How to Disable a Rootkit Hiding in Kernel-Mode Drivers

Kernel-mode rootkits operate at the most privileged level of a computer, sitting beneath the operating system in the same address space as core drivers. Because they load before many security products, they can intercept system calls, hide files, mask network connections, and spoof process lists. A user in Melbourne opening their banking app may see nothing unusual while a malicious driver quietly logs keystrokes in the background.

Disabling such a threat is not a matter of running a standard antivirus scan. The malware actively subverts the tools meant to detect it, and rebooting into the same compromised environment often restores it. The walkthrough below outlines how a careful technician can prepare, isolate, and remove a kernel-mode rootkit on a Windows machine, with notes for users across Australia who may face patch delays or limited local IT support.

How kernel-mode rootkits stay invisible to the operating system

A kernel-mode rootkit typically arrives through a dropper, a malicious attachment, or a trojanised installer. Once executed, it writes a driver file, often with a name that mimics a legitimate component, into a protected folder such as \Windows\System32\drivers. The payload then registers a service entry pointing to its own file, requesting load at the earliest stage of boot.

At that point the rootkit runs in ring 0, the same privilege level as the kernel itself. It can hook the System Service Descriptor Table, patch interrupt handlers, or alter the way Windows enumerates processes. Telemetry that security software relies on can be silently rewritten, returning clean results for malicious activity. The Australian Cyber Security Centre has documented several campaigns that used this technique against small businesses, particularly in regional areas where endpoint protection was outdated.

Red flags that point to a kernel-level compromise

Symptoms are often subtle. A machine may boot slightly slower, Task Manager might show lower CPU usage than expected during heavy operations, or a network light on the router keeps blinking even when the computer is idle. Some users notice that familiar processes no longer appear in the list returned by tools like tasklist, while others see phantom entries that disappear on refresh.

Unexplained outbound traffic to unfamiliar IP addresses is another strong indicator, especially on home networks served by Aussie Broadband or larger carriers where the customer portal shows connection logs. Sudden instability in USB or storage drivers, repeated blue screens with stop codes referencing 0x0000007E, or a disabled antivirus that refuses to re-enable also deserve attention. When several of these signs appear together, a kernel-level intruder is a reasonable suspicion.

Setting up an isolated workspace before you start

Attempting cleanup from inside the infected operating system is risky, so preparation matters. Begin by downloading known-clean copies of scanning utilities such as Malwarebytes Anti-Rootkit, Kaspersky TDSSKiller, or ESET SysRescue onto a separate, uninfected machine, and copy them to a USB stick formatted on a trusted computer.

Boot the suspect machine from a Windows installation media or a Linux-based rescue environment, such as the ESET SysRescue Live CD, which mounts the infected drive as a secondary volume rather than executing its code. A technician in Sydney or Brisbane can sometimes access a cloud-hosted forensic image through a managed detection service, but a local USB-based approach remains the most reliable for home users. Disconnect the network cable and disable Wi-Fi to prevent the rootkit from calling home during the analysis window.

Manual steps to neutralise kernel-mode drivers

Once booted into the rescue environment, open the registry hive of the infected system and review the HKLM\SYSTEM\CurrentControlSet\Services key. Sort entries by their ImagePath value and look for drivers pointing to unusual locations, misspelled service names, or those lacking a verified publisher signature. Cross-reference any suspicious service with the on-disk file in the drivers folder and record the exact name and path for later removal.

From the command line, use sc query to list services and sc qc to inspect their configuration. Legitimate kernel drivers usually have descriptive display names matching their file names, while malicious entries often show a generic name such as rndismp6 alongside a path under C:\Windows\System32\drivers. Working with registry hives offline requires care, so back up the SYSTEM and SOFTWARE hives before making changes. A deeper manual approach, including SSDT hook inspection, is covered in trojan removal guides that walk through similar driver-level threats.

Specialist scanners that uncover hidden kernel payloads

After the manual triage, run the bootable scanners prepared earlier. Tools like Kaspersky TDSSKiller, Malwarebytes Anti-Rootkit, and GMER are designed to read raw disk sectors and compare them against known clean baselines, exposing rootkits that hide from the live operating system. Each tool should be updated on a clean machine before being run against the target, since the rootkit may attempt to block downloads or tamper with update traffic.

Run a full scan and allow the tool to quarantine or delete the flagged drivers. Reboot into the cleaned environment and repeat the scan from within Windows to confirm no active rootkit remains. For persistent infections that resist standard tools, an offline scan using the built-in Microsoft Defender Offline mode or a vendor rescue disk often succeeds. The process resembles the email worm cleanup workflow, which also relies on offline media to dismantle replicating payloads.

Locking the system down after a successful cleanup

Once the rootkit is removed, change every password accessed from the affected machine, ideally from a different trusted device, and enable multi-factor authentication on email, banking, and any service tied to myGov. Review startup items, scheduled tasks, and browser extensions, then apply the latest operating system updates, including optional driver updates that patch exploitable kernel interfaces.

Method	Detection depth	Skill required	Risk to system	Best suited for
Bootable rescue scan	High	Low to moderate	Very low	Most home users
Manual registry edit	Very high	Advanced	High	Experienced technicians
Full OS reinstall	Certain	Moderate	Low when backed up	Severe or repeated infections
Cloud forensic analysis	High	Professional	Very low	Businesses with incident response contracts

Back up critical data to an external drive that was not connected during the infection, and consider enabling controlled folder access or a reputable endpoint detection platform to catch future attempts. Reporting the incident to the ACSC through ReportCyber helps Australian analysts track campaigns that may target other households or small businesses in the same suburb.