Removing A Rootkit

Removing a rootkit is a two-pronged approach, focusing at the removal of the rootkit as well as the malware it was hiding.

As rootkits change the Windows operating system itself, their removal can cause it to become unstable or even non-functioning. Removing the malware that the rootkit hides is as simple as removing any malware but is not possible until the rootkit is removed, a process which may leave the system unstable and make it hazardous to remove the malware from it.

A possible cure is to restore your drive via a drive image, though the image must have been created prior to the rootkit infection, and the imaging will restore the boot sector of your disk.

Rootkit Removal Tools

BlackLight

A time-limited program that may soon be discontinued and folded into F-Secure Internet Security 2006, BlackLight nonetheless scans carefully and attempts to clean offending files from the system.

RKDetector 2.0

Composed of two separate applications that scan the file system and running processes, respectively, RKDetector suffers from not having the flexibility and breadth of features of the other programs here.

RootkitBuster 1.6

A spin-off / standalone version of the rootkit scanning technology from one of Trend Micro's commercial programs, which actually works quite well on its own.

RootkitRevealer 1.71

One of the first rootkit detectors, it's now overshadowed a bit by some of the other programs here but can still do some decent work.

Rootkit Unhooker 3.0A

A Russian-authored tool that's the most comprehensive and powerful of those tested here.