Emergency virus recovery tools: Rescue disks and online scanners explained

If malware gets onto your PC, it can disable your antivirus, but bootable rescue disks and on-demand online virus scanners can help you beat the infection.

The antivirus suites we recommend, in our best free antivirus and best paid antivirus guides are put through rigorous testing by multiple independent labs as well as user testing by us. If you don’t have a protection plan in place we’d thoroughly recommend investing in on of our reccomended services.

But even the most capable malware detection engines can occasionally be deceived by a new threat or highly effective obfuscation of malicious code. When that happens, some viruses start by disabling your operating system’s security, starting with your antivirus. If this renders your system unuseable, you’ll need a bootable rescue disk. If you can still use your PC, but can’t access or run scans from your antivirus software, try an online scanner to either check specific files or carry out an on-demand scan that might escape the malicious software notice. Here’s what you need to know about the rescue tools available to you.

Rescue disks and bootable scanners

Some malware prevents you from using your PC once infection has taken hold. To work around this, you can using a rescue disk – a bootable CD or USB drive with its own live operating system, especially designed to detect and destroy viruses on your hard disk.

These are usually tiny Linux distributions, designed to automatically load an easy-to-use malware scanner, which will download the latest virus definition files and then scan your computer’s local storage.

Your hard disk typically remains unmounted, allowing it to be more accurately scanned and cleaned. And because the infected operating system isn’t booted at any point, the malware can’t take steps to be prevent itself from being removed.

A number of antivirus programs, such as Avast, allow you to burn a rescue CD or disk for future use, but there are also downloadable ones, which tend to be rather more useful if you’ve already had to turn to a spare or borrowed PC. Note that some rescue disk creators, such as Trend Micro’s require a functional Windows system to create the disk, so you won’t be able to fire up a Raspberry Pi, or similar, in case of emergencies.

For that reason, I’m only going to recommend rescue images that can be burned from anything down to an Android phone with a USB OTG cable.

You will, however, need a tool to burn bootable images to a CD, DVD or USB drive. For making bootable USB disks, try Rufus (Windows only), Balena Etcher (Windows, Linux, macOS), Ventoy (cross-platform, unofficial Android port available in Play Store). If you only have an Android phone and a USB cable, DriveDroid allows your phone to emulate a bootable USB drive, within certain limitations.

For burning discs, use the Disc Image Tools on modern versions of Windows, Burn on macOS, and Brasero on most graphical versions of Linux. Legacy and modern Windows users can download CDBurnerXP.

Eset SysRescue

Downloadable as either an ISO or an IMG file, SysRescue has more features than most rivals, with granular scanning and malware removal options. Select the image you need at https://www.eset.com/int/support/sysrescue/

Antivirus Live CD

An ultra-lightweight bootable virus scanner maintained by the 4MLinux team, the Antivirus Live CD uses the ClamAV malware scanner to scan for remove malware from your PC, regardless of what OS it runs. Download it from SourceForge. The lack of a graphical environment may put off some users, but a comprehensive tutorial makes up for this.

Dr.Web LiveDisk

It’s available as both a CD ISO and a version that’ll automatically create a bootable USB drive, but note that the USB tool is only available for Windows. Detailed instructions are available for creating and using both versions. Download either version from https://free.drweb.com/aid_admin/

Kaspersky Rescue Disk

One of Kaspersky’s many free tools, this bootable ISO image provides straightforward options powered by the anti-malware firm’s well-regarded detection engine. Download it from here.

Online virus scanners

Designed to provide a quick scan without interfering with any existing security software you have installed, online scanners can also help you work around malware that tries to knobble your installed antivirus.

They’re usually either web apps that allow you to upload files for analysis or a rather unhelpful name for a small, downloadable on-demand scanner. The former are truly cross-platform, while the latter may only work on one or two operating systems, usually Windows, sometimes macOS. Don’t confuse them with cloud-based scanners.

These scanners are very bare-bones, with few options, and often require an internet connection to function. Real-time protection is not included, but some allow you to schedule regular scans.

Even if you’re not dealing with a virus emergency, these can be useful to keep around to double-check anything you’re suspicious of, and supplement the capabilities of whatever full security suite you have installed, whether that’s Microsoft Defender or a third-party option.

For this reason, make sure you get an on-demand or “online” scanner that uses a different malware detection engine to your installed antivirus suite.

VirusTotal

VirusTotal is one of the simplest online scanners out there, and the only one there with no download requirement. Just drag and drop a suspicious file or paste in a dubious URL to get a near-instant assessment of whether or not it presents a threat. No downloads required, which means you can use this browser-based tool on almost any platform. Analyse files and URL now at https://www.virustotal.com/

Trend Micro HouseCall

Windows and macOS users can download an application to quickly scan their PC and even local network for threats using Trend’s malware detection engine. You can save the HouseCall launcher to run whenever you like, but it won’t be automatically updated, so you’ll have to manually download new versions periodically. Versions for both operating systems are available at https://www.trendmicro.com/en_us/forHome/products/housecall.html

Eset Online Scanner

Eset Online Scanner has a periodic scan option and has an offline mode, although this will only have available the virus database it downloaded last time you used it while connected to the internet. Confusingly, the Online Scanner is referred to on its download page as a one-time scan, but it’s really a very cut-down version of Eset’s award-winning antivirus, with minimal options, no real-time protection, and the option of uninstalling it after every scan. Download it at https://www.eset.com/us/home/online-scanner/