Windows Defender Offline: frequently asked questions

Windows Defender Offline helps protect your PC by scanning it to remove rootkits and other advanced malware that can't always be detected by antimalware programs. If this type of malware is detected on your PC, you'll be prompted in Microsoft Security Essentials or Windows Defender to download and run Windows Defender Offline.

The following are answers to some frequently asked questions about Windows Defender Offline.

What if I get an error message when trying to create a bootable CD, DVD, or USB flash drive?

Here are some steps to help you resolve errors that you might get when creating a bootable CD, DVD, or USB flash drive.

Show all

Download failed

If you receive an error that the download failed, you might not have a reliable Internet connection. To solve this problem, do the following:

  1. Make sure your PC is connected to the Internet, and you can browse several websites.

    If your Internet connection isn't stable, you might not be able to complete downloading the necessary files from the Microsoft Download Center. Contact your Internet service provider’s technical support for assistance, or try again with a better Internet connection.

  2. If you can browse several websites, verify that you have at least 500 MB of free hard disk space on your PC. If you don't, delete some files and try again.

  3. If you have a reliable Internet connection and enough free disk space, but still can't download the files, reset Windows Internet Explorer's proxy settings by following these steps:

    1. To reset Internet Explorer's proxy settings automatically, click this button:

      A Fix it button
      Reset Internet Explorer's proxy settings

    2. In the File Download dialog box, click Run, and then follow the instructions on the screen.

Unable to proceed with the required action

If you get this message, there might be a failure in extracting and creating the file system to be written on the disc. To solve this problem, follow these steps:

  1. Verify that you have at least 500 MB of free space on your PC.

  2. Make sure that you have permission to write to the default Windows temp folder by doing one of the following:

    • If your PC is running Windows  XP, click Start, click Run, and then type %temp%.

    • If your PC is running Windows  Vista or Windows 7, click the Start button Picture of the Start button, and then type %temp%in the search box.
  3. Go to the folder that contains the temp folder.

  4. Right-click the temp folder, click Properties, and then click the Security tab.

  5. Click your user name.

  6. If you don't have Write permission, click Edit.

  7. Click your user name, select the Write checkbox, and then click OK.

A system update is required to burn the DVD or CD

This error message is displayed when the Image Mastering API v2.0 (IMAPI2) isn't installed. IMAPI2 is available as part of the Windows Vista and Windows 7 operating systems. To solve this problem, download and install IMAPI2 by following the steps in Download and install IMAPI2 on the Microsoft Support website.

CD or DVD drive not detected

This problem can be caused by a faulty drive, a disc that isn't blank, or if your CD or DVD recorder, drivers, or file system have been damaged. To solve this problem, make sure you're using the CD or DVD recorder drive you selected (if you have more than one), and that you have inserted the CD or DVD properly. If you inserted a blank CD or DVD and you still get the error, verify that the target drive being used is the one you selected and that the disc isn't damaged. If the problem persists, try using another blank CD or DVD, or try using a USB flash drive instead.

This problem can also be caused if the CD or DVD recorder isn't recognizable by IMAPI2. If you have a CD or DVD drive that isn't recognizable by IMAPI2, we recommend trying to create your media on another PC that's compatible with Windows Defender Offline.

There was a problem burning the CD or DVD

Creating a CD or DVD might fail for many reasons, including a damaged CD or DVD, moving the PC while trying to create the CD, a broken CD recording device, or a PC infected with an unidentified virus or malware. To solve this problem, try using a new blank CD or DVD. If the problem continues, Windows Defender Offline and other software or drivers installed on the PC might be incompatible. Try running Windows Defender Offline on a different PC that isn't infected, or use the Create ISO option to create a disc image which can be burned manually onto a CD or DVD using any CD or DVD creation software.

There was a problem adding files to the USB flash drive

You'll likely run into this error if there isn't at least 250 MB of free space on the flash drive. To solve this problem, delete some files from the flash drive and try again.

No USB drive was detected, the selected USB drive was not detected, or failed to format the selected USB drive

To solve any of these problems, make sure that the USB flash drive is inserted into a USB port or try a different flash drive. If this doesn't work, try running Windows Defender Offline on another PC or try reformatting the USB flash drive.

How do I start my PC from a CD, DVD, or USB flash drive?

  1. Insert the Windows Defender Offline CD, DVD or USB in the PC infected with a virus or malware.

  2. Restart the PC.

  3. Some PCs will detect removable media and give you the option of starting up from the CD, DVD or USB flash drive.

    1. Read the instructions on the screen to turn on this option. In some cases, you might need to press any key to start from the CD, DVD, or USB drive or to press a specific key, such as F12.

    2. Press the key (usually F12). A list of available devices is shown. There will be an entry for each hard drive, one for each CD, DVD drive, and a USB flash drive.

    3. Use the arrow key to scroll to the drive that has the bootable CD, DVD, or USB flash drive in it, and then press Enter.

    4. The PC will start from the Windows Defender Offline CD, DVD, or USB flash drive.

  4. For PCs that don't automatically start from the removable media:

    1. During the restart process, read the screen for any instructions that explain how to interrupt normal startup and enter the BIOS Setup Utility. Most PCs use the F2, F10, ESC, or DEL key to begin the BIOS Setup.

    2. Look for a tab in the BIOS Setup Utility that is labeled "Boot Order," "Boot Options," or "Boot." Following the directions on the screen, use the arrow keys to go to the Boot order.

    3. Locate the CD, DVD, or USB flash drive (this might be called Removable Device) in the Boot list. Following the directions on the screen, use the arrow keys to move the drive up so that it appears first in the Boot list.

    4. Press Enter. The boot order sequence is now changed to boot from the CD, DVD, or USB flash drive.

    5. Press F10 to save your changes and to exit the BIOS Setup Utility. Select Yes in the confirmation window. The PC will restart. Allow the PC to restart normally.

How do I use the Windows Defender Offline ISO file?

An ISO image (International Organization for Standardization) is an archive file (also known as a disc image) of an optical disc, composed of the data contents of every written sector of an optical disc, including the optical disc file system. ISO images can be created from optical discs, or can be used to recreate optical discs using software from many software vendors. ISO image files typically have a file extension of .iso.

  1. The Windows Defender Offline creates an ISO file called MSSS_Media.iso and saves it to: %ALLUSERSPROFILE%\Microsoft\Windows Defender Offline.

  2. Insert a recordable CD or DVD into your PC’s disc drive.

  3. Go to the location where you saved the MSSS_Media.iso file, and then double-click it.

    In Windows 7 and Windows XP, this will open the Windows Disk Image Burner. If you have more than one type of disc creation software, select the one you want to use from the Disc burner list.


    • To burn the image file in Windows Vista, you'll need a third-party CD burning program.

  4. Check the Verify disc after burning check box to verify that the ISO file was burned correctly to the disc.

  5. Click Burn to create the disc.

Once the disc has been created, you can use Windows Defender Offline by starting your PC from the CD or DVD.

I've used Windows Defender Offline before, can I re-use the CD or DVD that I created?

If you created a CD or DVD you shouldn't reuse it; it contains definitions to help it detect malware. Definitions are updated frequently so the definition files on the CD or DVD will be out of date. If you created a USB flash drive, you can reuse it. Windows Defender Offline will update the definitions when you rerun the wizard.

Need more help?