What Is a Rootkit Virus Scan and Why Do You Need It?

A rootkit virus scan is a check for rootkits, malicious software that hides itself or other malware and keeps privileged access to a computer. Because an active rootkit can fool tools running inside the infected system, the most reliable scans run from a trusted environment, such as Microsoft Defender Offline, which scans before Windows loads.

Key Takeaways

• A rootkit is a collection of software that gives unauthorized access to a computer and usually hides its own presence, according to Wikipedia’s rootkit article.
• Rootkits run at different levels: user mode, kernel mode, bootkits, hypervisor level and firmware.
• Scanning from outside the running operating system is the most reliable detection method, because a rootkit cannot hide when it is not running.
• On Windows 10 (version 1607 or newer) and Windows 11, Microsoft Defender Offline is built into the Windows Security app.
• If a kernel rootkit is confirmed, reinstalling the operating system from trusted media is often the safest fix; firmware rootkits may survive even that.

Keeping up to speed with technology means that you will have to stay informed not only about all the useful developments that could be of help, but also about all the malicious software that you need to stay clear of.

I suppose that you are already aware of the general purpose of malicious software. If nothing else, you know that it needs to be avoided.

While on the topic of malicious software, there is one type of malware, often loosely called a virus, that you need to know about. It is called a rootkit and it is a collection of software designed to give an attacker access to a computer or system that would not otherwise be allowed, while hiding that access from the owner.

Simply put, it puts the other person in control, which can certainly be detrimental for the attacked system.

You are now probably wondering how your computer or a different system could get infected with this malware. Rootkits usually arrive through a security vulnerability that lets the attacker gain higher privileges, through a Trojan horse program that tricks you into installing it, or through malicious websites and infected USB drives.

The best thing to do would be to be careful about the sites you are visiting and the software you are downloading to your system, because once the rootkit settles in, getting rid of it can get pretty difficult.

In other words, prevention is better than the cure. Yet, this doesn’t mean that everything will immediately get lost in case your system gets infected. If you are persistent, determined and knowledgeable enough, you might manage to clean your computer up and get rid of the virus, but keep in mind that it can be difficult.

I am sure that you have already heard a few things about this particular malware and the difficulty of getting rid of it, so here’s my question. Have you heard about a rootkit virus scan yet?

If not, then it is about time you learned more about it. After all, this kind of scan is often your best chance of finding an infection that ordinary tools miss. So, let us check out what it is.

If you want more info about the rootkit in general, start here: https://en.wikipedia.org/wiki/Rootkit

What Is A Rootkit Virus Scan?

You are probably now thinking that I am talking about a specific program that can detect this malware and then remove it from your computer in an instant. That is not quite the case: a rootkit virus scan is a scan by an anti-rootkit tool or an antivirus offline scan that looks specifically for hidden code, and no single program can promise instant removal.

As we have already established, rootkits are very difficult to detect. A rootkit that is running can hide files, processes and registry entries from tools that run inside the same system, which is why scanning from outside the running system works better.

Still, what you can do is be very observant towards the behavior of your computer in order to check whether there is any malware lurking.

If you notice that the system is getting extremely slow or that certain processes aren’t running smoothly, you wouldn’t be wrong to suspect malware. Of course, you can always find a good rootkit scanner and use it to detect the virus. What is it that you can do then?

For starters, you can use some of the “clean-up” tools that are made by your anti-virus vendors. It’s important to understand, though, that rootkit is a lot smarter than your average virus, meaning that these tools might not be able to remove it completely. As you can see here, however, that doesn’t mean that you won’t be able to do absolutely nothing about it.

The most reliable thing to do if a deep (kernel-level) rootkit is confirmed is to back up your personal files and wipe the drive of your computer of all of its contents. Consequently, you will also need to reinstall the whole operating system and all the programs that you were using previously.

In case you aren’t sure you can do all of this on your own and succeed in getting rid of the malware, I suggest you find a professional to do it for you. A professional can also check whether the rootkit lives in firmware, where even a wipe and reinstall may not remove it.

Why Do You Need It?

If you are wondering why on Earth you would need a rootkit virus scan, then you are definitely still not familiar enough with this particular malware.

The bottom line is that a rootkit is stealthy, hard to see with normal tools and can be extremely harmful, because it can hide password-stealing keyloggers, viruses and remote-access backdoors. In short, that means that you should perform scans in order to ensure that you are staying protected and to detect the malicious threat should it infect your system, so that you can remove it.

What Is a Rootkit?

A rootkit is malicious software that gives an attacker privileged access to a computer and hides that access. The name combines “root”, the traditional name of the administrator account on Unix-like systems, with “kit”, the set of software components that does the work.

Modern rootkits are mostly used to hide another payload. Wikipedia’s rootkit article lists common uses: a backdoor for the attacker, concealing keyloggers and viruses, and turning the computer into a “zombie” in a botnet that sends spam or launches denial-of-service attacks.

A short history of rootkits

• 1990: Lane Davis and Steven Dake wrote the earliest known rootkit, for Sun Microsystems’ SunOS UNIX.
• 1999: NTRootkit, created by Greg Hoglund, was the first malicious rootkit for Windows NT.
• 2005: Sony BMG music CDs silently installed a rootkit as part of their copy protection; software engineer Mark Russinovich discovered it, and the company eventually recalled the CDs.
• 2010: the Stuxnet worm, which targeted Iran’s nuclear facilities, used a Windows kernel-mode rootkit to hide its files and processes.

Types of Rootkits

Rootkits are grouped by how deep in the system they run. The deeper the level, the harder the rootkit is to detect and remove.

How Does a Rootkit Scanner Find Hidden Malware?

Rootkit scanners combine several detection methods, because each one has gaps.

• Scanning from a trusted medium: the computer is started from a separate, clean environment (a rescue USB drive or a recovery environment), so the rootkit is not running and cannot hide.
• Signature scanning: looks for code patterns of known rootkits; effective against well-known ones, weaker against custom-built ones.
• Difference scanning: compares what the system reports with the raw data on the disk or in memory; a mismatch suggests something is being hidden.
• Integrity checking: verifies digital signatures and checksums of system files and drivers.
• Behavioral detection: watches for rootkit-like activity, such as unusual CPU use or network traffic; this method produces more false alarms.
• Memory dump analysis: examines a snapshot of memory for hidden processes, mostly used by specialists.

How to Run a Rootkit Scan on Windows

Microsoft Defender Offline is the built-in rootkit-capable scan on Windows. According to Microsoft, it runs from outside the normal Windows kernel, so it can target malware such as rootkits that infect or overwrite the master boot record. It is built into Windows 10 version 1607 or newer and Windows 11.

1. Save your work, because the computer will restart.
2. If BitLocker is turned on for the system drive, suspend BitLocker protection first; otherwise you may be asked for the recovery key after the restart.
3. Open the Windows Security app and select Virus & threat protection.
4. Select Scan options, choose Microsoft Defender Antivirus (offline scan) and start the scan.
5. The PC restarts and the scan runs in the Windows Recovery Environment, then the PC restarts automatically when it finishes.
6. Open Windows Security and check Protection history for the results.

Microsoft lists a few requirements: you must be signed in with local administrator rights, the Windows Recovery Environment must be enabled (it can be checked with the command reagentc /info), and Microsoft Defender Antivirus must be the primary antivirus. Microsoft states that the offline scan does not apply to ARM versions of Windows 10 and 11.

Microsoft’s monthly Windows Malicious Software Removal Tool can also detect and remove some classes of rootkits, and many antivirus suites include rootkit detection.

How to Scan Linux and Unix Systems for Rootkits

On Linux and other Unix-like systems, chkrootkit and rkhunter are two long-running rootkit detection tools. The chkrootkit project describes itself as a tool that locally checks for signs of a rootkit, using a script that checks system binaries for rootkit modification plus small programs that check logs and network interfaces; as of October 2026 its site lists version 0.59 as the newest release. Treat any clean result with care, because a report produced inside a compromised system cannot be fully trusted.

What to Do If a Scan Finds a Rootkit

1. Disconnect the computer from the internet and your network to cut off any remote access.
2. Copy off your personal files (documents, photos), not programs, ideally from a trusted boot environment.
3. Change your passwords from a different, clean device, starting with email and banking, because rootkits often hide password-stealing keyloggers.
4. Run an offline scan and let the security tool remove what it can.
5. Reinstall the operating system from trusted media if the rootkit is kernel-level or keeps coming back; Wikipedia’s rootkit article notes this may be the only available solution.
6. Check the firmware if the problem survives a reinstall, because firmware rootkits can need a firmware update or hardware replacement, and get professional help.

How to Prevent Rootkit Infections

• Install operating system and software security updates promptly, since the most common installation technique exploits security vulnerabilities to gain higher privileges.
• Use a standard (non-administrator) account for everyday work, following the principle of least privilege.
• Keep UEFI Secure Boot turned on; it was designed to address bootkits.
• Download software only from official sources, because a Trojan horse that looks harmless is a common way rootkits get installed.
• Keep antivirus protection active and run an offline scan whenever you suspect an infection.

For a wider view of threats, see these guides on common types of ransomware, how to stop ransomware in its tracks and what to do if you have been hacked.

Frequently Asked Questions

Is a rootkit a virus?

A rootkit is not strictly a virus. A rootkit is malware designed to gain privileged access and hide itself or other malware, and it is often bundled with viruses, keyloggers or backdoors, which is why rootkits are commonly called viruses.

Can antivirus software detect rootkits?

Antivirus software can detect many known rootkits, especially user-mode ones, but a kernel-level rootkit can hide from tools running on the same system. An offline scan from a trusted environment, such as Microsoft Defender Offline, is more reliable.

Does Windows have a built-in rootkit scanner?

Yes. Windows 10 version 1607 and newer and Windows 11 include Microsoft Defender Offline, found under Virus & threat protection, Scan options, in the Windows Security app. It scans the PC in the Windows Recovery Environment, without loading Windows.

Will reinstalling Windows remove a rootkit?

A reinstall of the operating system from trusted media is often the safest way to remove a rootkit that lives in the operating system, including kernel-mode rootkits. It may not remove a firmware rootkit stored in the BIOS/UEFI or other hardware, which can need a firmware update or hardware replacement.

What are the signs of a rootkit infection?

Possible signs include a sudden slowdown, crashes, security software that is disabled, and unusual CPU use or network activity. None of these proves a rootkit on its own, so confirm with an offline scan. If passwords may be exposed, check whether your passwords have been compromised.

Powered by