How to use Microsoft Defender Antivirus Offline scan to remove tough viruses on Windows 10

Microsoft Defender Offline Scan on Windows 10
Microsoft Defender Offline Scan on Windows 10 (Image credit: Windows Central)

Windows 10 comes with the Microsoft Defender Antivirus security feature to protect your computer and data from virtually any type of malware and hackers. Although this is one of the best antivirus software, it's not perfect, and sometimes, specially crafted malicious code can find its way into the system and rapidly take control and cause irreversible damage.

This is not specific to Microsoft Defender. This can occur with any third-party antivirus you install on your computer. However, if your computer gets infected with a nasty hard-to-move malware when Windows 10 is loaded, you can use the Microsoft Defender Offline scan option. The offline option is an automated feature capable of running when the system isn't running, which allows the anti-malware engine to detect and remove most viruses more easily.

In this Windows 10 guide, we will walk you through the steps to perform an offline malware scan using the Windows Defender Antivirus tool.

How to use Defender Antivirus Offline scan on Windows 10

To scan and remove viruses with the Microsoft Defender Antivirus Offline scan feature, use these steps:

  1. Open Windows Security.
  2. Click on Virus & threat protection.
  3. Under the "Current threats" section, click the Scan options setting.

Source: Windows Central (Image credit: Source: Windows Central)
  1. Select the Microsoft Defender Offline scan option.

Source: Windows Central (Image credit: Source: Windows Central)
  1. Click the Scan now button.
  2. Click the Scan button.

Once you complete the steps, Windows 11 will restart into the Windows Recovery Environment (WinRE), where the command-line version of Microsoft Defender Antivirus will run automatically without loading the system. The scan will detect and delete any hard-to-remove viruses it may find without user interaction. The offline scan will take around 10 minutes, then the computer will restart automatically.

Review scan results

To review the scan information, use these steps:

  1. Open Windows Security.
  2. Click on Virus & threat protection.
  3. Under the "Current threats" section, click the Protection history setting.

Source: Windows Central (Image credit: Source: Windows Central)
  1. Confirm the scan actions and recommendations (if available).

Source: Windows Central (Image credit: Source: Windows Central)

If you don't see any information in the history, then the antivirus couldn't find anything on the computer.

It's also important to pay attention to the items' dates because the list includes all the recent actions, and sometimes, you may see things from previous scans or real-time detections.

More Windows resources

For more helpful articles, coverage, and answers to common questions about Windows 10 and Windows 11, visit the following resources:

Mauro Huculak

Mauro Huculak is technical writer for His primary focus is to write comprehensive how-tos to help users get the most out of Windows 10 and its many related technologies. He has an IT background with professional certifications from Microsoft, Cisco, and CompTIA, and he's a recognized member of the Microsoft MVP community.

  • With Windows defender there is simple no need for another virus protector. And I'm #1 again.
  • MS tests have proves that it is improving a lot. But it's really bad to avoid general malware. I know cause half my family manages to get their pcs infected and I don't allow them to use anything else than Defender to avoid pc slowdowns and firewall issues so that they won't be bugging me.
  • Look up HOSTS file in bing.  Follow instructions.  Helps immensely with bad sites, not to mention ads.
  • I use Windows Defender, Windows Firewall, and SmartScreen. It works very well! Then, I use Malwarebytes Anti-Malware Premium as an added layer of security. In order to keep your family from getting infected, however, you need to create an Administrator account and lock their personal accounts down so they can't install software without the Administrator's password. I did this for my friend's kids. They try to get around it, but they don't have the password, so they can't install cracked games and software. And I haven't had to fix their computers since. If they need you to install something for them, you can always use TeamViewer or something similar.This configuration has made my life a lot easier as they family/friend IT guy.
  • If this tip didn't work out for you this might help you out. :) they provide excellent services. tested. xD
  • I cannot understand why people buy or use other antivirus.I have windows defender and I think is the best antivirus because it's free and official and it didn't slow my pc as others.
  • What I can't understand is why do you expect people to behave like you?many people have different and riskier activities online than you and for that they need a tougher protection than you, simple as that, even if not the case don't ever expect people to do as you want them to do,just be happy with Defender live your life.
  • Some other antivirus suites offer many more tools (with paid version) that help keep you safe, and have a better track record with detection and false-positives. What I cannot understand is why people think they're the center if the universe and everyone must have exactly the same needs as them.
  • I'm not in the center of the universe because I'm god I created it.And I command u to change your antivirus because demons will kill you.
  • Omg I don't understand why people are so angry when you say something different.I never say or blame anyone.I use my PC and my notebook for search or playing games.If anyone else is out there and use his PC like this I said I don't understand why they want to pay for antivirus when they can use the Windows defender for free.For anyone who blame me or use inappropriate words just F*** You,
  • Oh no..."official" is being used here, too? Well, I keep a ton of "unofficial" malware bits around, just in case. Malwarebytes is also free, if that's your main concern.
  • it is better to have second line of defence..
  • Absolutely no need of so called no.1 anti-virus programs. I've been using this since the day 1 of MS Security Essentials and Windows Live for PC. Never caught myself with virus problems... My friends took my advice to let Defender work it's way aaand it's a gold :)
  • Well, good for you,come take your cookie.
    Me: I don't give a f*ck what work on your computer, who do you think you are to tell me what programs I have to download on my own computer?
    Like I said do what you do and be happy if it's work you , let others people think for themselves,they absolutely don't have to behave like you online , download or install programs you like or you want, we have the freedom to download or install any programs we want on our own PC, that's exactly what is amazing on Windows, having a tons of programs to choose.
  • All I'm saying is,
    1. Msft has a huge responsibility to protect its consumers from potential threats that come popping in its OS. So far an amazing job in SECURITY.
    2. Those programs were never needed for me. I'm telling my opinion and that's called Free Speech. You sound like you're a marketing guy.
    3. My Friends came to me asking for help. When I saw an antivirus program that couldn't do its job, I suggested him Defender.
    I've never asked you to CHANGE anything, that's a bold word.
    Bite me.
  • Haha, sorry I suppose I was frustrated by these people who go like "I do this why everyone don't do like me?".
    I'm definitively agree Defender is good for many people who have a standard online activities but for others, it's definitively not enough, hell I even have Malwarebytes pro on my computer, I see some who even have two AV, plus Malwarebytes Pro, plus Anti-exploit, they are a tech-savy people.
    Again sorry, my answer was harsh because I really can't stand people who try to impose their views on others(not you but some people on this comment section)
  • Where in his post is he telling you what to do? He is just saying defender works for him and therefore he tells his friends to use it as well. Obviously you are not his friend. So, he hasn't told you to do a god damn thing.
  • you must be working for one of those antivirus software companies, I guess it's getting difficult.
  • Lol, Ahaha,yeah right
  • You need to calm down. What's wrong with you? He shares his opinion very mildly, and you attack him like he's trying to take away your freedom. Chillll
  • That's why I said I'm sorry, I was upset by another not him and I lashed out.
  • I've been using Defender exclusively for years. It's improved and it's easier to manage over the years. We use all sorts of protection ay work but IT doesn't manage policies well so on home machine I stick with Defender. Knock in wood, but I have yet to fix something that it missed. Thanks for the tip, offline may come in handy one day!
  • Defender is crap. You get what you pay for.
  • Norton is crap. Sometimes you pay to much for inferior products. Paying more doesn't automatically make something better.
  • I am using Norton antivirus on my Win 10 PC and I disagree. Have used tons of AVs and it's amongst the top. But depends on your online use and choice of course.
  • I agree with your statement, but recently I just found some malware that it cannot detect
  • I find panda antivirus to be the best and they do have a free version as well. Check AV comparatives and you'll see that it's constantly near the top along with Trend Micro and a few others. Defender is a good start at best. Adding Norton DNS servers to your router is another good thing to do as a layered security approach.
  • I don't believe that. Windows defender slowed down my computer lot many times than I can count. Not that it's a heavy program, but the disk usage spikes at of times and stays like that. Been using bitdefender since, you wont believe how light and non intrusive it is
  • Just a tip... For those that need that bit extra protection than the Defender, as someone that has been avoiding antiviruses like a boss and used Defender and Microsoft Essentials, I just figured out you can get keys for the best antivirus programs for about 8-10$ from digital key vendors. A pack of smokes and a coffee costs as much or more so I guess it is worth it. Personally I avoid them for the shake of performance. Now I got an antivirus and already hate how my boot times on my laptop increased yet it's almost intact on my Surface Pro. I guess I am going for an SSD for my laptop!
  • A bit off topic, but they should really update the user interface in Windows Defender. It looks a bit outdated...
  • It sure needs an UI update to match the new design language. And better insights on what is happening.
  • Great article! Fortunately windows has become much more secure, and hopefully we won't have to use this information.
  • I lol'd when I read "tough viruses" & " windows defender" in the same sentence. More & more the motivations become clear...
  • Ummm. Ok
  • Good reply!
  • To bad it cant be updated like Kasperskys rescue drive. So much potential for winpe & they dont offer this option
  • A simple ad blocker is a solution to tons of virus spread by pop ups which many times change your default webpage and many things. Ads are the main source of viruses.
  • Exactly. I think Ad Block Plus combined with Windows Defender is a match made in heaven! Posted with the Nexus 6, Nexus 5, or Surface Pro 3
  • Ads were never happened to be this tough to get rid of before Windows 8...
  • There are other viruses too that could be target via things like any input device maybe dvd or pen drive. But still today internet is the main source of virus. Fake apps, fart apps etc and on a browser its ads by google, pop ups etc.
  • Anyone use AVG Free?
  • Stopped years ago when it became AVG Nag & Bloatware
  • Yeah, I used to it but stopped for the same reasons -- it started nagging me and slowd by system down. I only run windows defener, an ad blocker in my browser, and then I run the free version of MalwareBytes every couple of weeks.  I have never had a problem since I stopped running AVG.
  • Yes. Used it for some years now on multiple machines. Seems to work fine. I don't do a lot of side by side testing, but I don't notice any performance slowdowns. I use it monthly and double check a few times a year by running Malware Bytes in case AVG missed anything.
  • Last version I was running was 12(because it was the last to cater to power users) till they ended support for it in dec. Moved to kav when their 18month sub. was on sale during boxing week. Much better for windows vista/7
  • For ever. Well, until I bought a Windows 8 device and used Defender. Got a call from the bank - someone got my bank details. Put AVG back on - should have seen all the crap that Defender missed. Cost me dearly. Got money back what was taken 30 days until then, but lost the rest. Defender can rot in hell.
  • how much memory space required to do that ? for just an bootable stand-alone antivirus ?
  • Minimum of 250MB of space in the USB flash drive. Thanks,
  • What's the benefit of using this versus the built-in Windows Defender in Windows 10? ​Either way, Windows Defender is quite good now. I also have the Bitdefender Free Edition 2014 because it's efficient, subtle, and out-of-my-face. And it still gets updated regularly with the latest definitions.  
  • Active malware can often detect when an antimalware program is running and employ methods to hide from it. When scanning offline, i.e. without booting into Windows, the malware does not launch and thus cannot do this.
  • Exactly basically this is like an avg. AV rescue disk/drive but unfortunately you have to keep reimaging it to keep it up-to-date(unlike Kasperskys usb solution)
  • In all my years of using PC, I have never once encountered any sort of virus or malware. [Achievement Unlocked] \m/
  • Plot twist: your PC is riddled with viruses, but you just don't know about them ;)
  • Tru. I just checked it with my rat.
  • Lol
  • Spyware
  • Same here. Almost 4 years. No virus on my PC. Because now I know very well about viruses. It's true that people don't believe. Because they don't have much knowledge ;)
  • I don't need antivirus at all and have ran Ashby for at least 3-5yrs now. If you're a sage and informed user, you will rarely if ever get a virus.
  • How does Defender compare to AVG Free?
  • If anything, it is less intrusive. Defender rarely needs to be opened as it runs everything in the background on an OS level. I used to use AVG free and that thing was just irritating. That was years ago though so maybe something has changed... Posted with the Nexus 6, Nexus 5, or Surface Pro 3
  • Exactly
  • Nah. It's even worse now.
  • Until recently it compared quite badly to other free antivirus but recent independent testing have shown a marked improvement and it beat AVG free as well as a few paid AV's (the crap ones like Mcaffee anyway).
  • Its sucked since 13 due to the lack of understanding who their market is. Having to use ccleaner to clear out old files is a real pain
  • Most of the free anti virus programs are more or less same in detecting malwares... I've used several big named AV software but Windows Defender/MSE was the best when it came to using system resources... For extra protection I use MBAM free...
  • Windows Defender one of the worst Security Tools out there just check AV-Test results
  • Not as true as it was a few months ago my friend.
  • Sure on w8.x & above it's a full suite like mse/1 care or Forefront
  • Recent test results show good improvement. So, IMO it's better to stay with Defender than any other free antivirus.
    Paid ones are different league altogether.
  • My Asus router with McAfee blocks most bad sites before they even get to my PCs. It's worth a look...
  • Asus dropped support for it like sony did
  • I have Windows Defender and self defense. When you visit web, don't believe any popup. If it seems bank/eBay/credit card send you warning email, don't click. Open the web browser yourself and visit the web site. It'll mention what stated in the email. Watchout anyone else removable drive or zipped file but mostly windows defender will take care of that. You must update windows defender often.
  • My windows defender is turned off and has no option to turn on.... Help?
  • I had that once. Try running Malwarebytes.
  • I didn't knew about it. Thanks Windows Central for it. I already knew that Windows Defender is the best antivirus for Windows as it is created by the creator of Windows which is Microsoft.
  • " Windows 10, you'll need to go to Settings > Update & recovery > Recovery under Advanced startup, click Restart now" Or just hold the SHIFT key while clicking Restart.
  • I am sorry but virus just dont "worm" into a system, people have to download it and run it for it to happen. yeah it still sucks regardless of how it got there but it doesn't mean an antivirus can save someone if they turn off their AV, or just don't care to get one. or run any file that they download even if it's an obvious "getyourprize.exe". Anyway I usually deactive antivirus because they are a waste of resources most of the time, if you are not downloading a file, a virus shouldn't just "worm" in a computer. something like Virustotal or jotti can make the job, manually but without hitting people's performace, it's not like AV packages slow computers too much, but sometimes they do, on certain things. but it's stupid when people from other OSs say you must use an antivirus on windows like if that made their OSs safer or Windows immune to virus. The best way to avoid virus is by not clicking on every .exe around. and if people let their virus get in a computer, I am sure windows defender offline wouldn't really be useful if next time they will do the same and infect it once again.
  • Virus also spread through transfers from hardware to hardware... It could be undetectable, it's not like the virus always come with a tag. Programs that cleans the virus are mostly hassle free and simple, Defender is the one i know best that runs without affecting your system performance. In my point of view, turning off your antivirus could be unwise.
    Macs get minimal or no virus attacks because of its poor developer and programmer base. This is one of the reasons.
  • I am waiting for full update on my Lumia 640 xl
  • Windows defender help best when turned off xD
    Seriously, even a Chinese no name anti virus programm works better and more trustfully then windows defender
  • Well, good for you.
  • Windows defender is a lot better an article about a year which reported a marked improvement in Defender...
  • At present, I am using Bitdefender 2016 total security on all my PCs and I love the startup optimizer that allows me to delay startup of certain apps. However, for most people, I recommend Defender + Malwarebytes + Adblock and Disconnect plugins, along with NoScript. This combo is free and works like a charm.
  • NoScript is a pain for the average Joe. The startup optimizer is well... No different than msconfig or the task manager in windows 10 :p.
  • Defender eh?
    That's always one the things I turn off after getting rid of McAfee lol. But I'll give it this offline tool a shot, no harm, no foul. Prefer something like Eset nod32 when looking at paid solutions. Freeware? Something like avast, bit defender. However anybody who is worth the salt in IT Imo will always have hijackthis, hitman pro (cloud scanner), bitdefender rootkit tools, mbam etc in their recovery usb toolkit.
  • Being cheeky here. Isn't Ubuntu FREE and doesn't need an AntiVirus?
  • Only because of very small market share, like Mac and Windows Phone. Linux has had a few exploits exposed in the last 12 months as well as Android. Since an Android is a type of robot, isn't saying Android botnet sort of redundant?
  • I know. That is why I being silly. No OS is virus free. Just use the internet wisely.
  • There's no comparison b/w an Android and a Linux. Why do scientific researchers use Linux while Windows is being used globally on pc? Android is a total mess when it comes to the security. As good as the OS can become for the user as much as the security will be risked. It's not about market share.
  • Been using Defender or it's prequel for years on multiple pc with just one virus that made it through. In addition, all users run as standard users with a separate admin account and have the mvps hosts file installed. That one virus was easy to eradicate since it didn't escape the user profile. Verified with offline tools. Got sick and tired of expensive bloated AV products that hurt day to day performance more than wiping my computer and starting over every month.
  • Wow! Another feather.... I think this could be a way around for those who don't want to purchase end point securities....
  • Windows Defender is useless. Malwarebytes Anti-Malware finds more, its not even a anti virus program.
  • Hi I have a question. My windows insider is not work to update my phone
  • I watch alot of porn on my computer and i use MacAfee its getting ready to expire should I use windows defender?
  • my pc is affected by wajam it stops my defender and i was unable to install antivirus and it is automatically downloads many useless software and installing it but the defender is better than antivurus softwares thanks for posting this method to remove the malware  
  • Defender is good for basic frontline AV and it runs along the OS making it fast unfortunately it dose miss son more hardened viruses which is a shame. Security side of it I would say buy a professional AV.. Not AVG and AV like that so far Kaspersky been the most strongest AV that I use on a personal level but I am a business user so barracuda would be my First choice but all depends really on you decide for your self.
  • I've seen Kaspersky fail on several occasions. My previous work place use nothing but that on all machines even then malwarebytes picked up several virus that it missed. Several of the machines were exhibiting odd behaviour. They ran several Kaspersky scans nothing, so I suggested they download mbam and check with that just incase, lo and behold several Trojans hiding in the temp folders.
  • Spybot is pretty good too at picking up a lot of stuff like that...though it does sound like malwarebytes is quite popular...
  • I have the normal defender that comes with the PC. Is this one different from that one????? Posted via the Windows Central App for Android
  • This is more of a clean-up tool that you use when your PC has become infected beyond a normal automatic scan and removal scenario.
  • Well done Mauro.
  • Does anyone know how I can format and reinstall windows10? I dont have a cd tray in my laptop and win10 came as an upgrade. I think i have collected way too much malware. Plz and thank you.
  • You can download iso file, create a bootable pendrive and than format and re-install.
  • This is brilliant--there have been way too many times when something like this would have helped tremendously. I just hope the definitions are able to catch the malware, but it's great that Microsoft has made this super easy to use. Any extra (free) tool from a trusted source is a welcomed addition to the malware fight arsenal.
  • Stick with Apps and Edge browser. You're better protected that way.
  • Too bad the stand alone tool doesn't work. That or maybe my machine has too many drives (4). After booting from the USB stick, it says that it can't find the system drive or the drive is corrupt. Guess I'll cancel that order for some more USB sticks.
  • HI  Would this help in removing browser hijacker? I guess "can't connect to proxy server thing" is due to a browser hijacker right? Would this windows defender offline tool help to fix this problem?  
  • What do I do after I boot into BIOS and what does it mean by "change the boot order"? Plz Help Fast
  • awesome post. but does WDO only works on pc/tab/lap having windows 10?