This is why working with end-user directly, or educating them on this process is critical (i.e. There's a little bedside manner suggestion, offered by Jason: 'You'll get a warning pop-up that you are about to install a new operating system, which isn't really the case, but that's a standard pop-up for all deployments with a type of 'Operating System.' This is kind of a scary dialogue to end-users, and unfortunately there's no way to control it. You can do it in the comfort of your office, staring at a Configuration Manager OSD screen. You don't need to haul a CD or USB drive to an infected machine in Timbuktu. It's a great - and decidedly nontrivial - way to clean systems that trigger an 'Offline Scan Required' message in System Center 2012 Endpoint Protection. Here's the new trick: Jason Githens, on the Microsoft System Center Configuration Manager Team, has posted detailed instructions for using System Center 2012 Configuration Manager to run WDO unattended. You can use any old Windows PC to create the CD or USB drive, but the 'bittedness' of the download has to match the bittedness of the scanned PC. If you have an older version of WDO on a USB drive, the WDO installer will only update the definition files. The definition files are stored with the program, so it's important to run the latest version. WDO uses signature files, which are updated daily. WDO boots into WinPE, scans for malware, and offers to remove anything menacing that's discovered. In the normal course of events, you create a CD or USB drive using WDO, then boot WDO from that CD or DVD. WDO, like Microsoft Standalone System Sweeper before it, scans Windows XP (SP3), Vista (RTM, SP1, SP2), Windows 7 (RTM, SP1), or Windows 8 Developer or Consumer Preview.

With this final release, there's a great new trick so that you don't have to schlep a USB drive around to all of the PCs on your network. It can also scan for rootkits not picked up by programs runnning on Windows.

Microsoft's rootkit-busting scanner, Windows Defender Offline, has emerged from beta and now stands ready to unhose various and sundry clobbered systems.Īs I explained last December during the beta phase, WDO can bring systems back from the dead.

Defender offline scan