Some infections survive every scanner you run inside Windows — because the malware is awake, hooked into the system, and actively hiding. An offline scan from NHV Boot attacks it while it sleeps: the infected Windows never starts, so nothing can defend itself.
Rootkits and boot-level malware are designed around one assumption: that you will fight them from inside the Windows they control. Boot NHV Boot instead, and the fight changes completely. The toolkit's WinPE runs from your USB stick, the infected installation sits on the disk as inert files, and the antivirus tools bundled in NHV Boot can read, scan and quarantine things that are normally locked, hidden or protected by the malware itself. The technique is old, professional and still the correct first move for a seriously infected machine. Here is how to do it without the two classic mistakes: stale definitions and stopping at the scan.
When Windows is running, advanced malware runs with it — injecting into system processes, hiding its files from directory listings, and restoring itself when a scanner deletes one copy. From NHV Boot's WinPE, none of that machinery is alive. The drive is just data. Files that were locked become readable, hidden files become visible, and a scanner can remove every copy of a threat at once because nothing is running to put it back. This is the same reason every serious rescue toolkit, NHV Boot included, carries security tools for use before Windows ever boots.
An antivirus is only as good as its definitions, and definitions baked into a downloaded build age from the day the build was published. NHV Boot makes this step easy: its WiFi connection interface is fast and modern, with drivers for current chipsets. Boot the PE, connect to a trusted network, open the security tools on your build and let them update before scanning anything. Skipping this turns an offline scan into a scan with last season's knowledge — the newest threats, the ones most likely to have infected the machine recently, are exactly the ones an old definition set misses.
Select the Windows partition of the infected machine as the target — and double-check you have the right one, because drive letters shift inside WinPE; identify it by size, label and the presence of a Windows folder. Choose a full scan, not a quick scan: the point of being offline is thoroughness. When threats are found, prefer Quarantine over immediate deletion where the tool offers it — quarantine is reversible if a detection turns out to be a false positive on some old utility, which happens often enough with technician tools. Let the scan finish even if it takes an hour; interrupting a half-cleaned infection leaves the worst of both worlds.
Removing malware does not repair the holes it left. Boot the real Windows and immediately check system file health. Open Command Prompt as administrator and run:
sfc /scannow — repairs protected Windows system filesDISM /Online /Cleanup-Image /RestoreHealth — repairs the component store SFC depends on, if SFC reports unfixable errorsAlso review startup items and scheduled tasks the infection may have left behind, and restore any browser settings it hijacked.
Three truths to end with. First, a clean scan means no known threats were found — it is not a mathematical proof the machine is pure, which is why the in-Windows second scan matters. Second, if the infection was ransomware, no scan decrypts your files; recovery there means backups or the incident-response route. Third — and most skipped — if malware ran on that PC, assume it saw the passwords used there. Change important passwords from a clean device, starting with email and banking, and turn on two-factor authentication. The scan cleans the machine; only you can clean the accounts.
Editions, USB creation, first boot and the full tool tour — everything in this guide, shown live on real machines.
▶️ Watch Full VideoThe bundled security tools vary between builds — the toolkit is updated regularly and tool line-ups rotate. Check the security or antivirus category on your own build after booting it, and always update definitions before trusting a scan result.
For an active, stubborn infection, yes — the malware cannot defend itself while Windows is off. For everyday protection, no: your installed antivirus with real-time protection prevents infections that a one-time scan can only clean up afterwards.
Then malware was probably not the whole story. Check disk health with CrystalDiskInfo, RAM with MemTest64 (both in NHV Boot), and temperatures and startup load inside Windows. Slowness has many causes; the scan honestly ruled out one of them.