Search for either toolkit and you get fifty download buttons on forty sites - and some of those copies have passengers. Here is how to get the genuine builds, every time.
Strelec and NHV Boot are distributed as big archives through file hosts, which makes them perfect targets for repacking - third-party sites re-upload copies with extra installers, miners or worse tucked inside. At the same time, genuine builds trigger antivirus warnings because of the admin tools inside them, which confuses everyone. Separate the two problems: source is your protection, and the antivirus behaviour has a boring explanation.
Sergei Strelec publishes from sergeistrelec.name and NHV Boot from nhvboot.com. Every other page on the internet is a mirror you cannot audit. The official pages link the authors' chosen file hosts, post the build's version and date, and - in Strelec's case - protect the archive with the well-known password strelec, which also stops casual tampering in transit. If a random site offers you a special installer EXE to get the file, close the tab.
These toolkits contain password reset utilities, low-level disk editors and remote access tools - exactly the categories antivirus products label as HackTool or riskware. A genuine build will collect such warnings; that is expected and is not, by itself, proof of infection. The danger is the opposite mistake: assuming every warning is harmless and running a repacked copy from an unknown site. Source first, then interpret warnings.
Create your rescue USB on a PC you trust, then keep that USB for rescue work only - not for carrying movies between random computers. If you use the USB inside an infected machine, rebuild or re-verify it afterwards before trusting it on the next client. A rescue toolkit is only as clean as the habits around it.
Extra browser toolbars after extraction, download managers you never asked for, or an archive that unpacks to a different size than the official page describes - any of these means the copy is not worth forensic effort. Delete it and download again from the official door. Five extra minutes of downloading beats one compromised client machine, as the full comparison video also stresses.
Boot speed, tools, drivers and the final verdict - the complete Strelec vs NHV Boot comparison, step by step.
▶️ Watch Full VideoThey are community-built rescue environments that bundle many commercial programs alongside free ones. Engineers worldwide use them for repair work on machines they own or are authorised to service. Licensing of the bundled software is ultimately your responsibility - for commercial support work, recovering a client's own system and data is the intended use.
Two practical reasons: antivirus products cannot casually delete the admin tools inside during download, and the published password acts as a basic authenticity check. The password is printed on the official site and in the version notes.
Rebuild the USB from the original official archive. If you maintain a dedicated rescue machine, you can exclude that one USB drive from scanning - but only for a USB you built yourself from the official source, never for files from mirror sites.