A rootkit attack is dangerous because the malware is built to hide below the layer you normally inspect. It may conceal drivers, processes, files, network activity, or another payload while keeping privileged access. If you only remove the obvious app and the hidden component remains, the infection can come back. Prevention still matters most, but a suspected rootkit also needs a different cleanup path: offline scanning, driver and boot checks, careful backups, and sometimes a clean reinstall.
How do you prevent a rootkit attack?
- Keep Windows, firmware, browsers, and drivers updated. Rootkits often need admin rights, a vulnerable driver, or a boot-chain weakness.
- Do not run cracks, cheats, keygens, unknown drivers, or unsigned “fix” tools. These are common routes for kernel-level and boot-level abuse.
- Use Secure Boot, Memory Integrity/HVCI, and the Microsoft vulnerable driver blocklist where supported. These controls reduce abuse of malicious or vulnerable signed drivers.
- Use standard user accounts for daily work. Save administrator approval for software you trust.
- When a rootkit is suspected, scan offline before trusting normal cleanup. A scan from outside the running Windows session is harder for hidden components to evade.
| Main intent | Hidden malware, recurring infection, rootkit symptoms, bootkit/rootkit cleanup |
| Highest-risk clues | Security tools disabled, unknown drivers, malware returns, boot changes, rootkit/bootkit detection names |
| Best first response | Stop using sensitive accounts, run full and offline scans, check drivers/startup, change passwords from a clean device |
| When to reinstall | Confirmed kernel/boot-level rootkit, failed removal, repeated reinfection, or system state you cannot trust |
What is a rootkit attack?
A rootkit is malware or a toolset that helps an attacker keep hidden access. It can live in user-mode processes, kernel drivers, boot components, firmware, or virtualization layers. The common goal is stealth: make malicious files, processes, registry entries, drivers, or connections disappear from ordinary tools.
A rootkit is not always the first thing that infects the computer. In many real incidents, another payload arrives first: a cracked installer, fake update, loader, remote-access trojan, or malicious driver. The rootkit-like component then helps the attacker hide persistence or protect the rest of the infection from removal.
| Rootkit type | Where it hides and why it matters |
| User-mode rootkit | Inside user-level processes. Easier to detect than deeper types, but still useful for hiding files or activity. |
| Kernel-mode rootkit | Inside the operating system kernel or drivers. Can interfere with normal security tools and system views. |
| Bootkit | In the boot process, EFI System Partition, bootloader, or early startup path. It can start before Windows defenses are fully active. |
| Firmware rootkit | In device or motherboard firmware. Rare on home PCs, but difficult to verify and remove when confirmed. |
Rootkit symptoms people usually search for
Rootkits are designed to hide, so the symptoms are often indirect. Treat these as warning signs, especially after running cracked software, game cheats, unknown drivers, fake updates, or tools that asked for administrator approval.
- Microsoft Defender, another antivirus, or EDR turns off, fails to update, or cannot finish a scan.
- Malware comes back after “successful” removal or after reboot.
- Unknown drivers, services, scheduled tasks, startup entries, or administrator accounts appear.
- Process, file, registry, or network views disagree between tools.
- The PC crashes or freezes shortly after boot, especially after a suspicious driver or “activator” ran.
- Security alerts mention rootkit, bootkit, hidden driver, kernel driver, EFI, MBR, or suspicious boot activity.
- Browser sessions, passwords, or accounts are abused even after the visible malware was removed.
Important: no single symptom proves a rootkit
High CPU, a blue screen, or a failed scan can also come from damaged Windows files, a bad driver, or ordinary malware. The rootkit suspicion becomes stronger when several clues appear together: hidden drivers, disabled protection, recurring reinfection, boot changes, or a security alert naming rootkit-like behavior.
How rootkits get installed
- Cracked software, keygens, trainers, and game cheats: users are told to disable security or accept unknown drivers.
- Bring-your-own-vulnerable-driver abuse: malware uses a legitimate but vulnerable signed driver to gain kernel access. Microsoft maintains a vulnerable driver blocklist for this reason. [2]
- Fake updates and phishing attachments: the first-stage malware gets admin rights, then installs persistence.
- Exposed remote access: weak RDP, reused admin passwords, or compromised remote tools can let an attacker install deeper components.
- Boot-chain attacks: serious campaigns such as BlackLotus showed why Secure Boot updates and revocations matter, not only the on/off setting. [3]
Rootkit prevention checklist for Windows in 2026
| Control | Why it helps |
| Windows Update and vendor firmware updates | Close privilege-escalation, driver, and boot-chain gaps that rootkits can abuse. |
| Secure Boot | Reduces boot-level tampering risk when firmware and revocation updates are current. |
| Memory Integrity / HVCI | Helps block untrusted or vulnerable kernel code on supported Windows systems. |
| Microsoft vulnerable driver blocklist | Disrupts malicious use of vulnerable third-party drivers; Microsoft says the list is updated through Windows servicing and published blocklist updates. [2] |
| Standard user account for daily work | Limits silent driver, service, and persistence installation. |
| Trusted software only | Avoids cracked installers, malicious drivers, fake browser updates, and “disable antivirus” instructions. |
| Offline backups | Makes reinstall realistic if the system cannot be trusted after cleanup. |
What to do if you suspect a rootkit
- Stop sensitive activity on that PC. Do not do banking, crypto-wallet work, password-manager changes, or email recovery from the suspicious system.
- Disconnect from the network if active compromise is likely. This is reasonable if you see new admin accounts, remote sessions, repeated alerts, or suspicious outbound traffic.
- Run a full scan from the installed security tool. Keep the report or detection name; do not restore quarantined cracks, drivers, or tools.
- Run Microsoft Defender Offline or another trusted offline scan. Microsoft describes Defender Offline as a scan from a trusted environment outside the running Windows session, which helps when malware hides while Windows is active. [1]
- Check recent drivers, services, scheduled tasks, startup apps, browser extensions, and remote-access tools. Pay attention to anything installed around the time symptoms started.
- Change important passwords from a clean device. Prioritize email, banking, Microsoft/Google/Apple accounts, password managers, social accounts, Discord/Steam, and crypto wallets.
- Back up only personal files you can inspect and scan. Avoid restoring executables, scripts, cracks, unknown archives, and old driver installers.
- Reinstall Windows when trust is lost. If a kernel or boot-level rootkit is confirmed, removal fails, malware returns, or security settings keep changing back, a clean reinstall is safer than endless cleanup attempts.
Offline scan vs Safe Mode: which one matters for rootkits?
Safe Mode is useful for ordinary cleanup because fewer apps and services load. But a rootkit suspicion is different: the hidden component may be active before normal tools can see it. That is why an offline scan or trusted rescue environment is more important when the alert points to a rootkit, bootkit, or hidden driver.
If you only have vague symptoms, start with normal full scans and the Safe Mode malware removal checklist. If malware keeps returning, security tools are disabled, or a detection names rootkit-like behavior, escalate to offline scanning and consider reinstall planning.
Rootkit vs bootkit: avoid the common mix-up
A bootkit is a specialized rootkit that targets the boot process. All bootkits are rootkit-like, but many rootkits do not touch the boot chain. For a focused boot-level guide, see What Is a Bootkit? Boot Malware, Symptoms, and Protection.
FAQ
Can antivirus detect rootkits?
Yes, many rootkits can be detected, especially before they fully install or when the scan runs from outside the infected Windows session. Deep kernel, boot, or firmware-level cases are harder and may need offline scanning or reinstall decisions.
Is reinstalling Windows necessary after a rootkit?
Not always. Reinstall becomes reasonable when a deep rootkit is confirmed, malware returns after cleanup, security tools stay disabled, boot components were changed, or you cannot trust the system state.
Are rootkits common on home PCs?
They are less common than adware, phishing, browser hijackers, and ordinary trojans. Risk rises when users run cracks, cheats, keygens, unsigned drivers, old activators, or unknown remote-access tools.
What is the difference between a rootkit and a bootkit?
A bootkit targets the boot process so it can start before or during operating-system startup. A rootkit is broader and may hide in user-mode apps, kernel drivers, boot components, firmware, or virtualized layers.
Can Secure Boot prevent all rootkits?
No. Secure Boot reduces boot-level tampering risk, but it is not a complete rootkit defense. Keep firmware and Windows updated, apply Secure Boot revocation updates when required, avoid vulnerable drivers, and keep offline backups.
References
- Microsoft Learn. “Microsoft Defender Offline scan in Windows.” Microsoft Defender for Endpoint, accessed June 7, 2026. https://learn.microsoft.com/defender-endpoint/microsoft-defender-offline
- Microsoft Learn. “Microsoft recommended driver block rules.” App Control for Business, last updated May 4, 2026, accessed June 7, 2026. https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules
- Microsoft Security Response Center. “Guidance related to Secure Boot Manager changes associated with CVE-2023-24932.” Microsoft, May 9, 2023, accessed June 7, 2026. https://www.microsoft.com/en-us/msrc/blog/2023/05/guidance-related-to-secure-boot-manager-changes-associated-with-cve-2023-24932/
