Antivirus Live CD hardens its own scanner against the malware it's meant to clean
The latest build of the 4MLinux fork ships ClamAV 1.5.4, closing eight vulnerabilities across exactly the file types rescuers are most likely to scan.
When your Windows installation won't boot, the antivirus sitting on that drive is pretty useless. So is anything you launch from within an OS you can no longer trust. That's the whole logic behind Antivirus Live CD, a free open-source rescue tool.
The newest build is worth a look for reasons beyond the usual version bump. Released today, version 53.0-1.5.4 rides on a fully rebuilt 4MLinux base and bundles ClamAV 1.5.4, a patch release that shut eight security holes. For a program whose only job is scanning infected machines, that timing is arguably on point.
Antivirus Live CD is a fork of the tiny Polish distro 4MLinux. It doesn't try to be a full recovery suite. It boots, mounts every partition it can find, and runs ClamAV against them. Keep in mind that it reads Windows file systems (NTFS, FAT32) just as happily as Linux ones, so a mixed or multi-boot machine isn't a problem.
Hardened against its own threat model
The interesting part is what's inside. ClamAV 1.5.4 is primarily a security patch, and the eight CVEs it closes live in the very parsers that matter here.
There's a ZIP catalog flaw that could write past a heap allocation while indexing file headers. A ZIP ownership bug can trigger an invalid free. There's a GPT parsing problem, two PDF bugs, and Mach-O flaws that could crash the engine outright. An integer overflow in the PE unpacker, broken size handling in XAR archives, and an UnRAR fix that stops files escaping the scan directory round out the list.
These are the flaws an attacker would actually ship inside a malicious archive or document. A rescue tool that inspects those artifacts is now shielded against attacks delivered through them. Most antivirus tools don't fuss much about their own scanner being exploitable. The theory is that you'd only run it on a machine you're trying to clean. This build apparently disagreed.
Per ClamAV's own table, 1.5.4 maps to FLEVEL 234. It follows 1.5.2 (the build from August's 52.0 release) and trails the parallel ClamAV 1.4.6 maintenance release by a few fixes. If you're on the older branch, that one still carries six of the eight CVEs.
The underlying core is just as modern. Version 53.0 runs Linux kernel 6.18.43, glibc 2.44, BusyBox 1.38.0, and GCC 16.1.0 for x86_64. That stack was hand-built from source, so these versions aren't tied to any single distro vendor's release calendar. 4MLinux skips apt and dnf entirely. Software ships as self-contained addon archives that the system rebuilds from a tiny core on every boot, under the lightweight JWM window manager.
The hardware bar is genuinely low. 4MLinux runs live on roughly 1,024 MB of RAM and installs to disk on as little as 128 MB, which keeps it useful as a life-extender for ten-year-old laptops. A small script called zk even installs or updates addons in a single command.
The 53.0 cycle is still finishing up. Core BETA landed August 24, the full BETA went out September 28, and STABLE is targeted for November 2026. This build previews that base a few weeks early while already shipping current security fixes.
Getting it running
The project has been on SourceForge since June 2012 and carries the platform's Open Source Excellence badge, which requires 100,000+ total downloads. It's still moving. Roughly 176 downloads a week, current ISO at 208.2 MB.
User ratings hover at a clean 5.0 out of 5. A PC repair tech named bert76 flagged back in 2016 that it's "light and powerful," noting it "works very well" even if it isn't as exhaustive as Bitdefender or Kaspersky rescue disks. He praised the step-by-step manual while conceding the command-line interface can feel "old school" to newcomers.
It's a rather honest set of reviews. The tool isn't trying to be consumer-grade, and that shows. It's not going to replace a full Windows antivirus install. It's a rescue disk, after all.
Download the ISO from the project's SourceForge page or the 4MLinux site, then write it to a USB stick with UNetbootin or Ventoy. Both are officially supported, and a 4 GB drive is plenty. The image is a hybrid, so it boots on both BIOS and UEFI.
Boot the target machine from that media, connect to a network, and let freshclam pull the latest signatures before you scan. Every partition auto-mounts at /mnt, so a recursive clamscan -r /mnt covers everything. Infected files come back with full paths, ready to delete or move to quarantine.
Two caveats. The environment is command-line oriented, so expect a learning curve if you've never touched a terminal. ClamAV also won't beat sophisticated registry-hidden rootkits the way a dedicated Windows rescue build might, since it's signature-based by nature.
The maintainer is Zbigniew Konojacki, who publishes online as zk1234. He's run this project since 2010, distributing it free under GPLv3 and funding downloads through optional donations.
Head here to pull the ISO from the SourceForge project page and here to the 4MLinux homepage.
