Thursday, June 02, 2011

Setting Up the Microsoft Standalone System Sweeper Beta, Now Windows Defender Offline

Edit Note: The Microsoft Standalone System Sweeper Beta has been renamed to "Windows Defender Offline".  The instructions below have been edited accordingly.

Windows Defender Offline

Windows Defender Offline is a recovery tool currently available from Microsoft.  The tool is not a general, all-purpose scanner and is not a replacement for an updated antivirus program.  Rather, it is to help start an infected PC and perform an offline scan to identify and remove rootkits and other advanced malware.

Windows Defender Offline can also be used in situations where an antivirus software fails to install or the program that is installed is unable to detect or remove malware from the computer.

The original "Microsoft Standalone System Sweeper" tool had long been a part of the Microsoft Diagnostics and Recovery Toolset (DaRT) for Microsoft Enterprise customers.

~   ~   ~   ~   ~   ~   ~   ~   ~   ~   ~

With USB sticks so readily available, the instructions that follow are for that media.  However, a blank CD or DVD can also be used.


Requirements When Creating Windows Defender Offline Media

When creating the bootable media, it is important to consider the following information and requirements:
  • A minimum of at least 250 MB of free space on the selected media (CD, DVD or USB drive) is required.
  • If you elect to prepare an ISO for future use, keep in mind that the definitions will not be up-to-date.
  • Installing Windows Defender Offline on a USB drive will reformat the USB drive, resulting in the loss of all data stored on the USB drive.  (See Note below*)
  • Regardless of the operating system used to create the file, it is essential to select the correct version of the tool, either 32- or 64-bit, for the infected operating system where the tool will be used.
  • An Internet connection is required for installation and download of the latest virus and spyware definitions for Windows Defender Offline.
  • Internet Browser: Windows Internet Explorer 6.0 or higher or Mozilla Firefox 2.0 or higher.


Installing on USB Drive

The download file is located at Microsoft Help and Support.  Again, it does not matter what the operating system is that you use to download and create the bootable media.  However, it is critical to select the correct version for the computer where the tool will be used.

After downloading the file, select the correct version.  If you need assistance determining whether the infected computer is 32- or 64-bit, see the Microsoft Help and Support article for instructions.


Launching the installer, will take you to the "Welcome" screen:

 


Clicking Next is when you select the media where the tool will be created:



The files for the selected version (32- or 64-bit) will download and install on the media:



After the process has been completed, the bootable USB drive is ready for use.



When you click "Computer" to eject the USB drive, note that the name includes the version of the tool that was created.


Updating the Definitions

After starting the infected computer with Windows Defender Offline, do the following to insure that the most recent definitions are installed:
  1. Click on the Help drop down arrow menu.
  2. Click on Check for updates.
  3. Click on Download.

In the event the infected computer does not have an Internet connection, the updates can be manually transported to the infected machine.  The definitions are the same for Windows Defender Offline as used with Microsoft Security Essentials.
  1. Download the latest definitions from the Malware Protection Center Portal, selecting the correct version for the infected computer: 
    -- mpam-fe.exe is for the 32-bit version   
    -- mpam-fex64.exe is for the 64-bit version
  2. Transport the saved definitions to the infected computer, selecting the Browse button to navigate to the location of the saved definitions.  (See Note below*)


*Note regarding reformatting the USB Drive 

If the following conditions are met, when running the tool again, the USB drive will not be reformatted.  In addition, after creating the tool on your USB, you can copy other tools, "rescue data" as well as the latest definitions. 
  1. The files on the USB drive are not damaged or missing (the tool will verify that the files are not damaged).
  2. The same USB drive is used.
  3. The version of the Windows Defender Offline used to create the bootable USB drive is the same as the version of the tool being re-run or updated.  The tool will detect the already installed product and will only update the definitions without reformatting or altering your data.

System Requirements for Infected Computer

Important Note:  BitLocker must be disabled on the infected computer to use Windows Defender Offline.
  • Operating system:  Windows XP Service Pack 3; Windows Vista (RTM, Service Pack 1, or Service Pack 2, or higher); Windows 7 (RTM, Service Pack 1, or higher).
  • Required processor: 
    Windows XP: 500 MHz or higher1.0 GHz or higher
    Windows Vista and Windows 7: 1.0 GHz or higher
  • Required memory:
    Windows XP: 768 MB RAM or higher
    Windows Vista and Windows 7: 1 GB RAM or higher
  • Required video card: 800 × 600 or higher
  • Available hard disk space: 500 MB 

Download and Additional Information



Related Articles




Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

13 comments:

  1. mitziJuly 29, 2011 at 10:00 AM

    Made the cd and started from it, no problems, but the program would not start. error code: 0x8004cc05

    what went wrong?

    ReplyDelete
  2. mitziJuly 29, 2011 at 10:03 AM

    error code 0x8004cc05 when system sweeper failed to start from cd.

    ReplyDelete
  3. AnonymousJuly 29, 2011 at 12:28 PM

    Microsoft System Sweeper Error Code 0x8004cc05 booting on a Dell Dimension E521 Vista System.

    ReplyDelete
  4. CorrineJuly 29, 2011 at 3:53 PM

    Hi, Mitzi.

    In checking the Dell Dimension E521 Vista System, it appears that it is a 64-bit AMD processor.

    First, make sure that the CD you created was for the 64-bit version of the System Sweeper (mssstool64.exe) even if you used a 32-bit computer to download the file.

    Second, although in the specs I found, it does not appear that your computer has a 3.5" floppy drive, if that is the case, I suspect that is the source of the error.

    You can disable the floppy drive either via Device Manager or BIOS.

    1) To Disable in Device Manager:

    Go to Device Manager. Select it and Expand FloppyDiskdrives. Select FloppyDiskDrive and right-click selecting disable.

    2) To Disable in BIOS:

    Restart your Computer, pressing Del to enter into BIOS. In CMOS Setup, click FloppyDrive A and select Disabled. When you Save your Changes in Bios, you won’t see FloppyDrive in Windows.

    In either process, restart the computer to ensure the changes took effect. Reverse the process to re-enable the floppy drive.

    ReplyDelete
  5. Alexandra LawrenzAugust 22, 2011 at 11:10 AM

    Good thinking on informing your readers of the requirements—sometimes users don’t realize what you need in order to run these sorts of tools. Also explaining the system requirements for an infected computer makes it very simple for anyone to know if this is the right option for them. I think it’s great that you can even run this tool without having to boot into windows. If you take a look at this post I wrote, it will give you step-by-step instructions as to how to install the new System Sweeper tool on a flash drive or CD: http://bit.ly/qyczwf

    ReplyDelete
  6. AnonymousSeptember 12, 2011 at 3:38 PM

    I also get Error Code: 0x8004cc05 when attempting to run System Sweeper from a USB drive. I have a 64-bit processor and the 64-bit version of System Sweeper, and no floppy drive enabled. What else may be causing this error?

    ReplyDelete
  7. CorrineSeptember 12, 2011 at 4:30 PM

    A solution I have seen work for some is to boot without the network cable. After the Microsoft Standalone System Sweeper launches, reconnect the network cable and download the current definitions.

    ReplyDelete
  8. AnonymousSeptember 12, 2011 at 6:38 PM

    Thanks, Corrine, disconnecting the network cable worked for me. Very strange!

    ionfield (Anonymous)

    ReplyDelete
  9. CorrineSeptember 12, 2011 at 8:25 PM

    Thank you for letting me know that disconnecting the network cable worked, ionfield. I'll update Solve Microsoft Standalone System Sweeper Errors to add that as another possible solution for Error Code: 0x8004cc05.

    ReplyDelete
  10. davidApril 17, 2012 at 11:21 AM

    Great help. downloaded the Standalone sysem onto my flash and then booted my pc. As suggested, went to my pc and change the booting order. Result, able to scan my computer. However, now my pc won't start from my hard drive, even after I changed the booting order back to its orginal. I've a hp pavilion entertaniment dv4 bought in 2010. Now, I need to do a system recovery on my pc, all that work. any advice. I keep getting mssage hp cannot repair start up automacally because of the recent change in hardware/software. HELP.

    ReplyDelete
  11. AnthonyAugust 15, 2012 at 5:03 PM

    My laptop, running 64/32 bit WIN 7, is infected, making it difficult to get on the INTERNET. I already have Securities Essentials running on that laptop but it has been disable. How do I download MS Standalone System Sweep Beta on to a DVD using my VISTA PC? Then I want to insert that DVD into my laptop and boot from it. Am I headed in the correct direction? Thanks Anthony, antpnd@yahoo.com

    ReplyDelete
  12. AnthonyAugust 15, 2012 at 5:25 PM

    My Samsung 64/32 bit WIN 7 laptop using MS Office 2007 with Security Essentials. It is infected. Can I download all my documents and pictures off its C drive to an external drive without carrying the virus into the external drive? Then reformat my C drive to wipe out the virus??? Then use its D drive to reinstall my C drive??? A long time ago I had made and still have four Backup DVD's. antpnd@yahoo.com

    ReplyDelete
  13. CorrineAugust 16, 2012 at 10:47 AM

    Hi, Anthony.

    First, you need to determine if your laptop is 64 or 32-bit to get the correct version. It cannot be "64/32 bit".

    As to backing up important files, although they should be fine, there is no guarantee.

    If you would like additional assistance, please follow the Log Posting Instructions at LandzDown Forum and I'll do my best to assist.

    ReplyDelete

Neither spam nor comments containing vulgarities will be approved.