How to Run Windows Defender Offline

Last Updated: June 17, 2020 Tested

Microsoft Defender Offline (formerly Windows Defender Offline) is a specialized tool that detects and removes persistent malware such as rootkits. Microsoft Defender Offline is used in the event that Microsoft Defender or Microsoft Security Essentials detects an anomaly that obstructs the normal scanning of PCs. It is extremely rare that this program needs to be run, but here is how to start it, if you need to.

Method 1

Method 1 of 4:

Windows 10 Creators Update and Later

1
Go to Windows Security or Windows Defender Security Center. This app has a shield on a solid background.
2
Click on Virus & Threat Protection.

Advertisement
3
Click "Advanced scan".
4
Click the radio button for Microsoft Defender Offline, then click Scan now. Your PC will boot off of the Microsoft Defender Offline media in the Windows RE tools.
5
Check the scan results in the window that pops up upon login.

Method 2

Method 2 of 4:

Windows 8 to Windows 10 Anniversary Update

1
Go to Settings > Update and Security > Windows Defender.
2
Click on the "Scan offline" button. Your PC will restart and boot off of the Windows Defender Offline media in the Windows RE tools.
3
Check the scan results in the window that pops up upon login.

Method 3

Method 3 of 4:

Windows 8 to Windows 10 Anniversary Update (Alternative method)

1
Launch Windows Defender.
2
Click on the orange "Download & Run" on the screen that says that your PC needs additional cleaning. Your PC will restart and boot off of the Windows Defender Offline media in the Windows RE tools.
3
Check the scan results in the window that pops up upon login.

Method 4

Method 4 of 4:

Windows 7 and Earlier

1
Download the Windows Defender media creation tool on a PC that does not have the malware (32-bit direct link 64-bit direct link).
2
Insert a blank flash drive formatted to FAT, not exFAT or NTFS. Then follow the prompts on screen to create the Windows Defender media.
3
Turn off the infected computer, and insert the Windows Defender media into the computer.
4
Boot into the BIOS, where you will have to change the boot order.
5
Exit the BIOS, and restart your computer. The Windows Defender media should run off of the USB drive, and should fully scan your computer.
6
When the scan completes, boot back into the BIOS, and change the boot order back to normal. Otherwise, you will be stuck booting to the USB drive.
7
Remove the USB drive. Check the scan results in the window that pops up upon login.

Community Q&A

Question

How do I use this to remove GrandCrab when only safe-mode functions work on my computer?

Aasim

Top Answerer

Go into the UEFI settings and change the boot order (refer to your manufacturer's website for that) so you boot off the USB.
Question

On my laptop, I booted to the BIOS but there was a password! The latest malware is too smart! How can I reset the BIOS password?

R2_d2000

Top Answerer

The wikiHow article How to Reset a BIOS Password should be able to help you.