Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
For Windows 10 version 1607 or later and Windows 11, the free option you usually need is already installed: open Windows Security, go to Virus & threat protection > Scan options, and choose Microsoft Defender Offline. It restarts into a trusted environment outside the normal Windows kernel, allowing it to inspect persistent malware and rootkits. Windows 7 SP1 and Windows 8.1 users can create legacy Defender Offline USB, CD or DVD media. If Windows will not start, or you want a separate boot environment, ESET SysRescue Live and AVG Rescue Disk can create USB or optical rescue media.
What is a bootable antivirus rescue CD, and when do you need one?
A bootable antivirus rescue disk starts a small security operating system before the installed Windows system loads. Because the regular Windows kernel, startup programs and many malware processes are not running, the scanner can examine files that hide from a normal in-Windows scan. Microsoft describes Defender Offline as a tool that “lets you boot and run a scan from a trusted environment.”
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →This approach is useful when malware survives ordinary scans, repeatedly returns after removal, blocks security software, or prevents Windows from booting. A rescue disk is not a general-purpose Windows recovery disc: its job is malware detection and cleanup. It will not repair every damaged system file, recover encrypted ransomware data, or replace a backup.
Although the search phrase says “CD,” current PCs are more likely to boot from USB. Optical media remains useful only when the computer has a working DVD/CD drive and firmware that can boot it.
Popular on Amazon
Which free Windows rescue download should you choose?
Choose the built-in Microsoft workflow whenever the target computer can still reach Windows Security. Use removable rescue media when Windows is unavailable, when you need to scan from outside the installed system, or when you want a second vendor’s environment.
| Option | Best use | Media | Important requirement or limitation |
|---|---|---|---|
| Microsoft Defender Offline | Windows 10 version 1607 or newer and Windows 11 systems that can open Windows Security | Normally no separate media; legacy editions can use USB, CD or DVD | Windows Recovery Environment (WinRE) must be enabled. BitLocker can request its recovery key unless protection is suspended. |
| Microsoft Defender Offline legacy media | Windows 7 SP1 and Windows 8.1 | USB, CD or DVD | At least 250 MB; USB creation reformats the drive and erases its contents. |
| ESET SysRescue Live | A separate environment with direct access to disks when installed Windows is unreliable | IMG for USB, ISO for CD/DVD | Create the media separately, then update signatures after boot when networking is available. |
| AVG Rescue Disk | Users who have AVG installed on a clean Windows PC and need removable rescue media | Empty USB of at least 2 GB or a blank recordable DVD | Create a UEFI variant for modern firmware or a BIOS-compatible variant for older systems. |
The official documentation consulted for these tools does not publish a comparative detection-rate, prevalence or efficacy statistic. Treat the table as a workflow and compatibility guide, not a performance ranking.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How do you run Microsoft Defender Offline on Windows 10 or 11?
On supported Windows versions, no CD download is normally required. The scan restarts the PC into Microsoft’s offline environment and Microsoft estimates the scan itself at about 15 minutes (Microsoft documentation, 2026).
- Save open documents, close applications and connect the laptop to power if possible.
- Open Windows Security.
- Select Virus & threat protection, then Scan options.
- Choose Microsoft Defender Offline scan and select Scan now.
- Read the restart warning and confirm. Windows closes the session and boots into the offline scanner.
- Allow the scan to finish. The computer restarts into Windows afterward; review the result in Windows Security’s protection history.
WinRE must be enabled for this workflow. Microsoft also warns that BitLocker-protected devices may ask for the recovery key when the offline environment starts. Locate that key before beginning, or suspend BitLocker protection only under your organization’s procedure; do not guess at a key or repeatedly restart through the prompt.
Also popular on Amazon
How do Windows 7 SP1 and Windows 8.1 users create legacy Defender Offline media?
Microsoft documents a legacy download that creates bootable USB, CD or DVD media for Windows 7 SP1 and Windows 8.1. The media needs at least 250 MB. Build it on a computer you have good reason to believe is malware-free, because malware on the creator PC could interfere with the download or media-creation process.
- Back up every file on the USB drive you plan to use. Microsoft’s creator reformats the drive, deleting existing data.
- Use a blank recordable disc or an empty USB drive with at least 250 MB available.
- Run the legacy Defender Offline media creator on the clean Windows computer and select USB, CD or DVD as the destination.
- Let the creator finish, then label the media so you can identify it at the target PC.
- Shut down the target computer, connect the USB drive or insert the disc, and open the manufacturer’s boot menu during startup.
- Select the removable-media entry and allow Defender Offline to scan. Remove the media when the tool tells you to restart or shut down.
The legacy package is intended for those older Windows editions; on current Windows 10 and Windows 11, use the integrated Defender Offline option unless a separate rescue environment is required.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do you create and run ESET SysRescue Live?
ESET SysRescue Live is a free malware-cleaning environment that runs independently of the installed operating system from a CD, DVD or USB. Its download provides an IMG image for USB creation or an ISO image for optical media.
- On a malware-free computer, download the ESET SysRescue Live image and use an appropriate image-writing utility to put the IMG on USB or the ISO on a blank CD/DVD.
- Back up the USB first if the writing utility will erase it; use blank optical media when creating a disc.
- Insert the finished media in the affected PC and open its firmware boot menu while powering on.
- When the ESET environment appears, select Run ESET SysRescue.
- Choose Update to obtain current signatures if the rescue environment has a working network connection.
- Run a smart on-demand scan for a broad check, or choose a custom on-demand scan when you need to target particular disks or folders.
- Read the detection report before approving repair or deletion. Keep the media inserted only as long as the scanner requires it, then remove it before the next normal Windows boot.
If networking is unavailable, the environment can still perform its offline scan with the signatures included in the image, but the Update action cannot retrieve newer signatures until connectivity is available.
Also popular on Amazon
How do you create and run AVG Rescue Disk?
AVG’s documented creator requires a second, malware-free Windows PC with AVG installed. Prepare either an empty USB drive of at least 2 GB or a blank recordable DVD. The creator can produce a UEFI version for modern computers or a BIOS-compatible version for older firmware.
- Back up any USB contents, then connect the empty drive or insert the blank DVD in the clean Windows PC.
- Open AVG’s Rescue Disk creator and choose USB or DVD as the destination.
- Select the firmware type that matches the target: UEFI for a modern UEFI computer, or BIOS-compatible for a legacy BIOS system.
- Complete media creation and move the drive or disc to the computer you need to inspect.
- Start the target PC and open its one-time boot menu. AVG lists Esc, F12 and F11 as common keys, but the manufacturer determines the actual key.
- Select the USB or DVD entry. In the AVG environment, choose Update VPS when networking is available.
- Start the scan, review its report, and approve repair or deletion only after checking the identified paths and threat names.
- Remove the rescue media before allowing the computer to boot Windows again.
How should you prepare a rescue scan safely?
- Protect your data: save work and close applications. A forced restart can discard unsaved changes.
- Use a clean creator computer: Microsoft and AVG both require or recommend creating media away from the suspected infection.
- Assume USB contents will be erased: copy files elsewhere before using a creator or image-writing tool.
- Have encryption information ready: WinRE and BitLocker can trigger a recovery-key request during an offline start.
- Keep power stable: connect a laptop charger and avoid interrupting a scan while disks are being examined.
- Know the boot-menu key: Esc, F12 and F11 are common examples, but check the computer maker’s documentation if none works.
- Prefer current signatures: update ESET or AVG after boot when a network connection is available; do not treat an update failure as proof that the disk is clean.
What should you scan, and what should you do with detections?
Use a full scan of all hard disks when you suspect a persistent infection, a boot-sector threat or an unknown source. A selected-disk or selected-folder scan is appropriate when you have a narrowly defined question and need a faster, targeted check. ESET and AVG expose these choices in their on-demand scan workflows.
Always inspect the report before taking action. Confirm the file path, detection name and proposed operation, then repair or delete only when you understand the consequence. If a report identifies a business-critical executable or an uncertain false positive, preserve the report and consult the software publisher or an administrator before removal. After cleanup, boot Windows normally and run the operating system’s own security checks again; a rescue scan is one diagnostic step, not a guarantee that every system change has been restored.
What if the PC will not boot from the CD or USB?
The removable device is not listed
Recreate the media from the original image, try another USB port, and open the one-time boot menu rather than changing permanent firmware settings first. Confirm that the media is actually connected before powering on. For AVG, verify that the UEFI or BIOS variant matches the target firmware.
Also popular on Amazon
The computer starts Windows instead
Restart and press the manufacturer’s boot-menu key earlier in the startup sequence. Select the entry that names the USB drive or optical disc, not the internal Windows drive. If the menu shows separate UEFI and legacy entries, choose the one corresponding to the media you created.
BitLocker requests a recovery key
This can be expected when WinRE starts on a protected volume. Stop and locate the correct recovery key before proceeding; repeatedly entering guesses can create additional lockouts. Organizations should follow their documented BitLocker-suspension and key-retrieval process.
The scanner cannot update
Continue with the available offline signatures if you must investigate immediately, but record that the database could not be updated. Connect supported wired or wireless networking inside the rescue environment and run its named update action before rescanning.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is a USB rescue drive better than a bootable CD or DVD?
For most current PCs, USB is the practical choice: it avoids dependence on an optical drive and supports the larger media requirements of modern rescue environments. Optical media is still useful for a machine that can boot discs but has unreliable USB support, or when you want write-once media that cannot be casually modified after creation.
Also popular on Amazon
| Consideration | USB | CD/DVD |
|---|---|---|
| Current hardware | Common on modern laptops and desktops | Requires an optical drive, which many newer PCs omit |
| Capacity | Comfortably exceeds the 250 MB legacy requirement and AVG’s 2 GB requirement when the correct drive is used | Use a blank disc supported by the image and the drive |
| Preparation risk | Creators commonly reformat the drive, so backup is mandatory | Blank media avoids deleting files already stored on a USB drive |
| Firmware choice | AVG requires a matching UEFI or BIOS build | The same firmware compatibility check still applies |
An empty 8 GB USB drive is a practical single-purpose choice because it exceeds both documented capacity thresholds, but capacity alone does not make an image bootable; the creator must write the rescue image correctly.
Frequently Asked Questions
Can I scan a Windows PC that has no working internet connection?
Yes. Defender Offline and the removable rescue environments are designed to start locally, so an internet connection is not required to begin a scan. Internet access matters for downloading the image beforehand and for retrieving newer ESET or AVG signatures after boot.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteHow long will an ESET or AVG rescue scan take?
Their official instructions do not publish a fixed duration. The elapsed time depends on the amount of storage selected and the number of files, so leave the machine powered until the report is complete rather than relying on Microsoft’s separate 15-minute estimate.
Will a rescue disk recover files encrypted by ransomware?
A rescue scanner can identify and remove malicious software, but the documented tools do not promise decryption of files already encrypted by ransomware. Preserve affected files and seek a tested backup or specialist recovery guidance before deleting anything.
Can I reuse the USB drive after creating rescue media?
You can use the drive for ordinary storage again only after recreating a normal partition and formatting it in Windows. That process erases the rescue image and any remaining data, so copy anything important before formatting.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
