A computer system uses a clean boot technique to protect against malware attacks. Upon certain detection of a malware infection, the computer system is configured to clean boot off of a fixed secure volume containing its own operating system and security software. The security software in the fixed secure volume is usable to remediate the malware attack by itself or by relying at least in part on security software installed in the infected volume.