How to create a rescue USB with antivirus: a practical guide

When malware blocks the Boot of Windows or sabotages the system, a Rescue USB with antivirus can get you out of trouble. These tools work outside the operating system and prevent malware from defending itself, increasing the chances of detection and cleanup and making it easier to identify types of malware.

In this guide I explain, in detail, how to create and use different rescue disks and USB drives, what options are there on the market, how boot from USB or DVD, what to do if your disk is encrypted, and how to recover data after an infection. You'll also see practical recommendations to prevent future incidents.

What is a rescue USB and when to use it?

A rescue USB is a bootable media with a minimal environment and an antivirus that allows you to scan your computer. without starting WindowsBy running outside the system, malware cannot block scanning or hide as easily, which helps detect hidden processes and rootkits.

Use it when you suspect an infection that prevents normal startup, when scans within Windows do not resolve the problem, or if you detect serious symptoms (e.g., MBR altered, error screens, constant reboots, or suspicious encryption). For boot problems you can see how restore the bootloader.

Preliminary checks and requirements

Before you jump in, confirm that the failure is actually due to malware and not due to hardware, drivers or BIOS/UEFI changesThis will help you choose the right tool and procedure.

Have another clean Windows PC, an Internet connection, and an empty USB (4GB or more recommended; some solutions work with 2 GB). If you are going to burn a DVD, you will need an ISO compatible burner and software (the Windows Disk Image Burner Enough).

Configure the equipment to be repaired to allow boot from USB or DVD, and read the messages from the tools calmly; acting hastily increases the risk of losing data or interrupting the process. If you prefer, use tools like WinSetupFromUSB.

Create a rescue USB with specific solutions

Various manufacturers offer built-in utilities or ISO images to create the media. Below, you'll see how to proceed with AVG, Avast and Panda Cloud Cleaner, plus a generic guide with Rufus for any ISO.

AVG Rescue (Rescue Kit)

In your AVG product, open the dashboard “Rescue Kit” and choose “Create rescue USB”. It's very straightforward: insert the USB drive, press "Begin" and then “Install”.

Once created, you can boot any PC from that USB and run the scan outside of Windows. If your computer doesn't start automatically, use the Boot menu or adjust the boot order in BIOS/UEFI.

Avast: Rescue Disk (USB or DVD)

Avast allows you to create your Rescue Disk on a USB or generate an ISO file to burn to DVD. You need a malware-free Windows PC and avast Antivirus installed.

• Create on USBInsert a blank USB drive, select the drive, and let it complete the creation. Once complete, accept and safely remove the media.
• Create ISO for DVD: Generate the ISO, open the folder, right click and choose “Burn Disc Image” (in Windows 11"Show more options” ▸ “Burn Disc Image”). Select the burner and press “Burn”.

Important: the Avast Rescue Disk is not compatible with ARM processors.If your computer is ARM-based, opt for another bootable solution.

Panda Cloud Cleaner (Bootable USB)

On a working PC, download PandaCloudCleanerUSB.exe. Connect the USB, press “Start”, choose the drive and “Install”. The wizard will show the progress and confirm the installation. correct USB creation.

On the infected PC, insert the USB and reboot. If the computer doesn't boot from the USB, you'll need to change boot sequence in BIOS/UEFI or use the boot menu. Accept the license key with Enter and follow the wizard: it will ask you to remove the USB when it prepares to scan, will restart the computer and will automatically launch Panda Cloud Cleaner. Click “Accept and analyze.”

Please note that during the analysis in advanced mode you will not be able to use the computer; let it work until the process is finished and the results are displayed. disinfect. If you prefer another tool, you can see how disinfect with Malwarebytes.

If you prefer professional help, some providers offer specialized telephone support; for example, Panda has assistance in Spain during business hours.

How to boot from a USB flash drive or DVD

With the PC off, insert the Rescue USB or the DVD. Turn it on and press the key to access the Boot Menu (usually F12, F11, F8, Esc, or one specified by the manufacturer).

In the Boot Menu, choose the appropriate device: it may be displayed as “Device storage USB”, “USB Flash Drive”, “Removable Devices”, or the name of your DVD optical drive. It sometimes appears in submenus with other drives.

If you are unable to access the Boot Menu, consult your computer's documentation, the manufacturer's website, or their technical support for the exact keys and steps on your model; if a GRUB rescue appears, follow the guide to fix GRUB rescue.

Analysis and disinfection with a Live environment

Once the rescue environment boots, follow the instructions. In solutions such as the Rescue Disk Avast You will see a main menu with “AvastPE Antivirus”.

Connect your PC to the Internet if possible and look for the option to update the signature database (in Avast it is “Update VPS”), so that the engine has the most recent definitions.

• Scan of all the discs: Check all units.
• scan by selected folders or disks: Choose specific areas if you need to.
• Includes the “analyze compressed files” if you want to check ZIP/RAR, etc.

When you're done, review the report and the available actions. In many tools, you'll be able to choose “Automatically solve” or manually review each detection to decide whether to clean, quarantine, or delete, and if you need further steps, see how repair Windows after an infection.

Recommended bootable antivirus tools

There are numerous alternatives, from full ISOs to utilities that automatically generate the USB. Here's a broad overview. popular options and what they offer. If you're looking for starter suites, look Alternatives to Hiren's BootCD.

Kaspersky Rescue Disk

It is downloaded in ISO format and offers a graphical interface, online update of firms, and analysis of the MBR and hidden files. It also includes utilities such as registry editor and Web navigator for additional tasks.

Avira Rescue System

Simplicity-oriented: focused on detect and remove malware and boot issues. In addition to scanning, it offers extras such as a memory test, registry editing, and basic partitioning options.

Bitdefender Rescue CD

Basado en Linux, updated with the latest definitions when connecting to the Internet. Suitable for in-depth analysis when you suspect persistent or difficult infections.

Dr.Web LiveDisk

Known for dealing with rootkits and persistent threats, it includes a built-in file manager and browser. It's useful when you need additional diagnosis beyond scanning.

Windows Defender Offline

Microsoft's option for scanning without starting Windows. Available for 32-bit and 64-bit versions, it's ideal if you prefer native tools on Windows computers.

ESET SysRescue

Boot from CD/DVD or USB, access the file system and drives to clean threats that block boot. Note: signature update It doesn’t run automatically; you have to do it manually in the interface (“Update” section).

AVG Rescue CD/USB

Interface type BIOS, very complete in functions. It allows several analysis modes, configure the network, and view the results of previous scans. Ideal for technical profiles.

Panda SafeCD

It works independently of the operating system and supports NTFS and FAT. It presents a complete report upon completion and allows you to define units to analyze and actions to be taken when findings occur.

Norton Bootable Recovery Tool

Download an ISO of less than 1 GB to boot the problematic computer. It offers various types of analysis and automatic update of your database upon connection.

Trend Micro Rescue Disk

It is obtained as an executable that creates the image with the antivirus and then you burn it to a USB or CD. You can inspect hidden files, drivers and the MBR, without loading potentially compromised system files.

Adaware Live CD

Allows you to create a Live USB or CD to boot and disinfect your system. Please note that the size exceeds 1 GB, so the download may take a while. Individual file analysis is not supported.

Panda USB Vaccine

It is not a bootable antivirus as such, but a utility to disable AutoRun and stop infections via USB. It is managed by the line of commands and can be integrated for pre-boot scans, and can help disinfect USB flash drive.

Bitdefender USB Immunizer

Similar to the previous one, it blocks automatic execution from memories to prevent USB propagation. Useful as a preventative layer in Windows.

USB Threat Defender

Focused on neutralizing AutoRun threats and providing ongoing protection. Works in background and covers system and USB drives.

USB DiskSecurity

Standalone application with various features to protect the system against USB malware. Disable AutoRun on your system and flash drives as a preventative measure.

BullGuard (Rescue)

Complete security solution with a rescue media that scans and blocks USB auto-runs. It is designed for Windows usuarios and reduce the risk of reinfection.

McAfee VirusScan USB / Rescue

McAfee portable proposal with automatic scanning when connecting drives and option to Rescue Drive for committed teams that don't start.

Avast Boot-Time Scan (without USB)

Useful alternative if you can get into Windows: schedule a analysis at startup from Avast to detect malware before the system fully loads.

Create a generic bootable USB with Rufus

If you have an ISO file (Kaspersky, Avira, Bitdefender, etc.), use Rufus to burn it to a USB in a simple and reliable way.

• Open Rufus, select your USB stick and choose the Antivirus ISO.
• Choose the appropriate partition scheme (GPT/UEFI or MBR/BIOS depending on your computer) and press “Start".
• Once created, safely eject the USB and use it to start the PC infected.

If the disk is encrypted: rescue the operating system

When you can't access an encrypted hard drive and Windows won't load, the right way is to prepare a preinstallation environment (WinPE) with the corresponding restoration utility; see how Install Windows PE.

• generates the restore utility executable for your encrypted devices.
• Create an image Custom WinPE and includes the utility in the image.
• Burn that image to a bootable media (USB or CD/DVD) and boot from it to restore the disk access. You can find more details in Microsoft documentation (e.g., TechNet).

USB and viruses: two useful clarifications

Can a USB drive carry malware? Yes. By connecting a compromised drive, it is possible for the infection to spread to other systems, especially if the AutoRun is not blocked.

How do I keep my USB drive safe? Always scan it when you plug it in and avoid opening it without first scanning it. Also, disable AutoRun. reduce risks.

Prevention tips and good practices

Keep your antivirus and system updated; activate the Automatic Updates of Windows to cover known vulnerabilities and prevent attacks.

Browse carefully: avoid unreliable pages, disable Java in the browser if you don't use it and don't open emails from unknown senders or suspicious attachments.

Control physical media: Limit the use of third-party flash drives and scan each USB before opening. Disk encryption and secure boot help protect the MBR and the startup environment.

Recovering data after an infection

If after cleaning the data appears corrupted or inaccessible, you can use tools to file recovery reputable. A popular alternative is Wondershare Recoverit, which supports numerous formats and devices.

Typical procedure: Install the software on a clean PC, select the affected drive (including external USB if applicable), start a full scan and, when finished, preview and recover the necessary files to another location. Alternatively, see how recover the Documents and Downloads folders.

As an additional method, you can try disk verification with CMD: Open Run (Win+R), type “cmd,” and run chkdsk against the drive letter (e.g., chkdsk D: /f). Respond “Y” if prompted and let the process complete without interruption.

A rescue USB with antivirus is a fundamental tool when the computer does not start due to malware, because it allows you to analyze from outside the system, update signatures, check entire disks or sensitive areas such as the MBR and choose between automatic action or manual review. With the alternatives you've seen—from Kaspersky, Avira, Bitdefender, Dr.Web, Windows Defender Offline, ESET, AVG, Panda, Norton or Trend Micro, to preventative utilities such as Panda USB Vaccine and Bitdefender USB Immunizer—, plus the option to create media with Rufus or a WinPE for encryption cases, you have everything you need to safely regain control and apply good practices to avoid the same thing happening again.