- To run an offline virus scan using Defender Antivirus on Windows 11, open Windows Security > Virus & threat protection, click “Scan options,” and select “Microsoft Defender Offline” scan.
UPDATED 1/17/2024: Sometimes malware and other malicious software can be very difficult to remove when you are signed in on your computer. However, if you have Windows 10, you can use the Microsoft Defender Offline feature to scan and remove all types of malware, including viruses, rootkits, ransomware, and other malicious software, no matter how tough they are.
The offline virus scan feature has been part of the Defender Antivirus solution for a long time, and it allows the antivirus to run without loading Windows 10 during startup. This is particularly useful because when your device is infected with persistent malware, removing it while Windows is fully loaded is extremely complicated.
In this guide, you will learn how to use the offline virus scan feature to remove rootkits, ransomware, and other nasty viruses on Windows 10. (The offline scan feature is also available on Windows 11.)
Perform Defender Antivirus offline scan on Windows 10
To perform an offline virus scan to remove tough malware with Microsoft Defender, use these steps:
-
Open Windows Security.
-
Click on Virus & threat protection.
-
Click on Scan options under the “Current threats” section.
-
Check the “Microsoft Defender Offline scan” option.
-
Click the Scan now button.
-
Click the Scan button.
After you complete the steps, the computer will boot into the system’s recovery environment, and the Microsoft Defender antivirus will perform a full virus scan. If the anti-malware detects any virus, rootkit, or any other type of malware, it’ll remove it automatically.
After the scan, you can find the Microsoft Defender Offline scan results on Windows Security > Virus & threat protection > Protection history.
Update January 17, 2024: This content has been updated to ensure accuracy and reflect changes in the process.
Mauro Huculak is a Windows expert and the Editor-in-Chief who started Pureinfotech in 2010 as an independent online publication. He is also been a Windows Central contributor for nearly a decade. Mauro has over 12 years of experience writing comprehensive guides and creating professional videos about Windows, software, and related technologies, including Android and Linux. Before becoming a technology writer, he was an IT administrator for seven years. In total, Mauro has over 20 years of combined experience in technology. Throughout his career, he achieved different professional certifications from Microsoft (MSCA), Cisco (CCNP), VMware (VCP), and CompTIA (A+ and Network+), and he has been recognized as a Microsoft MVP for many years. You can follow him on X (Twitter), YouTube, LinkedIn and About.me.