Windows Defender Offline

How to Use Windows Defender Offline​

   Information

The former Microsoft Standalone System Sweeper (MSSS) BETA has been rebranded and available as Windows Defender Offline now.

Windows Defender Offline is a free standalone, bootable malware and virus remover from Microsoft that performs an offline scan of an infected PC to remove viruses, rootkits and other advanced malware.

This tutorial will show you how to update and use the Windows Defender Offline Tool to create a 32-bit or 64-bit Windows Defender Offline bootable CD/DVD, USB flash drive, or ISO file on any computer to help you start an infected 32-bit or 64-bit PC and perform an offline scan at boot to help identify and remove rootkits and other malicious malware. In addition, Windows Defender Offline can be used if you cannot install or start an antivirus program on your computer, or if the installed AV program can’t detect or remove malware on your computer.

The log files for Windows Defender Offline are stored in a MPLog-MM/DD/YYYY-HH/MM/SS .txt file in the folder below on the computer that was scanned at boot.
C:\Windows\Windows Defender Offline\Support
For Windows Defender Offline FAQ's, see: Windows Defender Offline: frequently asked questions

   Note

Minimum System Requirements:

For both the PC infected with a virus or malware, and the PC that you are creating the bootable media on, you'll need PCs with the following minimum requirements.

• Operating system:
  • Windows XP (Service Pack 3)
  • Windows Vista (RTM, Service Pack 1, or Service Pack 2, or higher)
  • Windows 7 (RTM, Service Pack 1, or higher)
  • Windows 8
• Processor:
  • Windows XP: 500 MHz or higher
  • Windows Vista, Windows 7, and Windows 8: 1.0 GHz or higher
• Memory:
  • Windows XP: 768 MB RAM or higher
  • Windows Vista, Windows 7, and Windows 8: 1 GB RAM or higher
• Video resolution: 800 × 600 or higher
• Available hard disk space: 500 MB

For the PC infected by a virus or malware:

• The PC must have the same Windows operating system (OS) architecture 32-bit or 64-bit as Windows Defender Offline. Bootable media created on any version of Windows can be run on any other version of Windows. The only thing that needs to match is the architecture of Windows Defender Offline and the OS of the infected machine.
• Internet connection: Only required to update the latest malware definitions for a Windows Defender Offline bootable USB flash drive.
• In addition, BitLocker must be disabled to use Windows Defender Offline Beta.

For the PC on which you create the bootable media:

• Administrator account: A user account with administrator privileges to create the bootable media.
• Internet connection: An Internet connection to install and download the latest virus and spyware definitions for Windows Defender Offline.
• Internet browser: Windows Internet Explorer 7.0 or higher, or Mozilla Firefox 3.0 or higher.
• Media: A CD, DVD, or USB flash drive with at least 250 MB of free space.

   Tip

If you get a Error Code 0x8004cc04, Error Code 0x8004cc05, or Error Code 0x8050800c while using Windows Defender Offline, then please see the same suggested solutions here for MSSS.

If you have UEFI, then Windows Defender Offline is now able to boot with Secure Boot ENABLED.

   Warning

For obvious reasons, the "Windows Defender Offline" bootable CD/DVD, USB flash drive, or ISO should be created on a different computer other than the one that you suspect may be infected with malware.

STEP ONE

To Create a "Windows Defender Offline" Bootable CD/DVD, USB Flash Drive, or ISO File

1. If you have not already, you will need to download the same 32-bit or 64-bit version of Windows Defender Offline Tool at the download link below for the same 32-bit or 64-bit Windows that is installed on the computer that you will be scanning at boot, and save the exe file to your desktop.

Download


2. Run the downloaded mssstool64.exe (64-bit) or mssstool32.exe (32-bit) file, and click on Next. (see screenshot below)

3. Click on the I accept button. (see screenshot below)
NOTE: You will only be prompted for this the first time that you run the Windows Defender Offline Tool.

4. Do step 5, 6, or 7 below for what type of bootable "Windows Defender Offline" CD/DVD, USB, or ISO that you would like to create to scan with. (see screenshot below)

5. To Create a"Windows Defender Offline" Bootable CD or DVD
A) Insert a blank unformatted CD or DVD into the CD/DVD drive.
NOTE: If a AutoPlay window opens afterwards, close it.

B) Select (dot) Use a blank CD or a DVD, and click on Next. (see screenshot below step 4)

C) If you have more than one DC/DVD drive, then select the CD/DVD drive with the blank CD/DVD in it, and click on Next. (see screenshot below)

D) When it's finished, click on Finish. (see screenshot below)
NOTE: Be sure to label the CD/DVD as being able to only be used on a 32-bit or 64-bit Windows computer at boot.

E) Go to step 8.
6. To Create a "Windows Defender Offline" Bootable USB Flash Drive

   Note

If you run the Windows Defender Offline Tool again on the same USB flash drive, and if the following conditions below are met, the tool will only download new updated malware definitions (approx. 69.48 MB) and update the USB drive without reformatting it.

• The USB flash drive has Windows Defender Offline previously installed on it.
• The Windows Defender Offline Tool version that was used to create the bootable USB flash drive the first run is the same as the one being used for the second run.
• Files on the USB flash drive are not damaged or missing (the tool will verify that).

A) Connect a USB flash drive that is not password protected to your computer.
WARNING: This USB drive will be formated during this process, so be sure to backup anything that you do not want to lose to another location first.

B) Select (dot) On a USB flash drive that is not password protected, and click on Next. (see screenshot below step 4)

C) If you have more than one USB drives connected, then select the one that you want to use, and click on Next. (see screenshot below)

D) When it's finished, click on Finish. (see screenshot below)

E) Go to step 8.
7. To Create a "Windows Defender Offline" Bootable ISO File
A) Select (dot) Create Standalone System Sweeper on an ISO File, and click on Next. (see screenshot below step 4)

B) Select (browse) where you would like to save the ISO file to, and click on Next. (see screenshots below)




C) When it's finished, click on Finish. (see screenshot below)

D) You can now use the ISO file to boot with in a virtual machine (ex: Windows Virtual PC), or use the free Windows 7 USB/DVD Download Tool to burn the ISO to a DVD or USB flash drive.

E) Continue on to step 8.
8. You will now be able to boot from the 32-bit or 64-bit CD/DVD, USB, or ISO that you created to run Windows Defender Offline on the same 32-bit or 64-bit computer as in the STEP TWO section below when you like.

STEP TWO

To Scan a Computer with the Bootable CD/DVD or USB Flash Drive

1. Insert or connect the same 32-bit or 64-bit Windows Defender Offline bootable CD/DVD or USB flash drive to the same type of 32-bit or 64-bit Windows computer that you want to scan at boot.
NOTE: For example, you can only use a created 32-bit USB on a 32-bit computer at boot, and you can only use a created 64-bit USB on a 64-bit computer at boot.

2. In your BIOS/UEFI Boot Menu (ex: F11) of the computer that you want to scan, select to temporarily boot from the CD/DVD or USB flash drive created in the STEP ONE section above, and boot from it.

   Note

Please consult your computer's or motherboard's manual for exact details on how to do this.

You do not need to change the boot priority order in the BIOS/UEFI settings for this. Use the Boot Menu instead to select to only temporarily boot from the DVD/USB instead.

3. This is what you will see while it's booting from the CD/DVD or USB flash drive.




4. When Windows Defender Offline has booted, you will be able to update the definitions and select what type of scan you would like to run on the computer. A Full Scan is recommended, and could take several hours to complete.
NOTE: You will only be able to update the definitions at boot if you are using a bootable USB flash drive with a internet connection, and not with a bootable CD/DVD.




5. When finished, close Windows Defender Offline to restart the computer back into Windows.
That's it,
Shawn

Related Tutorials

---

• How to Download and Use the Microsoft Windows Malicious Software Removal Tool
• Scan for Malware using Malwarebytes Anti-Malware Free
• Add an Explorer context menu 'Send to VirusTotal'
• Enhanced Mitigation Experience Toolkit (EMET)
• How to Install and Use Microsoft Security Essentials
• How to Use the Microsoft Safety Scanner
• How to Scan Suspicious Files using Online Scanners

 

[SIW2]

I think it may be beta because it is the first time it is on it's own, using it's own dedicated shell. Also the exe that creates it is new.

 

[SIW2]

Theo,

I assume you can use the create iso option.

Then use another burner - imgburn , or whatever - may be easier.

I expect MS will add this as another option in system recovery.

 

[theog]

Theo,

I assume you can use the create iso option.

Only with
Description of the Image Mastering API v2.0 (IMAPIv2.0) update package that is dated June 26, 2007
installed.

 

[karlsnooks]

karlsnooks, thanks for taking the time testing out our new Microsoft Standalone System Sweeper Beta!

As for the update scenario - the rational was that if you opt to run the tool again on a recently created USB you are interested in updating it. Hence, the definitions are downloaded regardless of the date they were created. Do you think that given that rational the behavior should be different?

Yes

As for the manual update you performed - why did you do that?

Need current definitions.

I mean, when you boot from a USB drive created by the tool (without modifying it), when the Standalone System Sweeper start in the offline environment, the definitions should be updated. Did you have a different experience?

Yes.

Regarding the directions you unsuccessfully followed - what directions exactly were you trying to follow? and what exactly were you trying to do?

Help | update |
Suggest you try following your directions on a single standalone laptop with only wireless internet connectivity.


Thanks,
Guy Arad.

In addition, I think that after a product has been out in the enterprise environment for more that a year, a part of MSDart, then it is time to drop the word BETA.

Heck, Win 7 is a BETA by those criteria. (Now I know that there are many who will agree on that one.)

Why am I so hard? Because I'm in the pits. I help the poor souls who sometimes have trouble finding the on/off button. For a product to be usable by an IT person is one thing. To be usable by Joe OrdinaryUser is a different matter.

 

[Corrine]

Personally, I am rather confused as to why the Standalone System Sweeper is still labeled Beta since the tool has long been a part of the Microsoft Diagnostics and Recovery Toolset (DaRT) for Microsoft Enterprise customers.

Well that's interesting.

Not much on the MSSSTool in TechNet: Overview of Microsoft Diagnostics and Recovery Toolset.

 

[Tepid]

Personally, I am rather confused as to why the Standalone System Sweeper is still labeled Beta since the tool has long been a part of the Microsoft Diagnostics and Recovery Toolset (DaRT) for Microsoft Enterprise customers.

Well that's interesting.

Not much on the MSSSTool in TechNet: Overview of Microsoft Diagnostics and Recovery Toolset.

I ahve not used it yet, so making assumtions,,, I assume this is not like a regular PE where you can add drivers and such, or manipulate it in anyway.

If MSSS is available in DaRT, then a corporation would use that as they may have license to use it through Microsoft Desktop Optimization Pack (MDOP). That is what I would use in that environment.

MSSS appears will be available to all, like WAIK is. Assuming it will be anyway.

However, I am also wondering, is the MSSS build a universal build?
If so, how does it have the multitude of drivers needed to boot from USB on any PC and have network access? Unless it attempts to use the drivers on the system, which I suppose it could attempt to detect, but if they are corrupt, then it would corrupt the boot process, so it's not a good idea.

Otherwise, no network connectivity, no updates once booted.
Will it still run if it can not update once booted?

it's a bit confusing.

 

[SIW2]

Hi Tepid,

Yes, the d/l is an exe which creates an iso . It contains pe and the system sweeper.

Here's a file list View attachment MSS.zip

Same drivers that are in winre.wim. Wired connection support by default wpeinit.

You build your own pe - so you can just stick system sweeper into your own build.

 

[brianzion]

@brink
excellent tutorial brink very handy to have.this is a must for everyone's toolbox

 

[richc46]

TY Shawn. A fine tutorial that I can use for myself as well as helping others.

 

[Dave76]

Hi Dave,

Pretty sure it will be fine to boot mms iso from your menu, just like any other .iso

Tried MSSS ISO version on my Multi tool boot USB drive, it opened to the choose the drive to scan screen, then gave the 0X8004cc04 - definitions error.

Installed the USB version, it formatted the USB but got the same error message.
Neither of these methods gave the opening screen in the Step Two #4 in this tutorial.

Checked the USB drive and it's not usable for Readyboost, which might mean it's not acceptable for a bootable device also.
The second boot of both versions gave a device not recognize error. Unplug/plug-in did recognize it.

Will try on a different USB drive.

 

[karlsnooks]

Dave,
On the USB that doesn't work, try:
run Diskpart from an elevated command prompt
issue following commands:
List disk which will list the disks detected
Select Disk 2 ( or whatever number is the number of your USB stick)
Detail Disk (to verify that you got the correct disk)
CLEAN ALL ( this will write zeros to each and every byte of the usb stick)
Format FS=ntfs ( this will format the usb stick)
EXIT ( to exit from DiskPart)
Exit ( to exit from the command shell)

Now if that usb stick doesn't work it is defective.

 

[Dave76]

Forgot to mention this was on two different USB drives.

The ISO MSSS on my multi tool drive with Pendrivelinux for boot files/GUI, all the other ISO apps run fine, just not the ISO MSSS.

Will run Diskpart on the other MSSS USB drive and see if that helps, thanks.

Strange that the two versions on two different drives have the exact same error, might be due to slow memory on both USB drives.

USB drives are Transcend 4GB and SanDisk Cruzer Blade 4GB, both are fairly new.

 

[Dave76]

Downloaded the latest Microsoft Security Essentials virus definition files and placed them on the root of the USB memory stick with the multi tool grub.
It worked and is running now.

MSE Get the latest definitions, D/L the MSE 32bit or 64bit definitions.

This will make updating the definitions very easy.

Tried the same with the USB installed version, deleted the old mpam-fex64.exe file from the root of the USB memory stick and copied the new one there, still doesn't work.

Will try Diskpart on it.

 

[cottonball]

Great information!!

Is there an option to create and save a report of what the MSSS finds?

Thanks for your help.

 

[Brink]

Hello Carnardblanc, and welcome to Seven Forums.

Yes.

http://www.sevenforums.com/tutorials/166445-microsoft-standalone-system-sweeper-7.html#post1481923

 

[cottonball]

Thanks, Brink!

Also, thank you for the great tutorial at the start fo this thread. It is valuable help.


In this thread (Post 4):
http://www.sevenforums.com/system-security/169370-going-earth-malware.html

The poster said:

...got some screens about resolving boot problems... i follwed the instructions given by that thing. it allowed me to do a system restore...

Is there a thread where we can see the screens mentioned about resolving boot problems...?

Thanks again for your help.

 

[Brink]

I have not seen any so far.

 

[karlsnooks]

Shawn,
Although I ran it once for familiarization, I don't remember, but do you recall if the Microsoft System Scanner generates a log?

I know that the System Scanner is for those lucky people with an on-line connection and where a stand-alone solution isn't required.

thanks,
karl

 

[Brink]

Hello Karl,

It produces an event report if the scan finds anything, and is displayed in the results. It also has a History option in the toolbar that might show history of last scan results. However, I have not seen a log file yet, but I have not had anything to be found either.

 

[Corrine]

I believe any logs would be available in %systemdrive%\standalone system sweeper\support.