Secure boot

You can boot to a known-good rescue-system from a usb-stick or cd-rom or whatever, and use the tools there to scan your system.

Ofcourse this is only good if you trust your bios to actually load what you tell it to load, but that's true with secure boot too: if you don't trust your bios to load what you tell it to, then there's little reason to trust the same bios to correctly implement secure boot.