How to Scan for Rootkits with a Bootable Rescue Disk

Updated 14 November 2026 · Standard formula, shown below

Scanning for rootkits with a bootable rescue disk lets you check your system from a clean, trusted environment, bypassing the operating system that may already be compromised. You boot from a USB or CD containing specialized security tools, then run a deep scan of your hard drives. This guide covers the entire process, from creating the disk to interpreting the results.

What You’ll Need

A USB flash drive (8 GB or larger) or a blank CD/DVD.
A working computer with internet access to download the rescue disk image.
Software to create a bootable USB (e.g., Rufus, balenaEtcher) or built-in burning tools for CD/DVD.
A rootkit scanner included in the rescue disk (most security vendors offer free rescue ISOs, such as Kaspersky Rescue Disk, Bitdefender Rescue CD, or TREND MICRO Rescue Disk).
Basic knowledge of your computer’s BIOS/UEFI boot menu (usually accessed by pressing F2, F12, Del, or Esc during startup).

Step-by-Step

Download the rescue disk ISO. Go to the official website of a reputable security vendor and download the latest rescue disk ISO file. Ensure you download from the official source to avoid tampered files.
Create the bootable media. Insert your USB drive (or blank disc). Use a tool like Rufus (for USB) or the built-in disc burning feature in Windows (right-click the ISO and select “Burn disc image”) to write the ISO to the media. For USB, select the ISO, choose the correct device, and start the process. This will erase the USB drive, so back up any important files first.
Boot from the rescue disk. Restart your computer. During startup, press the key that opens the boot menu (often F12, F2, Esc, or Del). Select your USB drive or CD/DVD from the list. If the computer boots normally instead, you may need to change the boot order in BIOS/UEFI settings.
Start the rescue environment. Once the disk loads, you’ll see a menu. Choose the option to start the rescue environment (often “Default” or “Graphical mode”). Wait for the system to finish loading; this may take a few minutes.
Update virus definitions (if possible). Many rescue disks offer an option to update malware definitions before scanning. If you have an internet connection, do this now to ensure the scanner recognizes the latest rootkit variants.
Select the scan target. In the scanner interface, choose the drives or partitions you want to scan. For a thorough check, select all local drives. Some tools also allow scanning the master boot record (MBR) and boot sectors—make sure those options are enabled.
Run the scan. Start the scan. This can take anywhere from 30 minutes to several hours, depending on the size of your drives and the scan depth. Do not interrupt the process.
Review and act on the results. When the scan finishes, review the detected items. For each threat, choose the appropriate action: quarantine, delete, or repair. If a rootkit is found, follow the tool’s recommendation (usually quarantine or delete). After taking action, restart the computer normally.
Verify your system. After rebooting, run a full scan with your regular antivirus software to ensure no remnants remain. Also check that your system is functioning normally.

Common Mistakes

Not updating definitions before scanning. Rootkit scanners rely on up-to-date signatures; an outdated disk may miss newer threats.
Booting the wrong device. If you don’t enter the boot menu correctly, the computer may boot from the hard drive, and the rescue disk won’t load.
Scanning only the system drive. Rootkits can hide in other partitions or the MBR. Always scan all drives and boot sectors.
Interrupting the scan. Closing the lid, pressing power, or unplugging the USB mid-scan can corrupt the scan or leave the system in an inconsistent state.
Using a pirated or unofficial rescue disk. This can introduce malware or be ineffective. Always download from official vendor sites.

Tips

Create the rescue disk on a clean, trusted computer to avoid infecting the media itself.
Keep a rescue disk ready even if you suspect no infection—it’s a valuable emergency tool.
If your computer has UEFI with Secure Boot, you may need to disable Secure Boot temporarily to boot from the rescue disk. Re-enable it after the scan.
Some rescue disks include a command-line interface; if the graphical interface fails, you can still run scans via terminal commands (e.g., kavscan for Kaspersky).
After cleaning, change all your passwords and monitor for suspicious activity, as rootkits may have captured credentials.

Troubleshooting

Computer doesn’t boot from USB. Check that the USB is properly created (try another port, preferably USB 2.0). Enter BIOS/UEFI and ensure boot from USB is enabled and set as the first boot device. If Secure Boot is on, disable it temporarily.
Rescue disk loads but shows a black screen. This can happen with certain graphics cards. Try booting in “Safe Mode” or “Basic Graphics” mode from the rescue menu. If using a USB 3.0 port, switch to a USB 2.0 port.
Internet not working in the rescue environment. The rescue OS may lack drivers for your network card. Connect via Ethernet instead of Wi-Fi, or download the latest definitions on another computer and copy them to a USB drive that you can plug in during the scan.
Scan takes too long. If the scan seems stuck, it may be normal for large drives. Wait at least a few hours. If it truly hangs, restart and try scanning partitions individually.
Scanner crashes or restarts. This could indicate a hardware issue or a corrupted rescue disk. Recreate the USB using a different tool, or try a different vendor’s rescue disk.

Frequently Asked Questions

Will a rescue disk scan remove all rootkits?

It can remove most known rootkits, but advanced or polymorphic rootkits may evade detection. After cleaning, run a full scan with your regular antivirus and consider a system reinstall if you suspect persistence.

Do I need to uninstall my current antivirus before using a rescue disk?

No. The rescue disk runs independently of your installed OS, so there’s no conflict. However, after the scan, you may want to run a full scan with your regular antivirus to catch anything the rescue disk missed.

Can I use the same rescue disk on multiple computers?

Yes, the rescue disk is portable. Just ensure you update the virus definitions each time you use it, as definitions expire.

Is it safe to scan a PC that is not infected?

Yes, scanning a clean system is safe and can provide peace of mind. The rescue disk doesn’t alter system files unless you choose to quarantine or delete detected threats.

What if the rescue disk doesn’t detect anything but I still suspect a rootkit?

Try a different vendor’s rescue disk, as detection rates vary. Also check for unusual system behavior, network traffic, or hidden processes. Consider using a rootkit-specific tool like GMER or Sophos Anti-Rootkit (run from within Windows, but only if you trust the system).

Can I create a rescue disk on a Mac?

Yes, you can use tools like balenaEtcher to write the ISO to a USB drive from a Mac. Booting from the USB on a Mac may require holding the Option key during startup and selecting the USB drive.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.