{"id":3689,"date":"2016-08-04T22:35:20","date_gmt":"2016-08-04T17:05:20","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=3689"},"modified":"2024-04-29T11:42:31","modified_gmt":"2024-04-29T06:12:31","slug":"start-windows-defender-offline-scan","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/start-windows-defender-offline-scan\/","title":{"rendered":"How to Start Microsoft Defender Offline Scan in Windows 10\/11"},"content":{"rendered":"

Malware is more complex today than it was many years ago. It operates at the filter driver, service, or rootkit level, and eliminating it is tough. Sometimes, you need to boot to the Windows RE environment and then delete the core malware files and services added to your Windows installation.<\/p>\n

Microsoft Defender Offline takes care of this situation by running a quick scan even before the Operating System loads. When Defender detects a rootkit or any other tough malware when Windows is running, it suggests you run an offline scan, showing the following message or similar.<\/p>\n

\"microsoft<\/p>\n

Scan offline<\/p>\n

We found malware on your device. Run an offline scan to remove it. Your PC will restart.<\/p><\/div>\n

(or)<\/p>\n

Additional cleaning required.
\nTo complete the cleaning process your PC needs to be rebooted and cleaned with Microsoft Defender Offline. This will take approximately 15 minutes. Please save all your files before clicking on the button.<\/div>\n

How to Start “Microsoft Defender Offline” Scan<\/h2>\n

Microsoft Defender Offline is an integrated feature in Windows 10 and 11. To start Defender Offline scan, use one of the following methods:<\/p>\n

Method 1: Start Microsoft Defender Offline scan using GUI<\/h3>\n

Open Windows Security<\/strong>, click Virus and threat protection<\/strong>, and click “Scan options<\/strong>.”<\/p>\n

\"Microsoft<\/p>\n

Select Microsoft Defender Offline scan<\/strong>, and click Scan now<\/strong>.<\/p>\n

Microsoft Defender Offline downloads a light-weight offline scanner, restarts the system, and runs a scan before loading Windows.<\/p>\n

The light-weight offline scan image is about ~2 MB, comprising the following files:<\/p>\n

EppManifest.dll\nmpasdesc.dll\nMpClient.dll\nMpCmdRun.exe\nMpCommu.dll\nMpSvc.dll\nMpTpmAtt.dll\nMsMpCom.dll\nMsMpEng.exe\nMsMpLics.dll\nMsMpRes.dll\nmsseces.exe\nOfflineScannerShell.exe\nEN-US\\MpSwpHelp.RTF\nEN-US\\MsMpRes.dll.mui\nEN-US\\offlinescannershell.exe.mui\nEN-US\\EppManifest.dll.mui\nEN-US\\EULA.RTF\nEN-US\\mpasdesc.dll.mui<\/code><\/pre>\n
Presumably, OfflineScannerShell.exe powers the scan in Windows RE, including locating the correct Operating System against which the scan has to be run. It’s completely automated and preconfigured to run a Quick scan using the definitions already in the system.<\/p>\n
You’ll be prompted that you’re about to be signed out of Windows. After you are, your PC should restart. Microsoft Defender Offline will load and perform a quick scan of your PC in the recovery environment. There is no option to choose “Full scan” during the Microsoft Defender Offline scan.<\/p>\n
\"microsoft<\/p>\n
When the scan has finished, your PC will automatically restart.<\/p>\n
To see the Microsoft Defender Offline scan results:<\/p>\n