How to Remove a Rootkit (2026): Offline Scans, and When to Wipe

A rootkit is one of the hardest kinds of malware to deal with, for a simple reason: it is built to hide. It buries itself deep in the system - sometimes in the operating system’s core, sometimes even below it - and then conceals itself and any other malware it protects. That is why a normal antivirus scan, running inside the infected system, so often comes back clean when something is clearly wrong. Removing a rootkit means scanning it from a position where it cannot hide. Here is how.

What a rootkit is, and why it is hard to remove

“Rootkit” comes from getting “root” (full control) plus a “kit” of tools to keep it hidden. Once it has that control, it can intercept the system’s own requests and lie to them - so when your antivirus asks the operating system “what files and processes are here?”, the rootkit quietly edits the answer to leave itself out. There are a few levels, and they matter for removal:

• User-mode rootkits hide within normal programs. These are the easiest to catch and remove.
• Kernel-mode rootkits run inside the operating system’s core, so they can hide from almost anything else running on that system.
• Bootkits infect the boot process itself, loading before the operating system - and therefore before your security software.
• Firmware rootkits live in hardware firmware (like UEFI), surviving even an OS reinstall in the worst cases.

The common thread: if the rootkit is already running when you scan, it can hide from the scan. The fix is to scan when it is not running.

Rootkits are not the only family built to be invisible: fileless malware takes the opposite route and never writes a file to disk at all, which defeats scanners that look for one. The removal logic differs, so it is worth knowing which of the two you are facing before you start.

Signs you might have a rootkit

Rootkits are stealthy by design, so symptoms are indirect:

• Your antivirus is disabled, crashes, or refuses to open - and you did not do it.
• The system behaves strangely: settings change, the machine is slow, or it reboots on its own.
• There is network activity or outbound connections you cannot explain.
• A scan from inside the system says everything is fine, but the problems continue.

Any one of these has other causes too, but a security tool that keeps getting turned off is a classic rootkit red flag.

Step 1 - Run a boot-time / offline scan

This is the key move. Instead of scanning from inside Windows (where the rootkit is running and hiding), scan before Windows fully loads:

• Microsoft Defender Offline is built into Windows and does exactly this. It restarts your PC into a small, trusted environment and scans from there, before the rootkit can load. Open Windows Security, go to Virus & threat protection, choose Scan options, select Microsoft Defender Offline scan, and let it restart and run. This alone catches many rootkits that a normal scan misses.

Because the scan runs before the operating system, the rootkit is not active to conceal itself - which is the entire point.

Step 2 - Use bootable rescue media

If the offline scan is inconclusive or you want a second opinion, boot the machine from separate rescue media. Reputable security vendors offer free bootable rescue disks / USB scanners - you create the USB on a clean computer, boot the infected machine from it, and scan the drive while the installed Windows (and its rootkit) is completely powered off. Scanning a “dead” drive from a clean environment is the most reliable way to see what is really there.

Step 3 - When to wipe and reinstall

Be honest with yourself about this one. For a stubborn kernel-mode rootkit or a bootkit, the only way to be certain the system is clean is to wipe the drive and reinstall the operating system from scratch:

• Back up your important personal files (documents, photos) - but not programs or system files, which can carry the infection.
• Wipe the drive and do a clean OS install, ideally recreating the installation media from a known-clean computer.
• If you suspect a firmware/UEFI rootkit (rare, but it survives reinstalls), update your motherboard firmware from the manufacturer, and get expert help - this is beyond a normal cleanup.

A clean reinstall feels drastic, but for a real rootkit it is often faster and far more trustworthy than chasing something designed to be unfindable.

After removal: assume your passwords are exposed

A rootkit may have logged keystrokes or stolen credentials the whole time it was active. Once the machine is clean, change your important passwords - from a different, known-clean device, not the one you just cleaned - starting with email, banking and anything reused. Turn on two-factor authentication where you can.

How to avoid the next one

• Keep Secure Boot enabled in your firmware - it is specifically designed to block bootkits from loading.
• Do not run cracked software, fake installers or random “codecs” - the classic way rootkits get in.
• Keep Windows and your firmware updated, and use a standard (non-administrator) account for daily use.

The bottom line: a rootkit hides from any scan that runs alongside it, so you beat it by scanning from outside - Defender Offline first, bootable rescue media next - and, for the deep-seated ones, by wiping and reinstalling. For related cleanups, see how to remove a trojan virus and the full how to remove malware from Windows guide.