How to clean an infected computer with Kaspersky Rescue Disk

Kaspersky Rescue Disk 10 is designed to scan and disinfect x86 and x64-compatible computers that have been infected. The application should be used when the infection is so severe that it is impossible to disinfect the computer using anti-virus applications or malware removal utilities running under the operating system. In this case, disinfection is more efficient because malware programs do not gain control when the operating system is being loaded. In the emergency repair mode, you can only start objects scan tasks, update databases roll back updates and view statistics.

STEP 1: Download Kaspersky Rescue Disk

http://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/kav_rescue_10.iso

Step 2: Download the Kaspersky USB Rescue disk maker

http://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/rescue2usb.exe

step 3: Connect a removable USB device to your computer

In order to successfully record Kaspersky Rescue Disk 10 to a removable USB device, the device must meet the following requirements:

·         The USB device must be low-level formatted before recording.

·         At least 256 MB USB capacity. 

·         FAT16 or FAT32 file system.

If NTFS file system is installed on the device, you are required to format it in FAT16 or FAT32. Do not use an USB device with other operating systems installed on it, otherwise booting from Kaspersky Rescue Disk may be incorrect or end up with an error.

1.Click Browse. 

2. Select the destination folder and click OK. 

3. To start the extraction, click Install. 

      After the work of the utility for recording is completed, the Kaspersky USB Rescue Disk Manager window will open. Select the destination for the downloaded Kaspersky Rescue Disk 10 image using the Browse button. Run the downloaded file rescue2usb.exe.

4. Select the required USB device from the drop-down menu.

5. Click START.

6. Wait until the process is complete.

7. Click OK on the open window informing that Kaspersky USB Rescue Disk has been successfully created.

Boot your computer from Kaspersky Rescue Disk 10

Restart your computer. After reboot, a message will appear on the screen: Press any key to enter the menu.

Press any key.

If you do not press any key in 10 seconds, the computer boots from hard drive automatically.In the start up wizard window that opens, select the graphic interface language using the cursor moving keys. Press the ENTER key on the keyboard.

Read carefully the license agreement of Kaspersky Rescue Disk. If you agree with all terms, press 1 on the keyboard. To reboot the computer, press 2. To shut down the computer, press 3.

Select one of the following start up methods:Kaspersky Rescue Disk. Graphic Mode loads the graphic subsystem.

Kaspersky Rescue Disk. Text Mode loads the text user interface represented by the Midnight Commander (MC) console file manager.

Boot from Hard Disk.

Press the ENTER key on the keyboard.

Once the actions described above have been performed, the operating system starts. It scans your computer for connected devices and searches for file systems of your local and removable disks. Once the operating system has started, you can start work with Kaspersky Rescue Disk 10. 

Scan in graphic mode

In order to start a scan process using Kaspersky Rescue Disk and remove malware from the computer, perform the following actions:

Boot your computer from Kaspersky Rescue Disk in graphic mode.

In the bottom left hand corner of the screen click on the kaspersky icon button and select Kaspersky Rescue Disk from the open menu.

Update antivirus databases of Kaspersky Rescue Disk. To do this, go to the My Update Center tab and click on the Start update button. You can find detailed instructions on how to configure Internet connection via the application interface in KB6327.

Wait until databases are updated.

Go to the Objects Scan tab.

Check the boxes next to objects to be scanned for viruses. By default, Kaspersky Rescue Disk scans Disk boot sectorsand Hidden startup objects.

Click on the Start Objects Scan button.

Once the scan process is complete and malicious objects are detected, the application will asks you to select the action to be performed with detected threats. You can select one of the following actions:

Disinfect. After an object is disinfected you will be able to work with it.

Quarantine. If the scan of quarantined objects after update option is enabled in the application settings, quarantined objects will be rescanned after each databases update and as soon as objects are disinfected they will be available to work with.

Delete. You can delete infected objects if disinfection fails. Info about deleted objects will be displayed in the report.