[KB3509] How do I use ESET SysRescue Live to clean my computer?

Issue

Create a rescue USB or CD/DVD
Scan and clean your system
Erase a rescue USB

Details

Click to expand

ESET SysRescue Live is a free utility that you can use to restore your computer if it is damaged by malware or other threats. If you are experiencing a persistent malware issue, you can boot from a "rescue disk" that you have created directly into ESET SysRescue Live and use the utility to scan and clean your system.

System requirements

Microsoft Windows 10*, 8.1, 8, 7, Vista, XP, 2000
Microsoft Windows Server 2000, 2003 (x86 and x64), 2008 (x86 and x64), 2008 R2, 2012, 2012 R2
Microsoft Small Business Server 2003, 2008, 2011

* ESET SysRescue has been tested with Windows 10 but is not officially supported. It should work in most cases, but you may experience some unreported issues with your system.

Solution

Create a rescue USB or CD/DVD

USB flash drive data will be erased

This procedure will erase any data saved to your rescue USB flash drive. Back up any existing data before you begin.

Download the ESET SysRescue Live .IMG file if you plan on making a rescue USB flash drive, or download the .ISO file if you plan on making a rescue CD or DVD.

.IMG file recommended

If you use the .ISO file to make a rescue USB flash drive, it will not be able to save any download updates. For this reason, we recommend using the .IMG file for creating a rescue USB flash drive.
- To create an ESET SysRescue Live media on which you can update the Detection Modules whenever you use it with a computer connected to the internet, download the .img image file.
To burn a disc image, right-click the downloaded ISO image in Windows file explorer, select Burn disc image and follow the on-screen instructions.
- Use a free third-party software to create a rescue USB flash drive. There are several free utilities available on the internet, such as Rufus, UNetbootin or Universal USB Installer, among others.
On a Linux machine, you can use the dd command in a terminal window:
```
sudo dd if=/path/to/eset_sysrescue_live_enu.iso of=/dev/sdb bs=4M && sync
```
In the command above replace path/to/eset_sysrescue_live_enu.iso with the real path leading to the downloaded .iso image file. /dev/sdb is the path leading to the inserted rescue USB. Use the sudo fdisk -l command in a terminal window to double-check the path of the inserted rescue USB.

Scan and clean your system

With your computer powered off, insert your rescue USB flash drive (if you do not have one, see Create a rescue USB or CD/DVD) and power on the computer. If you are using a CD/DVD, insert it as soon as the computer is powered on. ESET SysRescue Live may start automatically. If it does not, follow any prompts to boot from removable media during startup.

Booting from removable media

Most computers are configured to look for bootable media like your rescue disk and will ask if you want to boot from this media during startup.

If ESET SysRescue does not open, and you do not receive a prompt to boot from your rescue USB flash drive or CD/DVD during startup, you will need to change the boot sequence on your computer to use ESET SysRescue. On most computers, you can access these settings by pressing one of the function keys (F8-F12), or the ESC key during startup. Contact your system manufacturer for more detailed instructions.

If your computer has a Windows 8.x or Windows 10 operating system, it probably uses UEFI mode to start the operating system. To use ESET SysRescue, switch to Legacy BIOS mode first.

Select Run ESET SysRescue using the arrow keys and press the Enter key.

Figure 2-1
Click the image to view larger in new window
Read the ESET License Agreement, select your preferred option from the Live Grid and Potentially Unwanted Applications drop-down menus and then click I accept the terms in the License Agreement if you agree to the terms.

Figure 2-2
Click the image to view larger in new window
Click Update → Update virus signature database. ESET SysRescue will download the latest detection modules (If you do not have an active internet connection, skip to step 5).

Figure 2-3
Click the image to view larger in new window

Cannot update virus signature database?

If you cannot update detection engine with internet connection available, clear the update cache:

Press F5 to open the ESET SysRescue preferences window.
Click Update, then click Clear (see the figure below) and close the window.
Run Update virus signature database again as described in step 4.

Figure 2-4

If you still cannot update, try to update at a later time.

Click On-demand scan → Custom scan.

Figure 2-5
Click the image to view larger in new window
Select In-depth scan from the Scan profile drop-down menu, select the check box next to Computer in the Scan targets window and then click Scan. ESET SysRescue will scan your system and clean infected files. If infected files that cannot be cleaned are found, you will be prompted for the action to take with these files.

Figure 2-6
Click the image to view larger in new window

RAID partitions

The scanning options are configured to scan the /media folder that includes mounted discs. If RAID partitions are not recognized, mount them manually.

ESET SysRescue Live may not be able to clean detected threats in Windows Vista 64-bit, and Windows 8/8.1/10. Due to the file-system architecture of these operating systems, especially when the operating system is hibernated, ESET SysRescue Live cannot clean threats detected during scanning.

Erase a rescue USB flash drive

You can erase SysRescue data from a rescue USB flash drive if it is no longer needed and you want to use the rescue USB drive for other applications.

Click the folder icon in the Start Menu bar, or press the Windows key + E keyboard shortcut to open Windows file explorer.
In the left hand menu, right-click your USB key.
Select Format.
Change the value of Volume label field to rename your rescue USB for easier identification if needed.
Click Start.

Need Assistance in North America?

If you are a North American ESET customer and need support regarding ESET SysResue Live, visit the ESET Forums.

If you have a malware issue and need help with ESET SysRescue Live, visit helpus.eset.com to chat with a live technician, view product documentation or schedule a consultation with an ESET Home Adviser.

Last Updated: Dec 28, 2022