Step-by-Step Cleanup of a Windows Kernel Rootkit

A rootkit that alters the Windows kernel is among the most serious forms of malware. It can hide files, processes, drivers, registry entries and network activity from ordinary security tools by operating beneath much of the system’s normal visibility.

Warning signs may include unexplained administrator accounts, disabled antivirus protection, random crashes, unsigned drivers, unusual outbound traffic or security software that reports different results after every restart. These symptoms can also have legitimate causes, so avoid deleting system files based on a single alert.

Treat the computer as untrusted until the investigation is complete. Disconnect Wi-Fi and Ethernet, unplug external storage, and avoid signing in to banking, email or cryptocurrency accounts. From a separate clean device, change important passwords and enable multifactor authentication.

In Australia, contact your bank immediately if the affected computer was used for online banking, PayID or Osko payments. Keep screenshots and security logs if the machine belongs to a business, school or council, because privacy and incident-reporting obligations may apply.

Isolate the Infected Computer

Physically unplug the network cable or turn off Wi-Fi using the router or a hardware switch where possible. Do not simply close suspicious applications and continue browsing, because a kernel-level implant may maintain access through a hidden driver or modified system component.

If the computer is part of a home network in Sydney, Melbourne or elsewhere, check other devices for suspicious logins, newly installed remote-access tools and unusual router settings. Do not connect an external backup drive until it has been scanned from a clean environment.

Preserve Evidence and Recovery Access

Before making changes, record the Windows version, visible alerts, suspicious file names, recent installations and the approximate time the problem began. Photographing screens can help when the rootkit disappears after reboot or when a professional examines the machine.

Use a separate device to locate the Microsoft account recovery details and the BitLocker recovery key. If important work files are stored locally, avoid repeatedly restarting the system. A forensic specialist may be able to recover useful evidence before remediation destroys it.

Start With Trusted Offline Scanning

Download an official Microsoft Defender Offline image or a reputable vendor’s rescue environment on a clean computer. Write it to a new USB drive, boot the affected PC from that device, and update its definitions if the rescue environment supports a safe network connection.

Run a full scan of every internal disk, including the EFI System Partition and recovery partitions where supported. A kernel rootkit may conceal itself from scans performed inside the infected Windows installation, so an external boot environment provides a stronger view.

Use Safe Mode Carefully

Safe Mode loads a reduced set of Windows components, which can prevent some persistence mechanisms from starting. It is useful for collecting logs and removing ordinary malware, but it is not proof that a kernel rootkit has been eliminated. Microsoft’s recovery options can help reach the required startup menu, and this Safe Mode cleanup guide explains the process in more detail.

Choose Safe Mode without networking unless internet access is essential. Review installed drivers with caution, checking their publisher, signature, path and installation date. Do not delete a driver merely because its name looks unfamiliar; legitimate hardware and security software often use obscure names.

Inspect Drivers, Boot Records and Integrity

From an elevated Command Prompt, run sfc /scannow and then use DISM to repair the Windows component store where appropriate. These commands can restore altered protected files, but they may not detect a sophisticated bootkit or a driver that has tampered with the kernel.

Inspect Device Manager, Autoruns from Microsoft Sysinternals and Windows Security’s protection history. Pay particular attention to unsigned or recently created kernel drivers, unusual services and changes to boot configuration data. If Secure Boot was unexpectedly disabled, restore it only after confirming that the system firmware and installed operating system are legitimate.

A remote-access trojan may work alongside a rootkit. If you find evidence of unauthorised remote control, follow this RAT removal guide and review account activity from a clean device.

Rebuild When Trust Cannot Be Restored

For a confirmed kernel modification, a clean reinstall is usually safer than trying to delete individual files. Back up personal documents only after scanning them offline, and avoid copying executable files, scripts, cracked software, macros or unknown browser extensions.

Create Windows installation media from Microsoft’s official site on a clean computer. During setup, delete all partitions on the affected system drive only if you have verified your backups and understand that this removes data. Reinstall firmware updates from the computer maker when necessary, enable Secure Boot and apply Windows updates before restoring files.

Verify the Repaired System

After reinstalling, install security updates, activate Microsoft Defender, create a standard daily account and keep administrator access for maintenance. Reinstall applications from official publishers rather than old installers stored on the compromised drive.

Check that Secure Boot is enabled, Windows Security reports no active threats, and no unexpected drivers or services return after several restarts. Review Microsoft account, email, banking and social-media sessions from a separate trusted device, then revoke unknown sessions and update passwords.

Cleanup approach	Best use	Main limitation
Offline rescue scan	Detecting hidden files and drivers outside Windows	A clean result cannot guarantee firmware integrity
Safe Mode cleanup	Removing ordinary persistent malware	Kernel threats may still load or conceal themselves
System repair commands	Restoring damaged Windows components	They do not replace a full compromise assessment
Clean Windows reinstall	Re-establishing trust in the operating system	Requires verified backups and application reinstallation
Professional forensic review	Business systems, suspected data theft or repeated reinfection	May involve cost and temporary loss of device access

If the rootkit returns after a clean installation, investigate the firmware, UEFI settings, router, browser synchronisation and every restored application. Australian businesses should preserve relevant logs and involve their managed service provider or incident-response team rather than repeatedly wiping the same machine.