
Sometimes malware and other malicious software can be very difficult to remove when you are signed in to your device. However, if you have Windows 10, you can use the Microsoft Defender Offline feature to scan and remove all types of malware, including viruses, rootkit, ransomware, and other malicious software no matter how tough they are.
The offline virus scan feature has been part of the Microsoft Defender Antivirus for a long time, and it allows the antivirus to run without loading Windows 10 during startup. This is particularly useful because when your device is infected with a particular persistent malware, it’s extremely complicated to remove it while Windows is fully loaded.
In this guide, you will learn the steps to use the offline virus scan feature to remove rootkit, ransomware, and other nasty viruses on Windows 10.
Perform Defender offline virus scan on Windows 10
To perform an offline virus scan to remove tough malware with Microsoft Defender, use these steps:
-
Open Windows Security.
-
Click on Virus & threat protection.
-
Under the “Current threats” section, click on Scan options.
-
Check the Microsoft Defender Offline scan option.
-
Click the Scan now button.
-
Click the Scan button.
After you complete the steps, the device will boot into the system’s recovery environment, and the Microsoft Defender antivirus will perform a full virus scan. If the anti-malware detects any virus, rootkit, or any other type of malware, it’ll remove it automatically.

After the scan, you can find the Microsoft Defender Offline scan results on Windows Security > Virus & threat protection > Protection history.