Kaspersky Rescue Disk is a free bootable tool from Kaspersky for scanning a Windows computer and removing malware without starting the installed operating system. It is meant for situations where an infection stops Windows from loading or blocks the antivirus already installed on the machine. The disk is a self-contained operating system that starts from a USB drive, a DVD or a network boot server. It runs on 64-bit PCs.
Working outside Windows
Malware that is active inside Windows can hide its files, lock the desktop or shut down security software. Kaspersky Rescue Disk avoids that by loading its own portable system. It reads the Windows drive as ordinary data, so the malicious code never runs. The environment also includes a file manager, a web browser and a terminal.
At startup a setup wizard asks for the interface language and the display mode. The full graphic mode is the normal choice. A limited graphic mode uses the same interface at a lower resolution for hardware that will not start the regular one. Once loading finishes, the scanner opens automatically.
Drives protected with BitLocker can be checked after they are unlocked. Before the system finishes booting, Kaspersky Rescue Disk detects encrypted partitions and asks for a password, a BEK key file or a recovery key for each one. A partition that is skipped, or one that is only partly encrypted, cannot be scanned.
Kaspersky Rescue Tool scanner
Kaspersky Rescue Tool, the main application on the disk, handles scanning and disinfection. It works only on computers that run Windows. Detection relies on the antivirus databases built into the disk image and, with an internet connection, on the Kaspersky Security Network cloud service.
The default quick scan covers system memory, startup objects and boot sectors. The scanner examines files of all formats, including the contents of archives. Changing the scan settings widens the scope. The user can add all mounted volumes for a full scan, or add individual folders one by one. Folder masks are not accepted.
When the built-in databases are out of date, the scanner can download fresh ones and save them to the computer’s hard drive. It can then use them after a restart. In the United States, database updates and Kaspersky Security Network may be unavailable in Kaspersky Rescue Disk.
Handling detected objects
For each infected or suspicious file, the results list shows its name, location and type of threat. It also shows a threat level marked high, medium or low. Expanding an entry reveals the file’s MD5 and SHA256 hashes. The tool proposes an action for every object, and the user can accept it or pick another:
- Skip leaves the file untouched.
- Copy to quarantine stores a safe copy while the original stays in place.
- Disinfect tries to clean the file; if that fails, the tool copies the file to quarantine and deletes it.
- Delete removes the file after saving a quarantine copy.
- Restore tries to bring back a clean version of the file from a backup.
A single neutralize command applies to every detection at once and works through disinfection, then restoration from backup, then deletion.
An active infection, meaning malware that is running, triggers a separate alert with a two-minute countdown. If nobody responds, Kaspersky Rescue Disk starts advanced disinfection. It follows this with a deeper scan of fileless objects, startup entries, the system drive, boot sectors and the EFI partition. The user can instead choose to disinfect without that extra scan.
Kaspersky Rescue Disk keeps quarantined copies encrypted, both inside the rescue environment and in a data folder on the Windows drive. The user can later restore a file removed by mistake or clear the quarantine.
Registry and USB repair utilities
A Tools tab in Kaspersky Rescue Tool holds three utilities. Windows Unlocker looks for lockers, programs that block access to Windows. It is intended for cases where the regular scan did not unlock the system. USB Recovery repairs registry settings so that keyboards, mice and other USB devices work again after a Kaspersky application was removed incorrectly. Both scan the Windows registry and list the keys they intend to change. Before making any change, they save those keys to a backup file, because a wrong edit can leave Windows unable to start.
The third utility, Registry Editor, opens the offline Windows registry for manual editing in a layout similar to the Windows editor. It can also export keys for later analysis. It is aimed at experienced users.
Boot media and saved settings
The Kaspersky Rescue Disk image can be written to a USB drive or a DVD. On networks with a PXE boot server, the disk can also start over wired Ethernet.
By default the portable system forgets its settings, including network configuration, every time it shuts down. On a USB drive, a persistent partition can hold application settings between sessions. Kaspersky Rescue Disk writes antivirus databases, reports and other temporary data to the computer’s hard drive instead.
For troubleshooting, a Hardware info tool reports on the PC’s components, and Kaspersky Rescue Tool keeps a performance report.
