Windows Defender Offline is a powerful offline scanning tool that runs from a trusted environment, without starting your operating system. This topic describes using Windows Defender Offline in Windows 10 and Windows 7.
When should I use Windows Defender Offline?
Run Windows Defender Offline if:
- Windows Defender detects rootkits or other highly persistent malware on your PC and alerts you to use Windows Defender Offline. You might see a message saying that malware was found on your device, or a message in Windows Defender that looks like this:
- You suspect your PC has malware that might be hiding on your PC, but your security software doesn’t detect anything. In this case, you can start a Windows Defender Offline scan from Windows Defender Settings. Go to Settings > Update & security > Windows Defender > Select Scan Offline.
Before you use Windows Defender Offline, make sure to save any open files and close apps and programs.
The Windows Defender Offline scan takes about 15 minutes to run, and then your PC will restart.
Where can I find scan results?
To see the Windows Defender Offline scan results:
- Select the Start button, then select Settings > Update & security > Windows Defender.
- On the History tab, select All detected items, then select View details. Any items detected by Windows Defender Offline will be listed as Offline in Detection source.
Using Windows Defender Offline on Windows 7
- Download Windows Defender Offline and create a CD, DVD, or USB flash drive.
- Restart your PC using the Windows Defender Offline media.
- Scan your PC for malicious and other potentially unwanted software.
- Remove any malware that is found from your PC.
We recommend that you download Windows Defender Offline and create the CD, DVD, or USB flash drive on a PC that isn't infected with malware—the malware can interfere with the media creation.
If you're not sure which version to download, see Is my PC running the 32-bit or 64-bit version of Windows?