The nastiest malware survives because it is already running when your antivirus starts - it hides its files, blocks scanners and re-installs itself. An offline rescue scan turns that fight upside down: Windows never starts, the malware never wakes up, and the scanner walks through its files while it sleeps.
If the installed antivirus says the PC is clean but pop-ups, redirects and strange behaviour continue, do not argue with it from inside the same infected Windows. Boot an antivirus rescue disk from your Ventoy USB instead. The rescue disk runs its own small system, mounts the Windows drive as plain data, and scans it with no interference. This guide covers the preparation, the scan itself, and the honest limits of what any scan can promise.
Rootkits and persistent malware defend themselves in three ways: they hide their files from Windows, they interfere with security software, and they watch for removal attempts and undo them. All three defences need the malware to be running.
In an offline scan none of that exists. The infected Windows is just a folder tree on a disk. Files cannot hide from a system that reads the disk directly, nothing is locked because nothing is open, and deleting a malicious file is final - there is no watchdog process to restore it. That is the entire trick, and it is a genuinely big one.
Shortcut worth knowing: Windows itself has a built-in offline scan - Microsoft Defender Offline, found in Windows Security under scan options. It reboots the PC into a scanning environment without any USB at all, and is a reasonable first move when you have no toolkit handy.
Boot Windows and run a second, different scanner - your installed antivirus plus its own full scan. One engine calling a PC clean is an opinion; two engines agreeing is evidence. Then update Windows and the browser, and remove any strange browser extensions and unknown start-up programs you find.
If money was involved - banking pop-ups, fake support calls, remote-access tools you did not install - change important passwords from a different, clean device, not from the PC you just cleaned.
No scanner can prove a PC is 100 percent clean; it can only say it found nothing it recognises. Deeply embedded infections, compromised firmware and stolen credentials are all outside a scan's reach. When the infection was severe, or the PC handles banking and business data, the genuinely safest ending is: rescue the documents with the live Linux method, then do a clean Windows installation and restore only the data. A scan is the right first attempt - it is not a certificate.
Watch the video to see the antivirus seat of the rescue toolkit used on an infected machine - and how the offline scan is run from the Ventoy menu.
▶️ Watch Full VideoYes, the well-known ones are. Vendors such as Kaspersky and ESET publish their rescue disks free of charge on their official websites - you do not need a paid subscription to boot and scan with them.
Run a second engine's full scan from inside Windows, check start-up programs and browser extensions, and fully update Windows. If the behaviour survives all that, treat it as a deep infection - rescue the data and clean-install Windows.
The scan itself only reads. Damage can only occur indirectly: if an infected system file has to be deleted, Windows may fail to boot until that file is repaired - which is why you rescue important data first whenever the disk allows it.