Lumma Stealer virus

To remove malware without connecting to the internet, use Microsoft Defender Offline. It is designed to scan after a restart without loading Windows, which makes it harder for persistent malware to hide.

1. On a clean PC that is not infected, download Microsoft Defender Offline and create bootable removable media.
2. Use a blank CD, DVD, or USB flash drive with at least 250 MB free space.
3. If using a USB drive, it will be reformatted and erased, so back up anything important on it first.
4. Insert that media into the infected PC.
5. Start the infected PC and boot from the USB/DVD/CD. Depending on the device, this may happen automatically, or boot order may need to be changed in UEFI/BIOS or by using a boot devices menu.
6. Let the Microsoft Defender tool run its scan and remove malware it finds.
7. When the scan finishes, restart the PC, remove the media, and boot back into Windows.
8. After Windows starts, open Windows Security and review Protection history for scan results.

If malware keeps returning after normal cleanup, Microsoft also recommends running an offline scan from Windows Security:

• Start > Settings > Update & Security > Windows Security > Virus & threat protection
• Under Current threats, select Scan options
• Select Windows Defender Offline scan > Scan now

Important notes:

• Save any open work before starting an offline scan because the device will restart.
• If the malware caused irreversible changes, a PC reset or reinstall may be required. Restore files from backups created before the infection when possible.
• Avoid reconnecting to websites or files that originally delivered the malware, because reinfection can occur that way.

• Run and review the results of a Microsoft Defender Offline scan
• Virus and Threat Protection in the Windows Security App | Microsoft Support
• Troubleshoot problems with detecting and removing malware | Microsoft Support
• Troubleshoot problems with detecting and removing malware | Microsoft Support