Setting Up the Microsoft Standalone System Sweeper Beta, Now Windows Defender Offline

Edit Note: The Microsoft Standalone System Sweeper Beta has been renamed to "Windows Defender Offline".  The instructions below have been edited accordingly.

Windows Defender Offline

Windows Defender Offline is a recovery tool currently available from Microsoft.  The tool is not a general, all-purpose scanner and is not a replacement for an updated antivirus program.  Rather, it is to help start an infected PC and perform an offline scan to identify and remove rootkits and other advanced malware.

Windows Defender Offline can also be used in situations where an antivirus software fails to install or the program that is installed is unable to detect or remove malware from the computer.

The original "Microsoft Standalone System Sweeper" tool had long been a part of the Microsoft Diagnostics and Recovery Toolset (DaRT) for Microsoft Enterprise customers.

~   ~   ~   ~   ~   ~   ~   ~   ~   ~   ~

With USB sticks so readily available, the instructions that follow are for that media.  However, a blank CD or DVD can also be used.

Requirements When Creating Windows Defender Offline Media

When creating the bootable media, it is important to consider the following information and requirements:

• A minimum of at least 250 MB of free space on the selected media (CD, DVD or USB drive) is required.
• If you elect to prepare an ISO for future use, keep in mind that the definitions will not be up-to-date.
• Installing Windows Defender Offline on a USB drive will reformat the USB drive, resulting in the loss of all data stored on the USB drive.  (See Note below*)
• Regardless of the operating system used to create the file, it is essential to select the correct version of the tool, either 32- or 64-bit, for the infected operating system where the tool will be used.
• An Internet connection is required for installation and download of the latest virus and spyware definitions for Windows Defender Offline.
  
• Internet Browser: Windows Internet Explorer 6.0 or higher or Mozilla Firefox 2.0 or higher.

Installing on USB Drive

The download file is located at Microsoft Help and Support.  Again, it does not matter what the operating system is that you use to download and create the bootable media.  However, it is critical to select the correct version for the computer where the tool will be used.

After downloading the file, select the correct version.  If you need assistance determining whether the infected computer is 32- or 64-bit, see the Microsoft Help and Support article for instructions.


Launching the installer, will take you to the "Welcome" screen:

 

Clicking Next is when you select the media where the tool will be created:

The files for the selected version (32- or 64-bit) will download and install on the media:

After the process has been completed, the bootable USB drive is ready for use.

When you click "Computer" to eject the USB drive, note that the name includes the version of the tool that was created.

Updating the Definitions

After starting the infected computer with Windows Defender Offline, do the following to insure that the most recent definitions are installed:

1. Click on the Help drop down arrow menu.
2. Click on Check for updates.
3. Click on Download.

In the event the infected computer does not have an Internet connection, the updates can be manually transported to the infected machine.  The definitions are the same for Windows Defender Offline as used with Microsoft Security Essentials.

1. Download the latest definitions from the Malware Protection Center Portal, selecting the correct version for the infected computer: 
   -- mpam-fe.exe is for the 32-bit version   
   -- mpam-fex64.exe is for the 64-bit version
2. Transport the saved definitions to the infected computer, selecting the Browse button to navigate to the location of the saved definitions.  (See Note below*)

*Note regarding reformatting the USB Drive 

If the following conditions are met, when running the tool again, the USB drive will not be reformatted.  In addition, after creating the tool on your USB, you can copy other tools, "rescue data" as well as the latest definitions. 

1. The files on the USB drive are not damaged or missing (the tool will verify that the files are not damaged).
2. The same USB drive is used.
3. The version of the Windows Defender Offline used to create the bootable USB drive is the same as the version of the tool being re-run or updated.  The tool will detect the already installed product and will only update the definitions without reformatting or altering your data.

System Requirements for Infected Computer

Important Note:  BitLocker must be disabled on the infected computer to use Windows Defender Offline.

• Operating system:  Windows XP Service Pack 3; Windows Vista (RTM, Service Pack 1, or Service Pack 2, or higher); Windows 7 (RTM, Service Pack 1, or higher).
  
• Required processor: 
  Windows XP: 500 MHz or higher1.0 GHz or higher
  Windows Vista and Windows 7: 1.0 GHz or higher
  
• Required memory:
  Windows XP: 768 MB RAM or higher
  Windows Vista and Windows 7: 1 GB RAM or higher
  
• Required video card: 800 × 600 or higher
  
• Available hard disk space: 500 MB 

Download and Additional Information

• Download: Windows Defender Offline
• FAQ's:  Windows Defender Offline: Frequently Asked Questions

Related Articles

• Windows Defender Offline Beta, formerly Standalone System Sweeper
• Solve Microsoft Standalone System Sweeper Errors
• How to Use the New Microsoft Safety Scanner
• Understanding Microsoft Anti-Malware Software 2012

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...