How to use Windows Defender Offline for malware removal

Some malware can interfere with normal antivirus scans by hiding processes, changing security settings, or loading before Windows fully starts. Windows Defender Offline addresses this problem by restarting the computer and scanning from a trusted recovery environment, before many threats become active.

This built-in Microsoft Defender feature is useful for suspected rootkits, persistent trojans, ransomware components, and other malware that survives a standard scan. It is available through Windows Security on supported Windows 10 and Windows 11 systems and does not require a separate download.

An offline scan is a removal and detection measure, not a complete incident-response process. If important files are encrypted, accounts may be compromised, or the infection continues after cleanup, additional recovery and security steps are necessary.

When an offline scan is useful

A normal Microsoft Defender scan runs while Windows is operating. That is convenient, but an active threat may protect its files, inject code into running processes, or restart itself when detection tools are opened. Scanning outside the regular Windows environment reduces these opportunities.

Consider using Windows Defender Offline when Defender repeatedly detects the same item, suspicious software returns after removal, or the computer displays unexplained boot errors and security warnings. It can also help when a full scan stops unexpectedly or when a suspected bootkit starts before the operating system.

The tool is less useful for every malware situation. It does not decrypt ransomware files, repair all damaged system components, or restore deleted data. A clean result should therefore be treated as evidence from one scan rather than proof that every threat has disappeared.

Prepare the computer before scanning

Save open documents and close applications before starting. The computer will restart automatically, and unsaved work may be lost. Connect a laptop to its charger, keep the device connected to the internet if possible so security intelligence is current, and make sure you know the BitLocker recovery key if drive encryption is enabled.

Disconnect unnecessary external drives, phones, and USB storage. This limits the number of locations that need examination and reduces the chance of malware spreading to removable media. Do not reconnect suspicious drives until they have been scanned separately.

Before removing anything, record unusual filenames, pop-ups, browser redirects, or detection names shown in Windows Security. These details can help determine whether the issue is a potentially unwanted application, a trojan, a ransomware infection, or a false positive.

Start Windows Defender Offline

Open Windows Security from the Start menu, select Virus & threat protection, and choose Scan options. Select Microsoft Defender Antivirus (offline scan), click Scan now, and approve the restart. Windows will boot into a protected environment and begin examining system files, startup locations, and other areas that are difficult to inspect while Windows is running.

The scan can take several minutes or longer depending on the storage device and the number of files. The display may appear basic, and the computer may restart when the process finishes. Avoid forcing a shutdown unless the system has clearly frozen for an extended period, because interrupting the scan can leave an active threat untouched.

If the offline scan option is unavailable, update Windows and Microsoft Defender, check whether security policies or third-party antivirus software have disabled it, and try again. Managed business devices may restrict this feature through administrator settings.

Review results and remove detected threats

After Windows starts normally, open Windows Security, go to Virus & threat protection, and select Protection history. Expand the relevant detection to review its name, severity, affected path, and action taken. A status such as “Removed” or “Quarantined” indicates that Defender acted on the item, while “Allowed” means the file may still be present.

Do not restore a quarantined file unless you have verified that it is safe and understand why it was detected. If the same threat returns, run a Microsoft Defender full scan after updating security intelligence. Then inspect startup applications, browser extensions, scheduled tasks, and recently installed programs for related components.

For a second opinion, a reputable on-demand scanner can be useful. The guide on Malwarebytes and HitmanPro explains how to use those tools together while avoiding unnecessary conflicts between real-time protection modules.

Compare scanning options

Windows Defender offers several scan types, and each serves a different purpose. An offline scan is particularly valuable when malware may be active before login, while a quick scan is better suited to routine checks.

Scan type	Best use	Windows state	Typical scope
Quick scan	Regular monitoring	Running normally	Common malware locations
Full scan	Broad examination	Running normally	Files and programs on connected drives
Custom scan	Checking a selected folder or drive	Running normally	User-defined location
Offline scan	Persistent or pre-boot threats	Restarts into a protected environment	System startup areas and malware-resistant locations

A full scan can identify threats that a quick scan misses, but it may run for a long time. An offline scan is more disruptive because it requires a restart, yet it can inspect components that are difficult for ordinary antivirus processes to control.

Use the scan history to keep track of what Defender found. Repeated detections with different filenames may indicate a broader infection, a malicious scheduled task, or a compromised installer rather than several unrelated files.

What to do after malware removal

Change important passwords from a separate, trusted device if the infection involved a password stealer, remote-access trojan, or suspicious browser activity. Start with email, banking, cloud storage, and administrator accounts, and enable multifactor authentication wherever available.

Install pending Windows and browser updates, remove unknown extensions, and review installed applications. Check that Microsoft Defender real-time protection, tamper protection, and the Windows firewall are enabled. If ransomware is suspected, preserve encrypted copies and ransom notes for analysis instead of deleting evidence immediately. Information about a particular lock-screen threat is available in this Reveton ransomware guide.

Practical steps for safer cleanup

• Back up essential personal files to a disconnected, trusted drive after the system is clean.
• Run a second-opinion scanner when symptoms continue after Microsoft Defender reports removal.
• Review Protection history and keep the detection names and file paths for reference.
• Reset exposed passwords and enable multifactor authentication.
• Avoid cracked software, unsolicited email attachments, and unfamiliar browser downloads.

Windows Defender Offline is a strong built-in response for malware that hides during normal operation, but effective cleanup also depends on reviewing persistence mechanisms and protecting online accounts. Run the offline scan from Windows Security, examine its results carefully, and follow up with updates, account protection, and verified backups.