Step-by-step Windows kernel rootkit cleanup

A rootkit that modifies the Windows kernel to hide processes can make a compromised PC look normal. Its drivers and hooks may conceal malicious files, network traffic and services from Task Manager, Defender and ordinary uninstallers. Removing the visible application is rarely enough because the operating system itself may have been altered.

Start with isolation and a trusted recovery environment, not random driver-deleting utilities. This process suits a home computer, a small Melbourne business or a managed work laptop used by a Sydney worker. Back up irreplaceable documents first, keep the original disk untouched, and expect a clean Windows installation to be the most reliable option when kernel tampering is confirmed.

Disconnect and contain the infection

Switch off Wi-Fi, unplug Ethernet and disconnect external storage. Do not sign into banking or email from the affected PC. On a work device, contact IT rather than continuing to browse; a managed endpoint may need to remain available for investigation. This helps stop the rootkit from spreading or downloading more components.

Record what you observed, including unknown processes, disabled security tools, strange network use and the dates involved. Photograph error screens and note which accounts were used. Copy only irreplaceable photos and documents to clean media, if this can be done without running the infected system; avoid copying installers, scripts or unfamiliar archives.

If online banking is involved, use the fraud number on the back of your Australian bank card; CBA, Westpac, ANZ and NAB each have dedicated fraud processes. Your internet provider, such as Optus or Telstra, can also reset router access details if needed. Keep the reference numbers from these calls.

If startup behaviour or driver details point beyond Windows, firmware rootkit cleanup covers UEFI checks that a standard reinstall will not address. A kernel-level compromise and firmware infection are different, and occasionally occur together, so avoid assuming that resetting Windows fixes every layer.

Build a trusted rescue environment

On a separate, known-clean computer, download Microsoft Defender and, if you use one, a reputable rootkit scanner from its official site. Update the tools before connecting the infected drive. Create a rescue USB with Microsoft’s recovery media or another trusted boot image; avoid “portable” security tools from dodgy download sites.

Boot the infected PC from the USB using its boot menu. Depending on the manufacturer, that may be F12, F11, Esc or F1. Choose the option that starts the external media, not the internal drive. If Windows will not start, use the rescue environment to access system repair and backup utilities; Defender Offline is also available through Windows Recovery on supported installations.

Microsoft Defender Offline is a useful second line of defence, but it is not guaranteed to recognise every kernel rootkit. Run it from recovery media, then use the trusted USB to start a second reputable scanner if its vendor supports that mode. Keep networking disabled while investigating a suspicious machine, and never delete a driver or system file merely because a scan labels it “hidden” or “unknown”.

Remove the rootkit and check persistence

When a tool identifies a rootkit, follow the vendor’s removal instructions, quarantine the payload, and reboot into the rescue environment for another complete scan. Recheck security settings, browser extensions, scheduled tasks and installed drivers. Restore legitimate drivers only from Windows Update or the hardware maker’s support site; random driver tools can reinstall the very components you are trying to remove.

A clean scan is not proof that the kernel is trustworthy. Compare running processes and active network connections with the software you expect to see, and review Windows Event Viewer for new kernel or driver errors. If Defender repeatedly detects the same component, or files disappear again after removal, stop relying on in-place repair.

At that point, choose between “Reset this PC” using “Remove everything” followed by “Clean everything”, or perform a full clean installation. The latter gives stronger assurance because it replaces the Windows installation and its drivers. Reinstallation does not remove a malicious UEFI component, and critical business or government systems should be handled by an accredited incident-response professional.

Rebuild Windows and recover your files

Before formatting or resetting the drive, preserve any data that matters on separate, clean media. Use the rescue environment for this work, and keep the original disk disconnected afterwards. Restore known-good documents and photos rather than complete user profiles, and scan copied files before opening them.

Do not bring back executables, installers, scripts, browser profiles, password databases or unfamiliar archives from the affected system. These can carry the rootkit or other malware into a freshly installed Windows account. If files are encrypted, work on a cloned image where possible so that recovery attempts do not destroy the only copy.

Destructive ransomware changes the urgency. Removing Jigsaw ransomware explains its hourly file-deletion behaviour and why containment must come before recovery work. Australian households and businesses can use ACSC guidance, while customers with exposed banking details should contact their bank’s fraud team promptly. A cyber insurer and police may also need to become involved when business data or money has been affected.

Harden the system and confirm recovery

Reinstall or update Windows, then download the remaining drivers and applications from official sources. Enable Secure Boot where supported, use a unique firmware-administrator password, and store important credentials in a password manager with multi-factor authentication. Any household or business still relying on Windows 10 should move to a supported device, since standard support ended on 14 October 2025.

Maintain tested backups using the 3-2-1 approach, with one copy offline and another in a properly protected cloud service. If encryption was part of the incident, recovering LockBit files explains the recovery decisions that should come before restoring anything. Avoid putting sensitive documents in consumer file-sharing folders without checking access controls and MFA settings.

For several days, watch for returning alerts, unexplained traffic, disabled updates and newly created administrator accounts. Compare startup items, scheduled tasks and browser extensions with a fresh profile. The cleanup is complete only when the trusted system remains clean across repeated boots, known-good backups restore correctly, and the old compromised drive stays disconnected.