would love to get this new tool to work.

Any assistance would be appreciated.

Thank you,

Dana

 

[SIW2]

Hi Morphus,

My question ( later expanded by Karl ) was:

If the updates are included while creating the iso - why does it then insist on updating again - and downloading the entire 60mb again - when you boot it 5 mins later?

Is there a way it could check to see if it was already up to date?

 

[theog]

Hi Shawn
I was playing with my Win XP test earlier, give it a try out, works OK, but must install KB932716 first.
Description of the Image Mastering API v2.0 (IMAPIv2.0) update package that is dated June 26, 2007

 

[Shadowjk]

Wonderful little tool but is it just as Bad as Windows Defender?

Still gonna keep it in the big piles of Bootable Disks etc of mine

Josh

 

[Brink]

Hi Shawn
I was playing with my Win XP test earlier, give it a try out, works OK, but must install KB932716 first.
Description of the Image Mastering API v2.0 (IMAPIv2.0) update package that is dated June 26, 2007

Hello Ray,

I'm assuming that XP was fully updated with all service packs and Windows Updates. Did you have to install this before the Standalone System Sweeper Tool would run in XP, or before Standalone System Sweeper would run at boot?

 

[StalkeR]

Great tutorial Brink. Thanks!

 

[SIW2]

I will have to double check - but it seems happy to scan all your partitions - not just the same bit version ones - if you avoid using the supplied shell.

 

[Corrine]

As for the update scenario - the rational was that if you opt to run the tool again on a recently created USB you are interested in updating it. Hence, the definitions are downloaded regardless of the date they were created. Do you think that given that rational the behavior should be different?
As for the manual update you performed - why did you do that?

Guy Arad.

Hi, Guy.

Regarding your question to Karl regarding the update rational, at the rate the definitions are updated (3 or 4 times/day), even if the USB was created the same day, they could easily be out of date. For an infected machine, having the most recent Defs, would be ideal.

Personally, I am rather confused as to why the Standalone System Sweeper is still labeled Beta since the tool has long been a part of the Microsoft Diagnostics and Recovery Toolset (DaRT) for Microsoft Enterprise customers.

​

 

[Airbot]

Personally, I am rather confused as to why the Standalone System Sweeper is still labeled Beta since the tool has long been a part of the Microsoft Diagnostics and Recovery Toolset (DaRT) for Microsoft Enterprise customers.

Well that's interesting.

 

[theog]

Hi Shawn
I was playing with my Win XP test earlier, give it a try out, works OK, but must install KB932716 first.
Description of the Image Mastering API v2.0 (IMAPIv2.0) update package that is dated June 26, 2007

Hello Ray,

I'm assuming that XP was fully updated with all service packs and Windows Updates. Did you have to install this before the Standalone System Sweeper Tool would run in XP, or before Standalone System Sweeper would run at boot?

Hi Shawn
winXP Pro sp3 & all updates + MDOP with add-on software. (KB932716 not need to make MSDaRT)

Standalone System Sweeper Tool, Part one, error after step 3 & 5.



USB drive not tested.

 

[Brink]

At least it makes it easy to fix by telling you what you need to do other than just give an error code.

 

[theog]

At least it makes it easy to fix by telling you what you need to do other than just give an error code.

True,
may be I will get new error when burning a MSDaRT,
Please uninstall KB932716