Rootkits are designed to hide—sometimes by tampering with the operating system’s view of processes, files, network activity, or even kernel-level drivers. That’s why “one scan” rarely answers the question. A solid approach combines trusted detection tools, safe workflow, and verification after cleanup.
This guide lists strong rootkit detectors and removal utilities you can get online (vendor sites, official downloads, and reputable online scanners). It also walks through a practical, evidence-driven workflow for Windows, Linux, and macOS—plus what to do when the main method fails.
As an Amazon Associate I earn from qualifying purchases.
What a Rootkit Is (and What It Can Do)
A rootkit is malicious software focused on stealth. Instead of just running in the background, it tries to avoid detection by hiding files or registry keys, intercepting system calls, disabling security tools, or persisting through boot-start mechanisms.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCommon rootkit categories you’ll see in the wild:
#1 Best Overall
- User-mode hiding: hides processes, services, or files from basic tooling.
- Kernel-mode rootkits: uses drivers to intercept low-level activity.
- Bootkit / UEFI or bootloader manipulation: targets early boot so malware runs before the OS security stack.
- Rogue persistence: scheduled tasks, services, signed-but-abused drivers, and startup entries.
That diversity is the reason you’ll see different tools specialize in different layers.
Prerequisites Before You Run Any Detector
Before running scanners, set yourself up to avoid making things worse or losing evidence.
1) Disconnect and limit damage
Unplug Ethernet and disable Wi‑Fi temporarily. If the system is compromised and actively communicating, isolation reduces spread and reduces the chance of malware blocking tools.
Free tools Windows power users keep installed
One-click scans. No signup required.
2) Use a trusted environment
- If you suspect firmware-level infection, consider using a known-good external environment (e.g., offline scanning media) if your vendor supports it.
- Download tools only from official vendor domains. Avoid random mirrors—rootkit authors love “fake cleanup tools.”
3) Know your OS and version
Detection tooling differs by platform. For example, Windows tools frequently look for driver-level persistence (SYSTEM/driver services, boot-start drivers), while Linux tools often focus on file integrity and known suspicious binaries.
Best Rootkit Detectors and Removal Tools (Online Resources)
The list below emphasizes reputable vendors, widely used diagnostics, and tools that support rootkit-adjacent detection. Some are online scanners; others are downloadable utilities. For removal, prefer vendors that also include cleaning steps or safe remediation guidance.
Microsoft Defender Offline (offline protection scans on Windows)
If you’re on Windows 10/11, Defender Offline runs scanning in an environment designed to reduce interference from active malware. It’s one of the best first bets when rootkit behavior is suspected (hidden processes/drivers, suspicious persistence).
Where to find: Microsoft Security settings. Look for “Microsoft Defender Offline scan” in Windows Security, or use Microsoft documentation for your build.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Microsoft Safety Scanner (quick on-demand scan)
Microsoft Safety Scanner is an on-demand tool (periodic updates). It’s not a full “rootkit remover,” but it’s useful as an additional clean layer before deeper tooling—especially for known malware families.
Where to find: official Microsoft download page for the current version.
Malwarebytes (detection and cleanup)
Malwarebytes is widely used for removing stealthy malware and rootkit-adjacent infections. While it’s not the only “rootkit-specific” tool, it frequently catches components that rootkits rely on (dropper payloads, fake browser extensions, malicious services).
Where to find: Malwarebytes official site (download the current version for your OS).
ESET Online Scanner
ESET’s online scanner uses current signatures and can be run without installing full ESET antivirus in many cases. It’s a good secondary scan to confirm what another vendor might miss.
Where to find: the official ESET Online Scanner page.
Kaspersky TDSSKiller (bootkit/rootkit family cleanup utility)
TDSSKiller is a specialized cleanup tool targeting TDL/TDSS-style threats (bootkit/rootkit families). If your symptoms look like bootkit infection—unexpected restarts, hidden services/drivers, or suspicious boot persistence—this tool is worth running as a targeted check.
Where to find: Kaspersky official TDSSKiller download page.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSophos Virus Removal Tool
Sophos provides a removal utility updated frequently for various threats. It’s often used as a secondary cleanup tool when multiple scanners disagree, or when you want a different detection engine.
Where to find: Sophos official Virus Removal Tool page.
Bitdefender Online Scanner
Bitdefender’s online scanner can be used as another “different engine” pass. For stealth infections, multiple independent engines reduce the chance of a blind spot.
Where to find: official Bitdefender online scanner page.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Trend Micro HouseCall
HouseCall is a frequently updated on-demand scanner. It’s commonly used as a second opinion tool—especially useful when you want to avoid heavy installs on a stressed machine.
Where to find: Trend Micro official HouseCall page.
GMER (advanced rootkit scanning on Windows)
GMER is an advanced utility focused on detecting hidden processes, services, drivers, and file/system hooks. It’s powerful, but it can also be disruptive—use it carefully and don’t “fix” blindly.
Where to find: GMER official site or trusted distribution source. Download from the vendor/authenticated page only.
Sysinternals Autoruns (persistence auditing on Windows)
Autoruns doesn’t “remove” rootkits directly. Instead, it’s excellent for finding suspicious persistence points: services, drivers, scheduled tasks, logon items, browser helper objects, and more. If a rootkit survives cleanup, Autoruns often reveals the persistence mechanism you need to eliminate.
Where to find: Microsoft Sysinternals (official download pages).
rkhunter (Rootkit Hunter) and chkrootkit (Linux)
On Linux, rootkits often alter files, binaries, or startup scripts. rkhunter and chkrootkit use signature-like checks, file permission checks, and known suspicious patterns to flag tampering.
Where to find: rkhunter and chkrootkit project documentation (commonly installable via your distro’s package manager). For example, many Debian/Ubuntu systems support apt installations for chkrootkit and rkhunter packages.
macOS: Malware scanning plus artifact checks
macOS rootkits are less common than Windows in typical consumer environments, but stealth malware exists. On macOS, favor a reputable scanner (for example, Malwarebytes or a mainstream AV), then verify persistence via LaunchAgents/LaunchDaemons and suspicious profiles/agents.
Where to find: official vendor pages for scanners and Apple’s own persistence documentation for analysis.
How to Run Rootkit Detection Safely (Recommended Workflow)
Rootkit cleanup is as much process discipline as it is scanning. The workflow below is designed to catch stealth layers without letting the malware interfere.
Step 1: Isolate and collect basic info
- Disconnect network.
- Record OS version (Settings > System on Windows; macOS System Settings > General > About).
- Note symptoms: blue screens, unexpected restarts, hidden services, unknown drivers, suspicious browser extensions.
Step 2: Run an offline-capable scan first
If you’re on Windows and have access to Defender Offline, start there. Offline scanning reduces interference from kernel-level components that can block in-OS tools.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Step 3: Run a second scanner from a trusted vendor
Choose an online scanner (ESET Online Scanner, Bitdefender Online Scanner, or Trend Micro HouseCall) or a second installed scanner (Malwarebytes). Use this as a confirmation pass. When different engines detect the same artifacts, confidence increases.
Step 4: Validate with a third approach (signatures + artifacts)
Now switch from “scan results” to “artifact inspection.” For Windows, use Sysinternals Autoruns to look for suspicious services/drivers and abnormal persistence. For Linux, rkhunter/chkrootkit give a file-integrity-ish view.
Step 5: Remove persistence, then re-scan
Most rootkits don’t just remove files; they persist. If you clean malware payloads but leave persistence points, the infection can return on reboot.
Step-by-Step Removal: What to Do When a Rootkit Is Found
There’s no single universal “click remove” path because the correct remediation depends on the rootkit’s layer (user-mode vs driver vs boot/start). Below are safe, typical containment paths.
Recommended Free Tools
Windows (typical containment path)
- Boot into a safer scan mode if available (Defender Offline or vendor-supported recovery scanning).
- Run a targeted cleanup utility if the threat pattern matches (for example, Kaspersky TDSSKiller for TDSS/TDL-like bootkit families).
- Run Malwarebytes or a reputable second scanner to catch remnants.
- Use Autoruns to remove persistence:
- Launch Autoruns as Administrator.
- Focus on Drivers and Services tabs. Look for items with suspicious names, unexpected vendors, or unusual paths (e.g., temp directories, random folder names).
- Disable suspicious entries (don’t instantly delete until you’ve confirmed). If the vendor provides a deletion option, prioritize safe disable/remove options.
- Reboot and re-scan with at least two engines.
Linux (typical containment path)
- Run rkhunter and chkrootkit to identify suspicious binaries and indicators.
- Check persistence locations:
- Systemd services/timers: inspect
/etc/systemd/systemandsystemctl list-unit-files. - Cron: check
/etc/crontab,/etc/cron.*, and user crontabs. - Startup scripts: inspect
/etc/rc.local(if present) and service enablement.
- Systemd services/timers: inspect
- Restore clean files where appropriate (for example, replace tampered system binaries from known-good packages).
- Reboot and verify by re-running scanners and confirming persistence is removed.
macOS (typical containment path)
- Run a reputable malware scan (Malwarebytes or mainstream AV).
- Inspect persistence using LaunchAgents/LaunchDaemons and login items.
- Remove suspicious profiles or browser extensions if present and unexpected.
- Reboot and re-scan to confirm the persistence is gone.
Verification: How to Prove the Rootkit Is Actually Gone
Verification is where many “cleanup” attempts fail—especially when people only rely on one scanner. Use multiple checks after remediation.
Cross-check key indicators
- Scan consistency: two independent scanners should no longer flag the same artifacts.
- Persistence absence: Autoruns shows no suspicious drivers/services; Linux shows no unexpected systemd units/cron entries.
- Behavior changes: reduced crashes, no repeated suspicious network activity, no unexpected re-installation loops.
Rebuild confidence with a clean boot sequence
On Windows, after remediation, perform a normal reboot and then re-run your detection tools. A rootkit can survive in memory initially but fail on reboot—your re-scan catches that.
Check for hidden drivers and services
Rootkits often rely on driver or service hooks. For Windows, treat suspicious driver entries (especially unknown publishers) as high priority. For Linux, treat unknown systemd units and altered system binaries as high priority.
Common Rootkit Detection Failures (and What to Try)
Even strong tools can miss rootkits—either due to interference, outdated signatures, or a stealth method that targets a specific scanning approach.
- Problem: Scanners report nothing, but symptoms persist
- Try an offline-capable scan (Defender Offline on Windows).
- Run a second engine (online scanner + installed scanner).
- Use Autoruns (Windows) or rkhunter/chkrootkit (Linux) to look for persistence/artifacts.
- Problem: Tool crashes or freezes
- Run in a safer mode (reduced background apps, no heavy disk activity).
- Try a different tool instead of repeating the same failing binary.
- Problem: Cleanup succeeds but infection returns
- Persistence wasn’t removed (services/drivers/systemd/cron).
- Malware has a re-dropper component. Run a full scan again immediately after reboot.
- Problem: You suspect bootkit/UEFI
- Prefer offline scanning and vendor-specific bootkit utilities.
- Consider firmware inspection and, when appropriate, vendor guidance for deeper remediation.
Which Tool Should You Use? A Practical Comparison
Use this table to pick the right tool for the right job. Rootkits are multi-layer threats, so “best” depends on your suspected category.
Best Value
| Tool | Platform | Strength | Best use |
|---|---|---|---|
| Microsoft Defender Offline | Windows 10/11 | Offline scanning reduces interference | When rootkit-like behavior blocks in-OS tools |
| Kaspersky TDSSKiller | Windows | Targets TDSS/TDL-style bootkit families | Suspicion of bootkit/persistent driver abuse |
| Autoruns (Sysinternals) | Windows | Finds persistence artifacts (drivers/services/startup) | Confirming persistence is truly gone |
| GMER | Windows | Advanced hidden artifacts/hooking detection | Deep investigation when you suspect stealth/hooking |
| ESET Online Scanner | Cross-platform (web-based scanning) | Different detection engine via online scan | Second-opinion scanning |
| Bitdefender Online Scanner | Cross-platform (web-based scanning) | Strong signatures and scan coverage | Confirming results after cleanup |
| rkhunter / chkrootkit | Linux | Artifact and integrity-style checks | Server troubleshooting and rootkit indicators |
| Malwarebytes | Windows/macOS/Linux (varies by product) | Broad detection and cleanup | Pair with offline or other scanners for coverage |
Legal, Ethical, and Operational Safety Notes
Only run these tools on systems you own or have explicit authorization to test. Some rootkit utilities can change system state (disabling drivers/services) and may be inappropriate for managed enterprise endpoints without IT approval.
When in doubt: preserve evidence (logs, scanner reports, hashes of suspicious files if you can) and prioritize safe disable/remove over aggressive deletion without confirmation.
FAQs
Are rootkit detectors free?
Many rootkit-adjacent scanners are free to download and run, but quality varies. Online scanners (ESET Online Scanner, Bitdefender Online Scanner, HouseCall) are often free for on-demand use, while advanced tools like GMER may have different licensing terms.
Can I remove a rootkit without wiping my PC?
Sometimes, yes—especially for user-mode or lightly persistent infections. If you suspect bootkit/firmware-level compromise, the safest path can be a reinstallation or vendor-guided remediation, because stealth may survive “cleaning.”
How do I know if Autoruns is showing legitimate entries?
Compare vendor signatures and file locations. If an entry points to an unusual path (temporary folders, random directories) or has an unknown publisher when you expect a known one, treat it as suspicious and cross-check with scanner detections.
What if rkhunter/chkrootkit reports warnings but I’m not sure?
Start by investigating persistence and file integrity. Warnings can be false positives when packages change or when systems are configured unusually. Use additional scanners and verify what changed (timestamps, permissions, startup entries).
Should I run all tools at once?
No. Running many tools simultaneously can slow the system and sometimes trigger defensive behaviors. Use a staged workflow: offline/first pass, second engine confirmation, then artifact inspection and final re-scan after remediation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Bottom Line
The best rootkit protection strategy is layered: use offline-capable scanning when possible, confirm with multiple trusted engines, and verify persistence artifacts with tools like Autoruns (Windows) or rkhunter/chkrootkit (Linux). Detection is only half the job—verification after reboot is what proves the threat is actually gone.
If your symptoms suggest bootkit-level compromise or the infection keeps returning after cleanup, treat wiping/reinstallation or vendor-guided remediation as a realistic, safety-first option.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
