Home article search

How do I use ESET SysRescue Live to clean my computer?


System requirements

  • Microsoft Windows 10*, 8.1 , 8, 7, Vista, XP, 2000
  • Microsoft Windows Server 2000, 2003 (x86 and x64), 2008 (x86 and x64), 2008 R2, 2012, 2012 R2
  • Microsoft Small Business Server 2003, 2008, 2011 

* ESET SysRescue has been tested with Windows 10 but is not officially supported. It should work in most cases, but you may experience some unreported issues with your system. 


ESET SysRescue Live is a free utility that you can use to restore your computer if it is damaged by malware or other threats. If you are experiencing a persistent malware issue, you can boot from a "rescue disk" that you have created directly into ESET SysRescue Live and use the utility to scan and clean your system.


Create a rescue USB or CD/DVD

Scan and clean your system

Erase a rescue USB


 Create a rescue USB or CD/DVD

USB flash drive data will be erased

This procedure will erase any data saved to your USB flash drive. Back up any existing data before you begin.

  1. Download ESET SysRescue Live .iso image file.
  2. To burn a disc image, right-click the downloaded ISO image in Windows file explorer, select Burn disc image and follow the on-screen instructions.

    Use a free third-party software to create a Live USB. There are several free utilities available on the internet, such as Rufus, UNetbootin or Universal USB Installer, among others.
  1. On a Linux machine, you can use the dd command in a terminal window:

    sudo dd if=/path/to/eset_sysrescue_live_enu.iso of=/dev/sdb bs=4M && sync

    In the command above replace path/to/eset_sysrescue_live_enu.iso with the real path leading to the downloaded .iso image file. /dev/sdb is the path leading to the inserted USB key. Use the sudo fdisk -l command in a terminal window to double-check the path of the inserted USB key.



Scan and clean your system

  1. With your computer powered off, insert your rescue USB (if you do not have one, see Create a rescue USB or CD/DVD) and power on the computer. If you are using a CD/DVD, insert it as soon as the computer is powered on. ESET SysRescue Live may start automatically. If it does not, follow any prompts to boot from removable media during startup.

Booting from removable media

Most computers are configured to look for bootable media like your rescue disk and will ask if you want to boot from this media during startup.

If ESET SysRescue does not open and you do not receive a prompt to boot from your rescue USB or CD/DVD during startup, you will need to change the boot sequence on your computer to use ESET SysRescue. On most computers, you can access these settings by pressing one of the function keys (F8-F12), or the ESC key during startup. Please contact your system manufacturer for more detailed instructions.

If your computer has a Windows 8.x or Windows 10 operating system, it probably uses UEFI mode to start the operating system. To use ESET SysRescue, switch to Legacy BIOS mode first.  

  1. Select Run ESET SysRescue using the arrow keys and press Enter.

Figure 2-1
Click the image to view larger in new window

  1. Read the ESET License Agreement, select your preferred option from the Live Grid and Potentially Unwanted Applications drop-down menus and then click I accept the terms in the License Agreement if you agree to the terms.

Figure 2-2 
Click the image to view larger in new window

  1. Click Update Update virus signature database. ESET SysRescue will download the latest detection modules (If you do not have an active internet connection, skip to step 5).

Figure 2-3
Click the image to view larger in new window

Cannot update virus signature database?

If you cannot update virus signature database with internet connection available, clear the update cache:

  1. Press F5 to open the ESET SysRescue preferences window.
  2. Click Update, then click Clear (see the figure below) and close the window.
  3. Run Update virus signature database again as described in step 4.

If you still cannot update, try to update at a later time.

  1. Click On-demand scanCustom scan.

Figure 2-4
Click the image to view larger in new window

  1. Select In-depth scan from the Scan profile drop-down menu, select the check box next to Computer in the Scan targets window and then click Scan. ESET SysRescue will scan your system and clean infected files. If infected files that cannot be cleaned are found, you will be prompted for the action to take with these files.

Figure 2-5 
Click the image to view larger in new window

RAID partitions

The scanning options are configured to scan the /media folder that includes mounted discs. If RAID partitions are not recognized, mount them manually.

ESET SysRescue Live may not be able to clean detected threats in Windows Vista 64-bit, and Windows 8/8.1/10. Due to the file-system architecture of these operating systems, especially when the operating system is hibernated, ESET SysRescue Live cannot clean threats detected during scanning.



Erase a rescue USB

You can erase SysRescue data from a USB flash drive if it is no longer needed and you want to use the USB flash drive for other applications.

  1. Click the folder icon  in the start menu bar, or press + E  keyboard shortcut to open Windows file explorer.
  2. In the left-hand menu, right-click your USB key.
  3. Select Format.
  4. Change the value of Volume label field to rename your USB key for easier identification if needed. 
  5. Click Start.

Need Personalized Assistance in North America?

If you're not already an ESET customer, ESET Support Services are available to clean, optimize and secure your system. Call 866-944-3738 or click to schedule an appointment with ESET Support Services today!


Was this information helpful?