An offline scan is a malware check that runs after a reboot, outside the normal Windows session. Instead of scanning a live, running system, the endpoint boots into a minimal environment and then examines the installed Windows files, startup locations, and other on-disk artifacts. This reduces the chance that active malware can hide itself, tamper with tools, or block detection.
Offline scans matter because persistent threats such as bootkits, rootkits, and heavily embedded malware often survive ordinary scans by interfering with the operating system. Security teams use offline scans when they suspect a machine is compromised or when repeated detections point to something that keeps reappearing after cleanup. In defense, the technique is useful for validating remediation; in attacks, it is often the last barrier malware tries to evade. It is a powerful recovery tool, but it is not a guarantee: success still depends on current signatures, a healthy scan engine, and access to the affected disk.