How to do offline virus scan with Microsoft Defender on Windows 10

If your PC gets infected with nasty malware, you can use the Microsoft Defender Offline scan to remove it — here's how to use the tool on Windows 10.

Microsoft Defender Offline
Microsoft Defender Offline

Sometimes malware and other malicious software can be very difficult to remove when you are signed in to your device. However, if you have Windows 10, you can use the Microsoft Defender Offline feature to scan and remove all types of malware, including viruses, rootkit, ransomware, and other malicious software no matter how tough they are.

The offline virus scan feature has been part of the Microsoft Defender Antivirus for a long time, and it allows the antivirus to run without loading Windows 10 during startup. This is particularly useful because when your device is infected with a particular persistent malware, it’s extremely complicated to remove it while Windows is fully loaded.

In this guide, you will learn the steps to use the offline virus scan feature to remove rootkit, ransomware, and other nasty viruses on Windows 10.

Perform Defender offline virus scan on Windows 10

To perform an offline virus scan to remove tough malware with Microsoft Defender, use these steps:

  1. Open Windows Security.

  2. Click on Virus & threat protection.

  3. Under the “Current threats” section, click on Scan options.

    Open scan options

  4. Check the Microsoft Defender Offline scan option.

    Microsoft Defender Offline scan

  5. Click the Scan now button.

  6. Click the Scan button.

After you complete the steps, the device will boot into the system’s recovery environment, and the Microsoft Defender antivirus will perform a full virus scan. If the anti-malware detects any virus, rootkit, or any other type of malware, it’ll remove it automatically.

Microsoft Defender antivirus offline scan
Microsoft Defender antivirus offline scan

After the scan, you can find the Microsoft Defender Offline scan results on Windows Security > Virus & threat protection > Protection history.

About the author

Mauro Huculak is a Windows expert and the Editor-in-Chief who started Pureinfotech in 2010 as an independent online publication. He's also been a Windows Central contributor for nearly a decade. Mauro has over 12 years of experience writing comprehensive guides and creating professional videos about Windows, software, and related technologies, including Android and Linux. Before becoming a technology writer, he was an IT administrator for seven years. In total, Mauro has over 20 years of combined experience in technology. Throughout his career, he achieved different professional certifications from Microsoft (MSCA), Cisco (CCNP), VMware (VCP), and CompTIA (A+ & Network+), and he has been recognized as a Microsoft MVP for many years. You can follow him on X (Twitter), YouTube, and LinkedIn.