Recommended Free Tools
Take the alert seriously, let your antivirus quarantine or remove the detected item, update its protection, and scan again. If the same rootkit alert returns after a restart, run an offline scan rather than relying only on scans inside Windows. If a trusted offline scan cannot resolve the problem, Microsoft recommends reinstalling Windows and security software, then restoring files from a backup made before the infection.
What to do first when antivirus detects a rootkit
Record the alert and follow the antivirus instructions
Note the detection name, affected file or location, time, and whether the antivirus reports quarantine or removal. Use the detecting product’s recommended action. Do not restore or whitelist a file simply because you do not recognize it.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
FixMeStick Gold Computer Virus Removal Stick for Windows PCs - Unlimited Use on Up to 5 Laptops or... | $109.99 | Buy on Amazon |
| 2 |
|
Syba 4 Piece USB-C Type-C Port Blocker with Removal Tool SY-ACC20222 | $38.63 | Buy on Amazon |
| 3 |
|
HitmanPro - 1-Year | 3-PC | $49.95 | Buy on Amazon |
| 4 |
|
HitmanPro - 3-Year | 1-PC | $89.95 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
A detection does not prove that every component has been removed. Microsoft notes that malware can leave remnant files and system changes even after detected threats are removed. Microsoft’s malware-removal troubleshooting guidance explains why a follow-up scan may still find remnants.
Free tools Windows power users keep installed
One-click scans. No signup required.
Update protection and run a full scan
Update the antivirus definitions, then run a full scan to check for remaining artifacts. If you use a product other than Microsoft Defender, follow that vendor’s instructions. Installing several competing real-time antivirus products is not a good reflex; use the product already responsible for protecting the device or seek trusted technical help.
#1 Best Overall
- WHAT YOU GET: FixMeStick Virus Removal Tool for Windows PCs (Windows XP, Vista, 7, 8, 8.1, 10, and 11. 512 MB RAM required), Getting Started Guide, our virus removal guarantee backed by our friendly Canadian based Customer Support Team.
When to use Microsoft Defender Offline
If the detection returns after a restart, or the antivirus cannot remove it, run an offline scan where supported. A recurring detection can mean that a hidden component is reinstalling the detected malware. Rootkits are designed to hide malicious activity, so the running operating system may not reliably show what is present.
Microsoft Defender Offline restarts the computer and scans outside the normal Windows kernel, making it harder for threats that hide during ordinary Windows operation to interfere. Microsoft’s Defender Offline instructions give this route in Windows Security:
Rank #2
- Usb port Blocker: come with 4 USB-C Blocker
- Physically blocks the USB-C ports to deny access to the USB-C ports
- Includes: 4 locks and 1 key
- item package weight: 0.1 pounds
- Save your work and close open programs.
- Open Windows Security, then choose Virus & threat protection.
- Select Scan options, choose Microsoft Defender Offline scan, and select Scan now.
- Allow the PC to restart and complete the scan. Microsoft estimates about 15 minutes, but actual time varies.
Check device and recovery requirements first
Microsoft lists support for x64 Windows 11 and x64 or x86 Windows 10, Windows 8.1, and Windows 7 SP1. Defender Offline does not apply to ARM versions of Windows 10 or 11, or to Windows Server SKUs. Its documented prerequisites include Microsoft Defender Antivirus as the primary antivirus (not in passive mode), a local administrator account, and Windows Recovery Environment enabled. If WinRE is disabled, the scan may not run.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIf BitLocker protects the system drive, suspend protection before the scan or make sure the recovery key is available; Windows may ask for it after restarting. Check Microsoft’s current instructions for your Windows version before proceeding, since requirements and menu labels can change.
Rank #3
Review the result and decide whether to escalate
After Windows starts again, check Windows Security → Virus & threat protection → Protection history for the scan result. If the alert is gone, keep protection updated and watch for another detection. If the same rootkit returns, the scan fails, or Windows still appears compromised, do not assume another routine scan guarantees the device is clean.
For persistent rootkit activity, Microsoft’s rootkit guidance, last updated July 24, 2024, recommends reinstalling the operating system and security software, then restoring data from a backup. If the device is managed by work or school, contact its IT team before attempting recovery.
Rank #4
How to reinstall Windows more safely
A clean installation is disruptive: it removes Windows, personal files, apps, and settings from the selected drive. Microsoft’s Windows recovery guidance says suspected malware that continues after a virus scan may warrant a clean installation from installation media.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →- Use another working PC to create Windows installation media. Microsoft specifies a USB drive of at least 8 GB; creating the media erases its existing contents, so use an empty or backed-up drive.
- Prepare what you will need to reinstall and recover, including access to the device and any BitLocker recovery key.
- Install Windows from trusted installation media, carefully selecting the intended drive because its contents will be removed.
- Update Windows and installed apps before restoring personal files.
- Restore only from a backup made before the infection, preferably one kept off the affected device. Microsoft warns that backups stored on an infected PC may have been modified. Scan restored files with current protection.
A file-preserving reset or factory recovery is not necessarily equivalent to a clean installation from trusted media in every infection. Choose recovery based on the persistence of the threat and the confidence you need that the system has been rebuilt.
Protect accounts if credentials may have been exposed
If there are signs that passwords or other credentials could have been exposed, change important passwords from a separate, known-clean device, starting with email and financial accounts. Turn on multifactor authentication where available. This is cautious incident response, not a rootkit-specific requirement stated in Microsoft’s guidance.
Does an antivirus rootkit alert always mean Windows must be reinstalled?
No. Start with the detecting product’s quarantine or removal action, updated protection, and a full scan. If the alert recurs or removal fails, use an offline scan where supported and review its result. Reinstalling Windows is the escalation for a rootkit that remains unresolved; Microsoft recommends reinstalling the operating system and security software and restoring a pre-infection backup.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
