Hardware FixRecommendedDevice not working? Your driver may be the problemCheck updates for common hardware issues.Fix DriversOctober DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix Now×
Skip to content
World desk3 min

How to Scan for Rootkits with a Bootable Rescue Disk

Microsoft Defender Offline scans supported Windows PCs outside the normal Windows session. Here’s how to run it, prepare for restart, and use bootable media on older Windows versions.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

On supported Windows 10 and Windows 11 PCs, you usually do not need to make a separate rescue disk: run Microsoft Defender Offline from Windows Security. It restarts the PC into Windows Recovery Environment (WinRE) and scans outside the normal Windows session. A bootable USB or disc is mainly relevant to the documented Microsoft workflow for Windows 7 SP1 and Windows 8.1, or when another vendor’s rescue tool is appropriate.

What an offline scan can—and cannot—tell you

Rootkits can try to hide from security tools running inside Windows. Microsoft Defender Offline starts from a trusted environment outside the normal Windows kernel, allowing it to target malware that may interfere with an in-session scan, including rootkits and malware that infects or overwrites the master boot record (MBR). Microsoft says, “The protection for Microsoft Defender Offline Scan focuses on firmware and rootkits.” That describes its focus, not a promise that it will detect every rootkit or certify a PC as clean.

As an Amazon Associate I earn from qualifying purchases.

Microsoft documents the scan for x64 Windows 11, x64 and x86 Windows 10, Windows 8.1, and Windows 7 SP1. It does not apply to ARM versions of Windows 10 or Windows 11, or to Windows Server SKUs. Check the current Microsoft Defender Offline documentation for compatibility and instructions that match your system.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Run Microsoft Defender Offline on Windows 10 or 11

On supported Windows 10 and Windows 11 systems, start the offline scan from Windows Security rather than creating separate media.

#1 Best Overall
64GB Bootable USB Installer for Windows 11, 10 & 7 Home/Pro with WinPE Repair Tools
  • [Win OS Install or reinstall] — Boot from the USB to install or reinstall Win 11, 10, or 7 Home & Pro editions. Includes OS installations and reinstallations media plus WinPE Utility Suite.
  • [WinPE Repair & Recovery Tools] — Boot into the included WinPE utility suite to backup system and important files, troubleshoot startup problems, repair boot issues, recover data, recover Win User accounts password, and diagnose common PC problems.
  • [All-in-One PC Rescue USB] — Combines Win 11, 10, and 7 installation media with PC repair, recovery, and diagnostic tools on one bootable 64GB USB drive, helping you troubleshoot and restore a computer without needing multiple discs or downloads.
  • [Support] — Full instructions are included in packaging plus a printable copy of the instructions with troubleshooting information on the device. Also, a video “How to boot from a bootable USB drive.mp4” to help guide you through starting a PC from a USB drive. If you need help using the USB please contact us for assistance, we are here to help.
  • [Video] - If you are new to booting from a USB drive or need a refresher see our video "How to boot from USB drive" both in description and on USB device.
  1. Save open work. The scan requires a restart.
  2. Open Windows Security and go to Virus & threat protection → Scan options.
  3. Select Microsoft Defender Offline scan, then choose Scan now.
  4. Allow the PC to restart. The scan runs in WinRE without loading the usual Windows session, then the PC restarts again when it is complete.
  5. After Windows starts, open Windows Security → Virus & threat protection → Protection history to review the result.

Microsoft’s user-facing steps are also on its Microsoft Defender Offline support page.

Check BitLocker, WinRE, and antivirus prerequisites

Before you trigger the restart, check these conditions if they apply to your PC:

Rank #2
Tech Core 31-in-1 Multi-Boot USB Toolkit for IT Pros
  • Supports UEFI and Legacy BIOS boot on many PCs and laptops. If boot issues occur, check Secure Boot settings and use the included boot instructions.
  • Complete All-in-One Dual USB-A & USB-C System Toolkit – boot, repair, recover, reinstall, reset forgotten Windows or Linux passwords, restore files, access locked systems, run LIVE/install best Linux OS systems - all from one ultra-fast 128 GB USB 3.0 drive loaded with premium Linux and Windows utilities.
  • Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
  • Powered by the most powerful Multi-Boot Manager – easily launch dozens of OS and recovery tools without reformatting. Works with laptops, desktops, mini-PCs, Windows tablets and other modern USB-C devices — no adapters or setup required.
  • Includes 31+ OS & Utilities (x86-64 & ARM64) – Linux Ubuntu, Kali, Mint, Tails, retro-gaming emulator - Batocera (ready to play), Garuda, Fedora, openSUSE, Solus, CAINE Digital Forensics, 3D printing and engineering Linux OS, Windows Installers, DriverPacks, Antivirus Rescue Disks, and much more!
  • BitLocker: If it protects the system drive, suspend BitLocker protection before the scan or have the recovery key ready in case Windows asks for it after restart.
  • WinRE: The offline scan needs Windows Recovery Environment enabled. In an administrator Command Prompt, run reagentc /info to check its status. If it is disabled, Microsoft documents reagentc /enable to enable it.
  • Defender’s role: Microsoft says Microsoft Defender Antivirus must be the primary antivirus, rather than running in passive mode.
  • Administrator access: Local administrator privileges are needed to receive offline scan updates.

These prerequisites and commands are described in Microsoft’s technical documentation.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use bootable media for the documented Windows 7 or 8.1 workflow

Microsoft’s instructions for Windows 7 SP1 and Windows 8.1 use bootable rescue media. Create it on a PC that is not infected, since malware on the affected system could interfere with making the media. The Microsoft-documented process is:

Rank #3
Penguin 31-in-1 Multi-Boot USB Toolkit for PC
  • Complete All-in-One Dual USB-A & USB-C System Toolkit – boot, repair, recover, reinstall, reset forgotten Windows or Linux passwords, restore files, access locked systems, run LIVE/install best Linux OS systems - all from one ultra-fast 128 GB USB 3.0 drive loaded with premium Linux and Windows utilities.
  • Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
  • Powered by the most powerful Multi-Boot Manager – easily launch dozens of OS and recovery tools without reformatting. Works with laptops, desktops, mini-PCs, Windows tablets and other modern USB-C devices — no adapters or setup required.
  • Includes 31+ OS & Utilities (x86-64 & ARM64) – Linux Ubuntu, Kali, Mint, Tails, retro-gaming emulator - Batocera (ready to play), Garuda, Fedora, openSUSE, Solus, CAINE Digital Forensics, 3D printing and engineering Linux OS, Windows Installers, DriverPacks, Antivirus Rescue Disks, and much more!
  • Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
  1. On a clean PC, obtain the Microsoft Defender Offline tool and create CD/DVD or USB media using Microsoft’s instructions.
  2. If using USB, back up the drive first. Creating the rescue media reformats it and erases existing data; use a blank or expendable USB flash drive.
  3. Insert the media in the affected PC and start the PC from it. Depending on the device’s firmware settings, you may need to open its boot-device menu or change the boot order.
  4. Let the tool scan the computer. When it finishes, remove the media and restart the PC.

Use the steps in Microsoft’s current Defender Offline documentation rather than assuming an old download or boot-menu key still applies to your device.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Consider another vendor’s rescue environment carefully

Other vendors describe bootable environments intended to scan or clean a computer outside its installed operating system, but the cited help pages do not establish current availability or support for every recent PC.

Rank #4
Hiren’s BootCD PE Recovery & Diagnostic Bootable USB Flash Drive
  • 🧰 All-in-One Recovery Solution: Includes the latest Hiren’s BootCD PE preinstalled with powerful diagnostic and recovery utilities.
  • ⚙️ Repair & Troubleshoot Any PC: Fix boot issues, recover data, clone drives, remove viruses, and reset forgotten Windows passwords.
  • 💾 Plug & Play Bootable USB: No installation required. Simply plug into your computer, boot from USB, and start recovering immediately.
  • 🚀 Fast & Reliable Performance: Professionally tested 3.0 USB flash drive ensures quick load times and long-term durability.
  • 💡 Compatible with Most Systems: Works with desktops, laptops, and all major Windows versions (XP, 7, 8, 10, 11).
  • Kaspersky Rescue Disk: Kaspersky describes it as a tool for scanning and disinfecting infected computers that cannot be disinfected by other methods. Its cited page is for an older product version: Kaspersky’s Rescue Disk description.
  • ESET SysRescue Live: ESET’s older product help describes bootable CD/DVD/USB media that can scan for malware and clean infected files independently of the host OS, with direct access to the disk and file system. The page does not establish present-day download availability or compatibility with every new device: ESET SysRescue Live help.

When assessing any rescue tool, check whether it runs outside the installed OS, supports your operating system and processor architecture, can obtain current security definitions, requires bootable media, and is still maintained by its vendor. Also account for encryption recovery and firmware boot settings. The cited vendor pages provide intended-use descriptions, not independent comparative detection-rate tests, so they do not support ranking the tools by effectiveness.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.