What is a rootkit — and how do you get rid of one?

A rootkit is a set of tools an attacker uses after gaining deep, administrator-level access to a computer, to hide what they're doing and keep that access, in NIST's definition. Its job is concealment. Microsoft puts the consequence bluntly: after a rootkit infects a device, you can't trust any information that device reports about itself — and a successful rootkit can stay in place for years if it isn't detected.

Why rootkits are so hard to find

• They change the system itself, making it very difficult to tell that a rootkit is present or what it has changed, NIST notes.
• Many use the same permissions as the operating system and start before it, so they can hide completely.
• They're often part of a larger malware suite that can bypass logins, record passwords and keystrokes and steal files.

How rootkits get in

Usually the same way as other malware. NIST describes infected websites that try to exploit weaknesses in a visitor's computer to install rootkits and other attacker tools, and Trojans that carry them in disguised as useful programs. Microsoft's advice follows from that: the best way to deal with a rootkit is to stop it being installed — keep software updated, be careful with websites and email, and keep backups.

How to check for a rootkit on Windows

1. Because a rootkit can hide from the running system, scan from outside it. In Windows Security, go to Virus & threat protection > Scan options, choose Microsoft Defender Antivirus (offline scan) and select Scan now.
2. Save your work first: the PC restarts and the scan runs before Windows loads, which takes about 15 minutes. Results appear afterwards under Protection history.
3. If your drive is encrypted with BitLocker, have your recovery key ready — you may be asked for it.
4. Microsoft notes you may need an extra tool that boots the computer into a known, trusted environment.

If the rootkit won't go away

If a rootkit can't be removed, Microsoft strongly recommends reinstalling the operating system and your security software, then restoring your data from a backup. NIST agrees that rebuilding the computer is the most reliable way to restore its integrity. Be careful which backup you use: backups stored on the PC during the infection might already have been modified by the malware. Some rootkits live in the computer's firmware rather than on the disk; if problems survive a reinstall, contact the device maker.

Secure Boot and other Windows defenses

• Secure Boot allows only trusted, digitally signed software to run while the PC starts, which helps prevent rootkits from loading at startup. Check its status in Windows Security > Device security.
• Trusted Boot then verifies the Windows kernel, drivers and the antimalware driver as they load. Together they reduce the risk of firmware and boot-level rootkits — they don't eliminate it.
• Memory integrity (Windows Security > Device security > Core isolation details) makes it harder for malicious programs to use low-level drivers to take over your PC.
• Microsoft is replacing the original 2011 Secure Boot certificates; on supported, updated Windows PCs the update installs automatically.

How to keep rootkits out

• Keep Windows, your apps and your security software updated automatically.
• Use a standard, non-administrator account for everyday work.
• Download software only from official sources, and be careful with attachments and links.
• Follow the 3-2-1 backup rule — three copies, two places, one offline — so a rebuild doesn't cost you your files.

With a rootkit, the computer can't vouch for itself. Scan from outside it — and if in doubt, rebuild.