How To Create And Use A Bootable AntiVirus Disc – Kaspersky Rescue Edition

What this tutorial is all about…  kav-rescue-disk

In this post I’ll give you step-by-step instructions on how to create and use a bootable antivirus disc.  The bootable antivirus we’ll be using is the Kaspersky Rescue Disc.  This post assumes you know little to nothing about creating bootable antivirus discs (or creating discs from an .iso).

Here are the reasons why you may need a bootable antivirus disc:

  • Your PC has become infected with a rootkit.   Rootkit detectors and removers that run in Windows like GMER, TDSSKiller and Combofix have limited success.  Sometimes when they’re dealing with an updated rootkit they won’t run or they’ll just hang and require you to reboot your computer.
  • Your PC has many infections and is preventing you from running or installing anti-malware or using the computer in general.
  • You may have suffered a minor malware infection and you want to scan from a bootable environment just to make sure nothing’s hiding.


What you’re going to need (or may need):

  • access to the internet
  • 1 blank DVD or CD
  • 1 DVD/CD Burner
  • Software for burning .ISO’s (disc images).  You can get a free one here – http://filehippo.com/download_imgburn/
  • A copy of the latest Kaspersky Rescue Disc from here – http://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/
  • About 1-4 hours depending on how much data you have on C: (less if you just scan the most infectable areas)

Disc Creation Step-By-Step Instructionsyou may follow the instructions below on your infected PC (if you have enough access to the internet) or the best way to go would be to perform the following steps on a computer that’s not infected.

  1. Open your web browser and put this url in the address bar (do not use search) http://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/ This will immediately start downloading the Kaspersky Rescue Disk (kav_rescue_10.iso).  If you get prompted to save this file please save it to your desktop for now.
  2. Download imgburn from here http://filehippo.com/download_imgburn/ (download is towards the top right) to your Desktop.
  3. Insert your blank DVD/CD in your burner now.
  4. Double click the imgburn download on your desktop t0 Install ImgBurn.  Just choose the default options but uncheck the option to install the ask toolbar.
  5. Once imgburn has been successfully installed launch (open) ImgBurn.
  6. Click the first big button on the top left “write image file to disc”.
  7. Under “Source” towards the right click the browse button (little yellow folder with magnifying glass).
  8. Now find the Kaspersky Rescue Disk ISO you just downloaded (kav_rescue_10.iso)
  9. Now click the write button on the bottom
  10. The disc creation process will probably take about 5-10 minutes.
  11. Once the burning process has been completed take that disc out of your burner and label (just write something like my antivirus boot disc).

Using the Kaspersky Rescue Disk Step-By-Step Instructions

  1. On the infected PC.  Turn off the infected PC.  If the PC will not power down by going to the shutdown menu then just unplug the power.
  2. Make sure this PC is connected to the internet via a network (ethernet cable).  We need to update the Kaspersky Rescue disc virus signatures once we’re in the bootable environment.
  3. Start the infected PC and immediately put your bootable antivirus disc in the DVD/CD drive.
  4. You’re probably going to need to shutdown your PC again since you may have missed the open to boot from disc.  If your computer booted into Windows then you missed your chance to boot from the Kaspersky Rescue disk.
  5. So, turn on your computer and see if it starts to boot from the Kaspersky Rescue Disk.  If it doesn’t then you need to make your DVD/CD drive first in the boot process.  This can be accomplished in your computers BIOS.
  6. As the Kaspersky Rescue Disk starts just keep pressing enter to every option screen.  This will start the Kaspersky Rescue environment in graphical mode.  Press “A” on all the white screen with all that black text.
  7. Ok, great.  Now we’re in a bootable environment and all the viruses on your computer are helpless.
  8. Let’s go ahead and update the Kaspersky Virus Signatures.  Click the “My Update Center” tab.
  9. Click “Start Update” at the bottom.  The update can take up to 20 minutes to complete.  Wait until the “Database Status” says “up to date”.
  10. Click the objects scan tab.
  11. Check “disk boot sectors” and “C”
  12. Click “Start Objects Scan”
  13. This scan can take quite awhile (typically 1-4 hours).  Malware will be detected as a red popup window on the bottom right.  Typically the Rescue Disk allows you to deal with the malware at the end of the scan.
  14. Here is the order in which I get rid of the malware:  1: Disinfect – if that doesn’t work – 2: quarantine – if that does work – 3: delete.
  15. Once the scan is complete and the malware has been dealt with you can reboot your PC into Windows.

In Closing… Once you reboot your PC there may still be some malware and settings left behind.  Here are the steps I would take to make sure you’re clean

  1. Malwarebytes – Download, Install, Update and Scan the C:\ drive with Malwarebytes.  Remove anything it finds (click show results).  Reboot.
  2. Reset Internet Explorer even if you use Firefox or Chrome.  Open Internet Explorer – Click Tools – Internet Options – Advanced – Reset.
  3. Make sure a proxy setting is NOT enabled in Internet Explorer.  Open Internet Explorer – Click Tools – Internet Options – Connections – Lan Settings – Uncheck the first check box under Proxy (if one is checked).

, , ,

25 Responses to How To Create And Use A Bootable AntiVirus Disc – Kaspersky Rescue Edition

  1. geohac March 4, 2011 at 8:35 pm #

    Nice tutorial! I’ll add this my site.

  2. Sheen March 5, 2011 at 12:29 am #

    Yosh! just like before Matt! Nothing beats! Thank you so much.

  3. Casey March 5, 2011 at 7:43 am #

    Nice tutorial! Are you going to make a video over it.

  4. Casey Ryback March 5, 2011 at 10:45 am #

    Hmmm… You said you’ll make a video about this…

  5. andy March 5, 2011 at 1:00 pm #

    This is a “must do” , another tool to add to my arsenal of weapons.
    Thank you Matt for all your time and effort in writing these postings and making your videos.

  6. Anakin March 5, 2011 at 6:55 pm #

    No need for a tutorial. Kaspersky provides all the necessary instructions on there web site. Also you forget to mention that you can make a Kaspersky USB Rescue. Good effort any how.

  7. thomas March 6, 2011 at 12:58 am #

    Kaspersky Rescue Disc is better in text mode than the GUI mode. Sometime in the GUI mode the text and icons are too small and you can’t read it.

    • douglasdileo@yahoo.com February 28, 2013 at 5:31 pm #

      same thing , am running it now in text mode and seems to be running fine..tryed the other run modes and doesnt work

  8. Alex March 6, 2011 at 4:08 am #

    Nice tutorial. Easy steps Thanks alot 😀

  9. estechguy March 7, 2011 at 9:11 pm #

    I am jealous because I have not had to use for Kaspersky Rescue Disc>

  10. Henk (Crete, Greece) March 8, 2011 at 7:15 am #

    Thank you Matt,
    For sharing this valuable information with us out there and all the time and effort you put into this. I’m still learning every day.

  11. JimBob March 9, 2011 at 11:32 am #

    Hey Matt… How about testing BufferZone from http://www.trustware.com/ ? It’s now free and claims to be similar to Sandboxie. Thanks.

    • malwarekilla March 10, 2011 at 5:51 pm #

      @JimBob – thanks Jim, I check out BufferZone

  12. Commander Krill March 10, 2011 at 6:58 am #

    Thanks Matt, is there any point in using several rescue discs? I mean Start with Kaspersky, then use DrWeb, Avira and so on?

    • malwarekilla March 10, 2011 at 5:50 pm #

      @Commander Krill – For me, no. Right now I’m sticking with Kaspersky only and then I’ll follow up with Malwarebytes, GMER and MBR.exe.

  13. john March 10, 2011 at 6:18 pm #

    do any of you guys know where you can get erd commander? I hear those are a must when rpairing windows. By the way the Kaspersky cd is a very good tool to fight malware.

  14. Gary March 17, 2011 at 12:32 am #

    Cannot enter anything at the white screen (accept/ reboot/ shutdown screen

  15. justin March 21, 2011 at 8:09 pm #

    when i put the disc in it get all the way to mounting /dev/hdc on /newroot/mnt/cdrom failed: Device or resourse busy what does this mean

  16. peale March 22, 2011 at 5:46 am #

    I’ve spent 30 minutes trying to update over and over and over the Kaspersky rescue cd.

    I orginally did the cd prior to finding your page here & it wouldn’t scan – said error code 80000046 and so when I found your posts here – I redid the cd & followed your download suggestions & all to a “t”

    After 30 minutes of update downloads I still get the error.

    Have they abandoned this cd?

    I don’t get it.

    Anyother ideas?

    I can’t run or update my malwarebytes – even in safe mode – so I’m sunk.

    thanks

  17. Jake March 25, 2011 at 4:07 am #

    Peale, I’m getting the exact same thing, the database wont update, it just keeps saying it’s corrupted, and when i try and scan i get that exact same 80000046 error code. Also, i cant boot any .exe’s like yourself. Please help us :S

  18. Coryg3232 January 12, 2012 at 2:59 pm #

    Kaspersky failed about 15% through scan. Also was unable to update even with a valid internet connection. It did find one rootkit malware infection.

  19. Coryg3232 January 12, 2012 at 2:59 pm #

    Looks like it worked. thanks.

  20. Lorrie April 22, 2012 at 7:52 pm #

    It’s difficult to tell when it is truly done with a task. When the scan completes, it just sits there and doesn’t ask anything, then suddenly there’s a window. When you’ve responded to the window it takes a long time to do the task that response triggered. It’s understandable that these tasks may take some time (because not only the software but the operating system itself is running from a CD/DVD), but progress indicator bars would help keep the user from trying to issue another command before preceding one is complete. Just a thought…

    However, the program did find many Trojans, and I disinfected/deleted them. but I still can’t boot into Windows Vista on my Toshiba Satellite A215-S5818. It immediately wants me to decide between Startup Repair and Starting Windows Normally. I choose Startup Repair, and the same thing happens: “Startup Repair cannot repair this computer automatically.”

    Frustrating!!

  21. douglasdileo@yahoo.com February 28, 2013 at 5:27 pm #

    very helpful, thank you for the info…running the disk now on laptop..taking quite a while ..hoping this clears it…

Trackbacks/Pingbacks

  1. TDSSKiller Won’t Run – What To Do - July 14, 2011

    […] the zip.  Sometimes the .exe is a newer version of the TDSS Killer.Make a Kaspersky Rescue Disk (how to create and use a Kaspersky Rescue Disk instructions) and scan boot sectors along with c:windowssystem32 (you have to click add for this one).  The […]

Leave a Reply