How to use Windows Defender Scan Offline Tool

[Wolfie]

Hi all,

for a normal offline scan, open Windows Defender Security app > Virus & threat protection > Advanced scan > Scan now (tick the box first).
Your computer will restart and scan your system, please make sure you have updated Windows Defender to the latest virus definitions:

Save your work before you continue!:

See also (If you want more info about windows defender direct from MS):

https://docs.microsoft.com/en-us/wi...urity-center/windows-defender-security-center

And (Plenty of vids on YouTube!):

There are a couple of other free "Offline Scan Tools". (You do not need the pay version so please read each page carefully before you download and commit yourself to spending money!).

Avast:

https://blog.avast.com/2015/08/10/how-to-scan-and-remove-viruses-when-your-computer-is-offline/

Main site: https://www.avast.com/en-gb/index

Avira:

Covered here: https://www.windows10forums.com/threads/avira-security-rescue-system-live-cd-anti-virus-app.14109/

Main site: https://www.avira.com/

Kaspersky:

https://support.kaspersky.com/4162

Main site: https://www.kaspersky.com/?_ga=2.268048135.827360109.1516777451-371344618.1516777451

Bitdefender:

https://www.bitdefender.com/support/how-to-create-a-bitdefender-rescue-cd-627.html

Main site (Freeware):

https://www.bitdefender.com/free-virus-removal/

If all else fails, you can follow the advice listed here and keep your data intact:

https://www.windows10forums.com/threads/re-install-w10-and-keep-your-files-app-data-intact.15825/
​

I hope it helps.

 

[Grizzly]

Nice article. Appreciate it.

 

[Wolfie]

Nice article. Appreciate it.

Hi Grizzly,

I am waiting for MicroScrap to phone me as it isn't doing what it is supposed to!. I will let them know what I have found thus far and hopefully they will fix it!. LOL

 

[davehc]

Hi Grizzly,

I am waiting for MicroScrap to phone me as it isn't doing what it is supposed to!. I will let them know what I have found thus far and hopefully they will fix it!. LOL

Could be because it was designed to run in Windows 7?

 

[Wolfie]

Hi Dave,

I missed something, I thought it was for both but you are right and the tool is only for W7, I have re-written the topic to reflect the fact. Thanks!.

It wasn't quite clear to me at least, poor format on their part (I have to blame someone!).

 

[davehc]

I can give you some tips! I am very good at blaming someone when the wife moans.

 

[Wolfie]

Have a look see if it makes more sense now please Dave, if it doesn't, I will blame you LOL!.

Hi @Ian ,

I will work on improving the info for W10 but want to leave the info for W7 too as it is a very useful tool for W7 (I think W8 too?).

 

[davehc]

Sorry for the late reply. - Bedtime!
Unfortunately, I would not see the purpose of having this on Windows 10. As I said, it was for window 7, but, even there , had its limitations.

Since Windows 10, however, an offline scan can be quite simply run from within the built in program.

 

[Wolfie]

Morning Dave,

I know in the meantime that the offline scanner tool is indeed for W7 thanks to your sharp eyes!. That said, I think it could still be useful to dual-booters at least. If @Ian wants me to remove it, I don't have a problem with that, otherwise it looks okay to me.

 

[davehc]

Ok. he's the boss, so it is between Ian and you. Possibly enough has been said in this thread, for readers to decide for themselves.
A more up to date link is here, but says little more
https://support.microsoft.com/en-us/help/17466/windows-defender-offline-help-protect-my-pc

 

[Regedit32]

Windows 10 since the Anniversary update 1607 has pretty much eliminated the need for an bootable disk for off line scanning. Nevertheless, it would do no harm creating one as a extra backup.

For what it's worth the Windows 10 Defender Offline Scan uses downloads and uses the following files:

EppManifest.dll
mpasdesc.dll
MpClient.dll
MpCmdRun.exe
MpCommu.dll
MpSvc.dll
MpTpmAtt.dll
MsMpCom.dll
MsMpEng.exe
MsMpLics.dll
MsMpRes.dll
msseces.exe
OfflineScannerShell.exe
EN-US\MpSwpHelp.RTF
EN-US\MsMpRes.dll.mui
EN-US\offlinescannershell.exe.mui
EN-US\EppManifest.dll.mui
EN-US\EULA.RTF
EN-US\mpasdesc.dll.mui

Perhaps you can create your own bootable disk using Linux as the shell and the above files of course.

 

[davehc]

Thinking deeper. If a user wants to make a portable anti virus boot, perhaps consideration should be given to using a third party program, as a double check.
If one is determined to use Defender, though, Then, I would suggest again, I see no purpose in it, when it can be run from within windows itself?
In fact, why would you need to run it offline anyway. I could understand MS trying to promote their newly bought anti virus for Windows xp/7, but no longer as it is now integrated.

 

[Regedit32]

The offline scan is just another tool in the Arsenal for the scenario when one gets a pig of a bug which may not be able to be fully removed while the computer is running or has internet access.

I agree that build-in offline should be sufficient given you can run it from the Command Console using WMIC or from PowerShell, or if you are still at the Desktop then from the built-in GUI of Windows Defender Security Center.

In the event one is, in actual fact infected with the type of Virus that requires an offline scan, Windows Defender will display a message on screen informing you as such. Most virus/trojans the average user is exposed to though would be basic advertising scripts that open other instances of your browser and may from time to time end up on scam type trojans that attempt to make you believe you are in need of support that requires $$$. Defender is more than capable of detecting these and removing them without the need for an offline scan.

I'm satisfied Defender and the monthly Malicious Removal tool Microsoft offers can handle most virus, but agree with davehc on the point that if if gets this far one needs offline scanning, they would be wise to have other third party options available, for which their are many excellent free tools, as well as ones you can pay for.

At the end of the day, I'd recommend a full backup of your files first before creating bootable antivirus disks.

 

[davehc]

Nuf said.
I falling in support of Ian.
This thread is only going to confuse. Perhaps the whole thing should just be removed
Only my pov, but wouldn't root kits, the lowest boot up level available, be found anyway with a scan -off or online? Defender claims it can do this-

 

[Wolfie]

I recently had a collection of viruses and I used Avira Anti Virus scanning tool (Offline CD); it found 11 Trojans and said it renamed them (I selected that option), it didn't work, Windows Defender couldn't be accessed either off or online at the time!.

 

[davehc]

I suggest there is a built in danger for using any off line scanners for virus.
If it does clean, as well as report, anything it may find, there is , imho, always the possibility that, due to a deliberate name change from a virus, after the scan a computer may not boot at all.
Regedit's earlier advice, which I wholeheartedly support. - Make sure you have a reliable backup/Image, before you go to that length.

 

[Ian]

I think it may be worth editing out the W7 part, as I think it may confuse things for anyone not paying full attention to the first post. It's your article, so you can do as you wish, but I don't see much use in having the W7 related info on a W10 site, given that it won't run on W10.

 

[davehc]

I have to agree. I fear a consequent deluge of members being unable to reboot!--Lol

 

[garybear]

Hi Here's my 2 cents. I'm new to your forum. I think that is a excellent article about WD off line.
Here's my thoughts. If your PC has become so infected that Windows Defender off Line doesn't clean it, you might think about performing a clean install. Here's a great article from MS Community.
https://answers.microsoft.com/en-us...infected/25c94d39-718b-4b9b-8a5f-38c99ff07c81

 

[davehc]

Hi Gary.

I think your post is just a little off target for this thread. More appropriate in the windows 10 support section - just my view. you could, if still able, copy and paste and delete this one if so inclined?