Windows Defender Offline on Windows 7 machines DEFINITIONS OUT OF DATE

Thanks for your interest in this problem.  The last time it occurred it took months to resolve. As stated

earlier, the resolution at that time was a newly released version of the MSSSTOOL 4.9.0221.0 (872kb).

The previous tool was only (840kb).

The problem is not that the definitions are out of date. The problem is that the WDO program that was

just created on the USB using the MSSSTOOL, sees them as out of date. In both cases, this problem has

occurred after activity by Microsoft in resolving Defender problems on Windows 10 machines.

Be aware that there is no connectivity to the internet, by wi-fi or ethernet, while the machine is booted

to the USB on a W7 machine. The "Update Definitions" button will always show a connection error,

because there is no connection.

Someone needs to convince Microsoft to release another update to the MSSSTOOL,    I think.

@GlenProuty

Don't know why you would assume there would be no internet connection except that Windows Defender Offline is really misnamed. Without connection one wouldn't get latest definitions or take advantage of sample submission for analysis during scan. I re-ran same USB drive created a few days ago and WDO updated to more recent than the latest definitions listed at MMPC. (1.245.444.0 vs 1.245.443.0)

I have no idea why the version available for DL is at version 4.9.0221.0. I tend to agree that it probably should be at same version as MSE (4.10.209.0). Doesn't really matter as the antimalware engine and definitions are current..

As I suggested in my reply to you the connection errors mean nothing, same thing happens with MSE (wish MS would fix that).

~bhringer

With respect, Windows Defender Offline, as it applies to Windows 7 is not misnamed.

WDO definitions are updated for a Windows 7 machine that is online, using the MSSSTOOL. The Tool

loads the definitions and the WDO program onto the Media USB. This USB is created to be bootable.

When the machine is booted from this USB, there is no internet connection software included. It is not

needed. It is already updated, and its function is to scan the system offline, without any of the system

program being loaded.

Failure to connect to the internet at this time is a red herring. W10 Defender Offline cannot connect

to the internet either while it is active. Same error code 0x80072EE7. (At least when CEIP is disabled)

We both know that the definitions are in fact up to date when the program says they are not. This is

the real problem! And it occurred in 2016 as well. And was fixed by updating the MSSSTOOL to version

4.9.0221.0.  Do you have any means to find out what change was involved on version 4.9.0221.0 ?

This is a an addendum to my previous post:

The Defender Offline program in Windows 10 uses the same definitions that WDO uses for Windows 7

machines. The latest definitions for both have the same version number. They are provided to W10

directly to the machine, probably through Windows update. The are provided to W7 machines from an

updated Media USB. Created by using the MSSSTOOL, which gets them from the internet.

Consider this: If there was a change made in the configuration or format of the definitions in response

to a major change in W10, say 1703; then those changes would be accommodated by W10 Defender or

it would be updated to do so. However, those same definitions would not be compatible with WDO in

Windows 7 machines unless there was similar change made to WDO. Vis-a-vis the MSSSTOOL. Since it

is what produces the WDO program on the Media USB.

 The only source for relief from this, or any other incompatibility would be the MSSSTOOL.

Sorry to see so little interest in this problem. However, in 2016 this problem was first observed in January,

but was not actively addressed until April.  It was finally resolved June 29 when the new MSSSTOOL was

released. WDO is not something we frequently use, but when you need it, YOU NEED IT !

  Regards, Glen