Windows Defender Offline scan won't work

Anonymous
2021-03-08T22:48:02+00:00

Hi, I've been having a lot of trouble trying to get Windows Defender to run an offline scan. It restarts the computer and I see the blue screen that says Windows Defender but it never runs the scan and the computer starts up after that. When I checked the Event Viewer it said nothing about Defender finishing the scan and just a lot of events that say that Windows Defender configuration was changed and if this was unexpected that it might be malware. Because of this I reset the laptop and that didn't fix the issue. I ran sfc /scannow plus dism and that didn't fix the issue. I then started running every scan I could using programs like Malwarebytes, rkill, Microsoft malicious software remover tool(I think that's what it's called) and a usb bootable scanner from Kaspersky. None of them found anything that was bad. I read online that if I did a Windows 10 repair upgrade then this fixes the problem most of the time, so that's what I did. After all of this I still can't get Windows Defender offline scan to work. Does anyone know what the issue is?

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

41 answers

Sort by: Newest
  1. Anonymous
    2021-03-09T22:47:43+00:00

    Yes, there are several reports that can be pointed out by the event log, as you can check here:
    https://docs.microsoft.com/en-us/windows/securi...

    Try offline checking to be more comfortable with commands, open the task manager (Ctrl + Shift + Esc)> file> run new task> check Create this task with administrator privileges> type: powershell> open and place the following command:
    Start-MpWDOScan
    run the command and restart the PC.
    I await your reply.

    Thanks for the reply! I did what you said and ran the scan through powershell but it did the same thing it always does. I tried to find logs that have Defender SENSE but could not find SENSE anywhere in the logs? Just Windows Defender. Also I ran sfc /scannow again and it found corrupt files. I've done this in the past and it's fixed them but that never fixed the issue. How can my files be corrupted when I just did a upgrade repair install? It seems like my files keep getting corrupted somehow even with new os installs?

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2021-03-09T22:45:52+00:00

    What is your version & OS Build at "START, Settings,, System, About"...

    Image

    Well, mine does get past that small "Windows Defender Offline" screen & to a larger DOS screen where the offline scan does complete (apparently with virus detected) in about 6 minutes. Pictures of the screens are shown in Option 3 here...

    https://www.tenforums.com/tutorials/42305-how-run-microsoft-defender-offline-scan-windows-10-a.html

    How to Run a Microsoft Defender Offline Scan in Windows 10

    Afterward, I get this in Event Viewer...

    Image

    Event ID 2030 announced the offline scan was configured to run. It did run, but nothing above that 2030 mentions it again. There is no report such as was seen in that DOS screen. But there are four 5007's -- so that appears to be normal.

    And there was a log where Brink said: C:\Windows\Microsoft Antimalware\Support. If you've got one, scroll to the date of your run, & see whether there is an error. I did have one error, but apparently not bad enough to stop it.

    Thanks for the reply! My version is 20H2 and build is 19042.804.

    My scan never gets to the DOS like screen. It ends before it gets to that point and the computer then restarts. I get the event saying the scan started and then four 5007 IDs. The last thing the log says is that the service was stopped (exit code 0x0). There is a spot that says "service stop requested (service error: 0x0)" And a lot of other stuff that I'm not sure about? One thing I've noticed before when checking this log is that the time of the log seems wrong? It says it was created an hour in the future? And in the log it says the current time is 3/10/21 not 3/9/21 which is today when I am writing this. Is that normal? Also in the log titled mssswrapper it says that the offline scan completed with 0x80501002. Is that good or bad?

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments No comments
  3. Anonymous
    2021-03-09T13:01:29+00:00

    Yes, there are several reports that can be pointed out by the event log, as you can check here:

    https://docs.microsoft.com/en-us/windows/securi...

    Try offline checking to be more comfortable with commands, open the task manager (Ctrl + Shift + Esc)> file> run new task> check Create this task with administrator privileges> type: powershell> open and place the following command:

    Start-MpWDOScan

    run the command and restart the PC.

    I await your reply.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments No comments
  4. Anonymous
    2021-03-09T10:01:41+00:00

    What is your version & OS Build at "START, Settings, System, About"...

    Image

    Well, mine does get past that small "Windows Defender Offline" screen & to a larger DOS screen where the offline scan does complete (apparently with no virus detected) in about 6 minutes. Pictures of the screens are shown in Option 3 here...

    https://www.tenforums.com/tutorials/42305-how-run-microsoft-defender-offline-scan-windows-10-a.html

    How to Run a Microsoft Defender Offline Scan in Windows 10

    Afterward, I get this in Event Viewer...

    Image

    Event ID 2030 announced the offline scan was configured to run. It did run, but nothing above that 2030 mentions it again. There is no report such as was seen in that DOS screen. But there are four 5007's -- so that appears to be normal.

    And there was a log where Brink said: C:\Windows\Microsoft Antimalware\Support. If you've got one, scroll to the date of your run, & see whether there is an error. I did have one error, but apparently not bad enough to stop it.

    Was this answer helpful?

    0 comments No comments
  5. Anonymous
    2021-03-08T23:53:36+00:00

    Hi, thanks for the reply, I really appreciate it. I did try creating a new administrator user account and it didn't help. I have also been booting the computer in clean boot all of the time. None of these things has fixed the issue so far unfortunately. Is it normal for event viewer to give so many reports of Defender being configured? I think it's event ID 5007. I just want to make sure that malware is not causing this issue. I've run so many scans and nothing has been found though.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments No comments