So your PC is acting weird. Programs crashing, weird pop-ups, your antivirus screaming at you. You’re starting to suspect something nasty has taken up residence on your hard drive. Take a breath. In most cases, you can kick that malware to the curb without losing your files or reinstalling Windows from scratch.
The trick for really stubborn infections is running an offline virus scan. That’s a scan that happens before Windows fully loads, so malware can’t hide or fight back. In this guide, you’ll learn how to do exactly that using the built-in Microsoft Defender Antivirus on Windows 10 and Windows 11, plus when and how to use a third-party rescue disk if Defender needs backup. Let’s get into it.
What Is an Offline Virus Scan (and Why Does It Work Better)?
A regular antivirus scan runs inside Windows, which means any malware that’s already running can potentially dodge it, disable it, or hide from it. An offline virus scan is different. It runs before Windows loads, in a minimal isolated environment where malware has nowhere to hide.
Think of it like trying to clean a room while someone keeps messing it up versus waiting until they leave. Offline scanning is the “wait until they leave” approach, and it’s especially effective against:
- Rootkits, which are malware that buries itself deep in your system to avoid detection
- Bootkits, which are infections that load even before your operating system does
- Stubborn trojans or spyware that keep coming back after normal scans
- Ransomware remnants that survive a standard cleanup
If your regular antivirus keeps finding the same threat over and over, or Windows is behaving so badly you can barely use it, an offline scan is your next move.
Before You Begin
A couple of quick things to do before you start scanning:
- Disconnect from your network. Unplug the Ethernet cable or turn off Wi-Fi. If you’ve got active malware, you don’t want it spreading to other devices or phoning home while you’re trying to clean it up.
- Save your work and close everything. The offline scan requires a restart, anything unsaved will be lost.
- Back up important files if you can. If Windows is still usable, copy your most critical files to an external drive or cloud storage. Just in case.
- Make sure Microsoft Defender is enabled. If you’ve replaced Defender with another antivirus, the built-in offline scan option may not be available. Check that Defender is active in the Windows Security app first.
If you suspect ransomware or a serious data breach, not just run-of-the-mill adware, consider reaching out to a professional before you start deleting things. Some ransomware situations require careful handling to avoid making recovery harder.
Method 1: Run a Microsoft Defender Offline Scan (Windows 10 and Windows 11)
This is the easiest option and the one most people should start with. Microsoft Defender Antivirus is built right into Windows 10 and Windows 11, and it has a one-click offline scan option that handles everything for you. No USB drive or extra downloads needed.
Step 1: Open Windows Security
Click the Start menu, type Windows Security, and open the app. You can also find it by clicking the shield icon in your system tray (the little toolbar area near your clock).
Step 2: Go to Virus & Threat Protection
Inside Windows Security, click the Virus & threat protection tile. It’s usually the first big option on the left.
Step 3: Open Scan Options
Scroll down a little until you see the Current threats section. Under the Quick scan button, click Scan options.
Step 4: Select Microsoft Defender Offline Scan
You’ll see a list of scan types. Quick scan, Full scan, Custom scan, and at the bottom, Microsoft Defender Offline scan. Select that one, then click Scan now.
Step 5: Confirm the Restart
Windows will pop up a warning letting you know your PC is about to restart. Save anything you haven’t saved yet, then click Scan to confirm. If a User Account Control (UAC) prompt appears asking for permission, click Yes.
Step 6: Let the Scan Run
Your PC will restart and boot into a minimal environment. You’ll see Microsoft Defender running its scan before Windows fully loads. This is totally normal. The scan typically takes around 15 minutes, though it can vary depending on how much stuff is on your drive. Don’t interrupt it or power off your PC mid-scan.
If Defender finds anything, it’ll deal with it automatically, quarantining or removing the threat. Once it’s done, your PC will reboot back into Windows normally.
Step 7: Check the Results
After Windows loads back up, open Windows Security again and go to Virus & threat protection > Protection history. This is where you’ll see a log of everything Defender found and what it did about it.
If something was quarantined that you’re pretty sure is a false positive (a legitimate file that got flagged by mistake), you can review and restore it from this screen. That said, if something is flagged as high-severity malware, don’t restore it. Trust the scan on that one.
Method 1 (Advanced): Trigger the Offline Scan via PowerShell
If you’re comfortable with PowerShell, or the Windows Security UI isn’t cooperating, you can kick off the same offline scan from the command line. This is handy if the regular method isn’t working for some reason.
- Click Start, type PowerShell, right-click the result, and select Run as administrator.
- Type the following command and press Enter:
Start-MpWDOScanThat’s it. Windows will schedule the offline scan and restart your PC to run it, exactly like the GUI method above. No extra steps needed.
Method 2: Use a Third-Party Rescue Disk for Tougher Infections
Microsoft Defender is solid, but it’s not always the best tool for the job, especially against newer, more complex malware. Independent testing consistently shows that some third-party antivirus suites catch things Defender misses, particularly in offline scenarios. If you’ve already run a Defender offline scan and you’re still seeing signs of infection, it’s time to bring in reinforcements.
Most major antivirus vendors offer free rescue media, a bootable environment you put on a USB drive that runs a full offline scan completely outside of Windows. Some of the most reputable options in 2026 include:
- Bitdefender Rescue Environment, one of the most highly rated in independent lab tests
- Kaspersky Rescue Disk, long-standing and well-regarded for deep cleaning
- ESET SysRescue Live, lightweight and effective, especially for rootkits
The general process for all of these is the same:
Step 1: Download the Rescue ISO on a Clean PC
Go to your chosen vendor’s website from a PC you know isn’t infected and download their rescue disk ISO file. An ISO file is basically a disk image, a complete snapshot of what should go on the USB drive.
Step 2: Create a Bootable USB Drive
You’ll need a free tool like Rufus to write the ISO to a USB drive. Plug in a USB drive (at least 2 GB), open Rufus, select the ISO file, select your USB drive, and click Start. Fair warning: this will erase everything on the USB drive, so back up anything important on it first.
Step 3: Boot From the USB Drive
Plug the USB drive into the infected PC and restart it. As it boots up, you’ll need to press a key to open the boot menu, usually F12, F8, F1, or DEL, depending on your PC’s manufacturer. From the boot menu, select your USB drive.
Heads up about Secure Boot: Some rescue media may not boot if Secure Boot is enabled in your UEFI settings. If your PC just boots into Windows instead of the rescue disk, you may need to enter your UEFI/BIOS settings (same key as above, usually) and temporarily disable Secure Boot. Just remember to re-enable it after you’re done, as it’s an important security feature.
Step 4: Run the Scan and Handle Threats
Once you’ve booted into the rescue environment, follow the on-screen prompts to start the scan. These tools typically run from a Linux-based environment, which means Windows malware has absolutely no ability to interfere. Let the scan complete, deal with any threats it finds (quarantine or delete as recommended), then restart and remove the USB drive.
A note on BitLocker: If your Windows drive is encrypted with BitLocker, third-party rescue tools may have limited access to your drive. You might need to temporarily suspend BitLocker or provide your recovery key to allow the scan to work properly.
What to Do After the Scan
You’ve run the scan, malware has been removed, and Windows is booting normally again. Nice work! But don’t stop there. A few extra steps will help make sure you’re actually in the clear:
- Run a second-opinion scan. Download and run a free on-demand scanner like Malwarebytes or Emsisoft Emergency Kit after your PC is back in Windows. Two scanners catching nothing is much more reassuring than one.
- Change your passwords. If malware was on your system, assume it may have logged your keystrokes or stolen credentials. Change passwords for your email, banking, social media, and any password manager accounts, ideally from a different device first.
- Check your startup programs and browser extensions. Malware often leaves behind browser extensions or startup entries even after the main infection is cleaned. Open Task Manager and check the Startup tab, and review your browser extensions for anything you don’t recognize.
- Install any pending Windows Updates. Go to Settings > Windows Update and make sure you’re fully up to date. Many malware infections exploit known vulnerabilities that updates patch.
- Enable ransomware protection. In Windows Security, go to Virus & threat protection > Ransomware protection and turn on Controlled folder access. This stops unauthorized apps from modifying your important folders.
- Check that Core isolation is on. In Windows Security, go to Device Security > Core isolation details and make sure Memory integrity is enabled. This is a Windows 11 feature that makes it much harder for malware to tamper with core system processes.
Tips and Troubleshooting
The Offline Scan Option Isn’t Doing Anything
If you select the Microsoft Defender Offline scan and your PC just reboots into Windows normally without scanning, a few things could be going on:
- Defender might be disabled. If you have a third-party antivirus installed, it may have turned off Defender entirely. Check Windows Security to see if Defender is active.
- Try the PowerShell method. Open PowerShell as administrator and run
Start-MpWDOScansometimes this works when the GUI doesn’t.
- Install pending updates first. Go to Settings > Windows Update, install everything, restart, and try again.
- Switch to a rescue disk. If Defender’s offline scan still won’t cooperate, skip to Method 2 and use a third-party rescue disk instead.
The Rescue USB Won’t Boot
If your PC ignores the USB drive and boots straight into Windows:
- Make sure you’re pressing the boot menu key at the right moment. It’s usually right after you see the manufacturer’s logo on startup.
- Try entering UEFI/BIOS settings and manually changing the boot order to prioritize USB.
- If Secure Boot is preventing the rescue disk from loading, temporarily disable it in UEFI settings, run your scan, then re-enable it.
The Scan Found Something, But It Looks Like a Legit File
False positives happen. Even good antivirus tools occasionally flag legitimate software as suspicious. If something was quarantined that you’re confident is safe:
- In Windows Security, go to Virus & threat protection > Protection history, find the quarantined item, and select Restore.
- If you’re not sure whether it’s a false positive, search the file name online or check with the software vendor before restoring anything.
PC Is Still Acting Strange After Cleaning
If things still feel off after a successful scan, with weird slowdowns, unexpected crashes, or strange network activity, don’t just assume you’re in the clear:
- Run a full scan (not just quick scan) with Defender and a second-opinion tool.
- Check for suspicious programs in Settings > Apps and uninstall anything you don’t recognize.
- If instability continues, the nuclear option is backing up your data and doing a clean reinstall of Windows. It’s annoying, but sometimes it’s the only way to be 100% sure.
Do I Even Need Third-Party Antivirus?
Honestly, for most people, Microsoft Defender combined with keeping Windows updated does a pretty solid job day-to-day. Independent lab tests consistently put Defender in the upper tier of protection. That said, some third-party suites do score higher in offline detection tests, so if you want extra peace of mind, especially for offline rescue scenarios, having a tool like Bitdefender or ESET in your back pocket isn’t a bad idea.
When to Just Reinstall Windows
Sometimes the infection is bad enough, or the damage to Windows system files is deep enough, that cleaning is more trouble than it’s worth. If you’ve run multiple offline scans, tried a third-party rescue disk, and your PC is still a mess, it might be time to cut your losses. Back up your personal files to a clean external drive, download a fresh copy of Windows from Microsoft, and start fresh. It’s a pain, but a clean install is the one guaranteed way to know your system is malware-free.
Wrapping Up
Dealing with a malware infection is stressful, but an offline virus scan is one of the most powerful tools you have, and the good news is it’s built right into Windows 10 and Windows 11 with no extra downloads required. Start with the Microsoft Defender Offline scan, and if that doesn’t fully solve it, escalate to a third-party rescue disk from Bitdefender, Kaspersky, or ESET. Once you’re clean, take a few minutes to enable ransomware protection and Memory integrity so you’re better protected going forward.
If you’ve been through the wringer with this and finally got your PC back, persistence paid off, and that’s worth celebrating. And if you’re still not sure your system is fully clean after all of this, don’t hesitate to reach out to a professional. Some infections, especially ransomware, are worth getting expert eyes on.
