When malware comes back after every cleaning, the scanner has to run before Windows starts. Update signatures, reboot into the offline scan, and check afterwards what was turned off.
Update signatures with **MpCmdRun -SignatureUpdate**, run **Start-MpWDOScan** for the boot-time scan, then read **Get-MpThreatDetection** and re-enable whatever the malware disabled.
An offline scan with stale definitions finds nothing. Resolve the current **Platform** folder instead of hard-coding a version number, because it changes with every update.
$mp = Get-ChildItem 'C:\ProgramData\Microsoft\Windows Defender\Platform' -Directory |
Sort-Object Name -Descending | Select-Object -First 1
$mpcmd = Join-Path $mp.FullName 'MpCmdRun.exe'
& $mpcmd -SignatureUpdate**-ScanType 2** is the full scan and runs while you keep working. The output shows the path of anything it quarantines, which is often more useful than the summary.
& $mpcmd -Scan -ScanType 2
Get-MpComputerStatus | Select-Object AntivirusSignatureLastUpdated,FullScanEndTime,RealTimeProtectionEnabledThe offline scan reboots the machine and runs outside Windows, so nothing resident can hide. Give it an hour on a laptop, plugged in, and do not interrupt it.
Start-MpWDOScan
:: equivalent from the UI: Windows Security > Virus & threat protection > Scan options > Microsoft Defender Antivirus (offline scan)**Get-MpThreatDetection** lists each detection with the file and the action taken. That path tells you which application is compromised and which files to replace.
Get-MpThreatDetection | Sort-Object InitialDetectionTime -Descending |
Select-Object -First 10 InitialDetectionTime,ThreatID,Resources
Get-MpThreat | Select-Object ThreatName,SeverityID,IsActiveMost infections disable protection or add exclusions so the scanner skips their folder. Read both settings before you call the machine clean.
Get-MpPreference | Select-Object DisableRealtimeMonitoring,ExclusionPath,ExclusionExtension,ExclusionProcess
Get-MpComputerStatus | Select-Object IsTamperProtected,AntivirusEnabled,RealTimeProtectionEnabledRemove the planted exclusions, turn real-time protection back on and confirm the state from a second source. A machine that reports protection off twice is not fixed.
Remove-MpPreference -ExclusionPath 'C:\Users\Public\Temp'
Set-MpPreference -DisableRealtimeMonitoring $false
Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,IsTamperProtectedAnother antivirus is registered, or Defender is disabled by policy. Check Get-MpComputerStatus for AntivirusEnabled and look for a third-party security product.
The recovery environment is damaged. Repair the recovery environment first, then repeat the scan.
A policy or a scheduled task restores the malware's configuration. Check the local group policy and the Task Scheduler for entries you did not create.
Something recreates it. Find the parent process in the detection event, and remove the scheduled task or service that drops the file.
It only reads and quarantines. Still keep a backup, because a false positive can quarantine a file you need.
After a real infection, yes. A single engine misses things, and a portable scanner does not need installation on a suspect machine.
The offline scan leaves no setting behind. Undo manual changes with Set-MpPreference -DisableRealtimeMonitoring $false and remove exclusions with Remove-MpPreference; quarantined files can be restored from Windows Security > Protection history.
Free · no account needed · tracks your progress