How to Detect and Remove a Rootkit in Windows 11

The Problem

A rootkit is malware that loads early enough and deep enough to lie to everything above it. A driver-level rootkit hooks the Windows kernel so infected files do not appear in Explorer and its process does not appear in Task Manager. A bootkit goes lower still, infecting the boot chain so it is running before Windows — and before your antivirus — even starts.

That is why the symptom is not "I found something bad" but "everything says the PC is clean, and it clearly is not."

Rootkits are genuinely rare on home PCs. Before you go down this path, rule out the far more common explanations: leftover persistence that keeps redownloading malware, a browser hijack, or a miner. This guide assumes you have already done that and the problem still returns.

Not sure it is a rootkit? Work through remove malicious scheduled tasks and startup persistence first. Nine times in ten, that is the actual answer.

Symptoms That Genuinely Point at a Rootkit

Malware returns after a full scan plus an offline scan plus clearing every persistence point.
Windows Defender switches itself off, or refuses to switch on — and Defender not working does not resolve it.
Network traffic to unknown addresses with no process you can attribute it to.
Secure Boot reports as disabled and will not stay enabled.
Blue screens naming an unfamiliar .sys file, especially after Memory Integrity is enabled.
A drive shows less free space than the files account for, or a partition you did not create.
The PC boots noticeably slower with a brief flicker or garbled text before the Windows logo.

Any single one of these has innocent explanations. Three or more together, after a proper cleanup, is when this guide applies.

Before You Start

Back up your documents to an external drive — not a system image, which would carry the infection. Scan that backup from a different, clean PC before you ever restore from it.

Have your BitLocker recovery key to hand before touching boot settings: find your BitLocker recovery key. Several steps here can trigger a recovery prompt.

The Fix: Step-by-Step

Step 1: Run Microsoft Defender Offline Scan Properly

This is the single most useful tool here, because it runs from a minimal boot environment where the rootkit's Windows-level hooks are not active.

Settings → Privacy & security → Windows Security → Virus & threat protection.
Scan options → Microsoft Defender Offline scan → Scan now.
The PC restarts and scans for around 15 minutes. Do not interrupt it.

Results appear in Protection history once Windows is back. Run it twice — a second pass sometimes catches what the first only partially removed.

Step 2: Scan From External Media

If the offline scan finds nothing but symptoms persist, scan from media the infected PC has no control over. On a clean PC, download a rescue ISO from a major vendor — Kaspersky Rescue Disk, ESET SysRescue, or Windows Defender Offline media — write it to a USB stick, boot the affected PC from it, and run a full scan.

This is the closest thing to ground truth available, because nothing from the infected installation is running.

Step 3: Check the Boot Chain

Bootkits alter the boot configuration or the EFI partition. In Terminal (Admin):

bcdedit /enum

Look for a path value pointing anywhere other than \Windows\system32\winload.efi (or winload.exe on legacy BIOS), an unexpected extra entry in the boot list, or testsigning set to Yes. Test signing enabled without you doing it deliberately means the machine is configured to load unsigned drivers, which is a rootkit's prerequisite.

Turn it off with:

bcdedit /set testsigning off
bcdedit /set nointegritychecks off

Step 4: Confirm Secure Boot Is On and Stays On

Secure Boot is the specific defence against bootkits — it refuses to load an unsigned bootloader.

Win + R → msinfo32 → System Summary → check Secure Boot State.
If it says Off, enable it in firmware: how to enter BIOS or UEFI, then see enable TPM and Secure Boot.

If Secure Boot will not enable, or turns itself off again after a restart, that is a strong bootkit indicator — and it also means Step 8 is where you are heading.

Step 5: Repair System Files and the Component Store

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

Run SFC, then DISM, then SFC again. This repairs system binaries a rootkit may have patched. It will not remove the rootkit itself, but it undoes collateral damage that keeps other tools failing. Detail in how to run SFC and DISM.

Step 6: Look for the Malicious Driver

pnputil /enum-drivers

Scan the output for drivers with no publisher, an odd original name, or a recent date matching when trouble started. Cross-check against the incompatible-driver list Windows shows when you try to enable Memory Integrity — that list is effectively a free rootkit-adjacent driver report. See enable Core Isolation and Memory Integrity.

Remove a confirmed bad driver with:

pnputil /delete-driver oem42.inf /uninstall /force

Step 7: Clear the Persistence Layer Again

A rootkit rarely works alone. Re-run the full sweep in remove malicious scheduled tasks and startup persistence — scheduled tasks, services, Run keys, WMI subscriptions — now that the driver is gone and things are visible again.

Step 8: Accept the Clean Install When It Is the Answer

If after all of the above the symptoms return, stop. A rootkit that survives an offline scan, external rescue media, and driver removal needs the disk wiped, not repaired.

Do it properly, because a normal reinstall keeps the existing partitions:

Create Windows 11 installation media on a clean PC.
Boot from it, choose Custom install.
Delete every partition on the target disk — including the small EFI and recovery partitions — so you are installing to unallocated space. This is what removes an EFI-resident bootkit.
Let Windows recreate the partition layout.

Full walkthrough: how to clean install Windows 11 and partition and format a hard drive.

Step 9: Update Firmware and Harden Before Restoring Data

A very small number of implants live in UEFI firmware itself and survive even a full wipe. Flashing the current firmware from your motherboard or laptop vendor overwrites that region.

Then, before restoring documents: enable Secure Boot, enable Memory Integrity and the vulnerable driver blocklist, enable LSA protection, and move daily use to a standard user account. Scan the backup from another machine before copying anything back.

Step 10: Change Every Password

A rootkit means full compromise for however long it was present. Change all passwords from a clean device, revoke sessions, and enable 2FA: review and revoke app access and active sessions and check if your email was in a data breach.

Rootkit vs Bootkit vs Ordinary Malware

| | Where it runs | Survives Windows reinstall | Usual removal | |---|---|---|---| | Ordinary malware | User account | No | Scan plus persistence cleanup | | Kernel rootkit | Windows driver | No, if partitions are deleted | Offline scan, driver removal | | Bootkit | EFI partition / boot chain | Only if partitions are kept | Delete all partitions, reinstall | | Firmware implant | UEFI flash | Yes | Firmware reflash |

What Not to Do

Do not download a "rootkit remover" from a search result. This category is heavily impersonated, and installing one is a common way to acquire the problem you were looking for.
Do not reinstall while keeping the existing partitions if a bootkit is suspected. That is the single most common reason a reinstall "did not work".
Do not restore a full system image taken after the infection started. Restore documents only.
Do not disable Secure Boot to make something work while investigating this.

FAQ

How common are rootkits on home PCs really?

Uncommon. The overwhelming majority of "the malware keeps coming back" cases are a scheduled task, service, or browser policy that was missed — not a rootkit. Rule those out thoroughly before assuming the worst, or you will wipe a machine unnecessarily.

Will Windows Defender detect a rootkit?

The offline scan detects many of them, because it runs before the rootkit's hooks are active. A live scan from inside the running system is much less reliable, since the rootkit can hide files from the scanner. Always use the offline scan for this.

Does a rootkit survive a factory reset?

A kernel rootkit does not if the reset actually reformats the system partition. A bootkit in the EFI partition frequently does survive Reset This PC, because that process preserves the EFI and recovery partitions. Deleting all partitions during a clean install is what removes it.

Can a rootkit survive replacing the hard drive?

Only a UEFI firmware implant can, and those are rare and typically targeted rather than opportunistic. If symptoms genuinely persist across a new drive and a full clean install, flash the motherboard firmware.

Is Secure Boot enough to prevent a bootkit?

It is the main defence and it is effective, provided it is actually enabled and the firmware is current. Several known bootkits work by exploiting outdated signed bootloaders, which is why firmware updates and Microsoft's revocation updates matter as much as the toggle.

My antivirus finds nothing but the PC is clearly infected. What now?

Scan from external rescue media in Step 2. If that also comes back clean and symptoms persist, the fastest route to certainty is the full wipe-and-reinstall in Step 8 — at some point, verification costs more than reinstalling.

Still Not Working?

If a fresh install on wiped partitions with updated firmware still shows the same behaviour, look outside the PC: a compromised router redirecting DNS produces symptoms that look exactly like a persistent infection. Check secure your home Wi-Fi router and set up DNS filtering.