Windows 10: After performing an Offline Scan with Windows Defender, it detects malware pointing...

Uzar Hamad · Feb 22, 2025

Detected: Trojan:Win64/Malgent!MSR Status: Quarantine failed This threat or app might not be completely remediated. Date: 21/02/2025 2:53 pm Details: This program is dangerous and executes commands from an attacker. Affected items: file: C:\Users\User\AppData\Local\Updates\WindowsService.exe file: C:\WlNDOWS\System32\Tasks\Windows Service Task-y UTF-16LE taskscheduler: C:\WlNDOWS\System32\Tasks\Windows Service TaskI'm thinking to delete these files, but I might break something if I do so. What's the best thing to do with this? not really sure what caused these files to be considered as secur

:)

Cliff S · Feb 22, 2025

Windows Defender Offline Scan in Windows 10

Also MpSwpHelp:

Using Windows Defender Offline
Malicious and other potentially unwanted software, including rootkits, attempt to install themselves on your computer when you connect to the Internet or install some programs from a CD, DVD, or other media. Once on your computer, this software might run immediately, or it might run at unexpected times.
Windows Defender Offline can help remove hard to find malicious and potentially unwanted programs using definitions to recognize threats. Definitions are files that provide an encyclopedia of potential software threats. Because new threats appear daily, it is important to always have the most up-to-date definitions installed in Windows Defender Offline. Armed with definition files, Windows Defender Offline can detect malicious and potentially unwanted software, and then alert you to the risks.

Windows 10
On Windows 10, Windows Defender Offline is completely automated. This means Windows Defender when it identifies advanced malware will recommend that Windows Defender Offline be run and on the next reboot Windows Defender Offline will automatically scan/remediate the malware and reboot into Windows 10. This removes the need for the user to interact with the Windows Defender Offline product manually, as such the below sections are no longer applicable to Windows 10.

Windows 8.1, Windows 8, Windows 7 and Windows Vista
The following sections apply only to the above mentioned OS.
Manually scan for malicious and other potentially unwanted software
Windows Defender Offline offers three ways to scan your computer: Full scan, Quick scan, and Custom scan.
· A Full scan will scan all the files on your computer. It is highly recommended that you perform this type of scan. However, a full scan can take a long time, depending on the size of your hard drive and number of files to scan.
· To do a full scan, click the Home tab, under Scan options select Full and then click Scan now.
· A Quick scan will check places on your computer’s hard disk that are most likely to be targets for malware, such as the system folder, startup folder, and the registry. You should run a quick scan anytime you suspect malware has infected your computer.
· To do a quick scan, click the Home tab, under Scan options select Quick and then click Scan now.
· Use Custom scan to choose just the folders or files you want to scan. This works well if you suspect a specific area of your computer is infected.
· To do a custom scan, click the Home tab, under Scan options select Custom and then click Scan now.
· On the Scan options page, select the drives and folders that you want to scan, and then click OK.
Respond to malware found on your computer
When Windows Defender Offline detects malicious or potentially unwanted software, you can review the item, choose Clean Computer, Remove, Quarantine, Clean, or Allow the item. Windows Defender Offline will offer a recommended action, but you can choose a different one if you prefer.
Note: If you choose Allow for an item, Windows Defender Offline will stop alerting you to risks that the software might pose to your privacy or your computer. Add software to the allowed list only if you trust the software and the software publisher.
To take recommended actions on malicious or potentially unwanted software
To review and apply actions to detected malicious or potentially unwanted software, follow these steps:
1. In Windows Defender Offline, click the Show details link under the Clean Computer button on the page that is displayed when a scan is completed. This opens a new dialog.
2. For each item listed, review the information that Windows Defender Offline displays about the item. You can choose to apply the recommended action, or select another action that Windows Defender Offline should take on the item.
3. Clicking on the Show details button provides more detailed information about each identified threat.
4. After you have reviewed each item and selected an action, click Apply Actions.
Using Clean Computer
When you have malicious or potentially unwanted software, one of your options is Clean Computer. The Clean Computer button appears on the Home tab of Windows Defender Offline.
When you choose Clean Computer, Windows Defender Offline opens a new dialog that lists the items that were identified and the progress in apply the default action on the item.
Windows Defender Offline first applies the default actions for detected software based on the definition file from Microsoft. If the default action fails, the next action recommended by Windows Defender Offline is automatically applied. In most cases, Clean Computer quarantines malware when the attempt to clean or remove the malware fails. Detected software items that do not have an action associated with them are removed.
If Windows Defender Offline fails to take the above mentioned actions on the item, the window turns red. If this happens, try rebooting and rescanning the machine. If Windows Defender Offline succeeds the window turns green. Clicking on Close will dismiss this dialog.
Updating Signatures on Windows Defender Offline
If you have Windows Defender Offline installed on a USB, inserting the USB drive on a computer with internet connection and re-running the wizard will update the signatures.

Otherwise, the recommended approach for updating signatures is to create a new copy of Windows Defender Offline.
Understanding alert levels
Alert levels help you choose how to respond to malicious and potentially unwanted software. While Windows Defender Offline will recommend that you remove malware, not all software that is detected is malicious or unwanted. The information in this table can help you decide what to do if Windows Defender Offline detects potentially unwanted software on your computer.
Alert level: Severe
What it means: Widespread or exceptionally malicious software, such as viruses or worms, which negatively affect your privacy and the security of your computer, and which can damage your computer.
What to do: Remove this software immediately.
Alert level: High
What it means: Software that might collect your personal information and negatively affect your privacy or damage your computer, for example, by collecting information or changing settings, typically without your knowledge or consent.
What to do: Remove this software immediately.
Alert level: Medium
What it means: Software that might affect your privacy or make changes to your computer that could negatively impact your computing experience, for example, by collecting personal information or changing settings.
What to do: Review the alert details to see why the software was detected. If you do not like how the software operates or if you do not recognize and trust the publisher, consider blocking or removing the software.
Alert level: Low
What it means: Potentially unwanted software that might collect information about you or your computer or change how your computer works, but is operating in agreement with licensing terms displayed when you installed the software.
What to do: This software is typically benign when it runs on your computer, unless it was installed without your knowledge. If you're not sure whether to allow it, review the alert details or check to see if you recognize and trust the publisher of the software.
Windows Defender Offline system requirements
Memory requirement:
The system to be scanned must have a minimum of 512 MB of memory.
Operating Systems that can be scanned for malware:
Windows XP SP3, Windows Vista, Windows 7 and Windows 8.
Windows Server 2k3 R2, Windows Server 2k3 SP 2, Windows Server 2k8, Windows Server 2k8 R2, Windows Server 8.
Click to expand...

Cyber_Defend_Team · Feb 22, 2025

Q> Windows Defender Offline Scan (Windows 10 Pro_x64) Event ID

Would you mind elaborate your issue in details?

If anything detects during Windows Defender Offline, it will be appeared in Windows Defender History and under malware list and general information for scan should be appeared in Windows Event Viewer.

win10freak · Feb 22, 2025

Windows Defender Offline Scan results?

I found this in the event viewer. What do you think?
Maybe it detected changes to Windows Defender to run the Offline scan, but this was actually done by me and not from malware.

Windows Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. Old value: N/A\Scan\OfflineScanRun = New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Scan\OfflineScanRun = 0x0

Windows 10: After performing an Offline Scan with Windows Defender, it detects malware pointing...

After performing an Offline Scan with Windows Defender, it detects malware pointing...

After performing an Offline Scan with Windows Defender, it detects malware pointing...

After performing an Offline Scan with Windows Defender, it detects malware pointing...

After performing an Offline Scan with Windows Defender, it detects malware pointing... - Similar Threads - performing Offline Scan

Malware preventing the offline defender scan

Malware preventing the offline defender scan

Malware preventing the offline defender scan

After performing an Offline Scan with Windows Defender, it detects malware pointing...

Windows Defender offline scan - possible malware?

Windows Defender offline scan - possible malware?

Windows Defender offline scan - possible malware?

Windows defender offline scan not scanning

Windows defender offline scan not scanning