What to do when rootkit files evade Windows Defender scans

Rootkits are among the nastiest pieces of malware floating around the web, and Australians have been copping more than their fair share lately. The Australian Cyber Security Centre logged a record number of incidents last year, with many tracing back to kernel-level threats that quietly burrow into Windows systems. When one of these infections decides to mask its own files, even the built-in Microsoft Defender can scan right past them without raising a flag.

The reason is technical. These threats load before the operating system's security stack fully initialises, then patch memory structures so that the file system appears clean. On a typical Aussie home setup running Windows 11 over an NBN connection through Telstra or Optus, the infection often arrives bundled with pirated software or a dodgy attachment opened during the afternoon. By the time the user reboots, the payload has already rewritten parts of the boot sequence.

Getting rid of it takes more than a right-click scan. The following walkthrough covers how to spot the warning signs, set up a boot-time scan, run offline removal tools, and verify that the hidden files are actually gone. If the infection includes a keylogger stealing credentials, the removing keyloggers that steal emailed passwords guide walks through the credential side of the cleanup in detail.

Why rootkits hide their tracks from real-time protection

Kernel-mode rootkits sit at the same privilege level as the operating system itself. They hook system calls so that when Defender asks "show me the files in this folder," the rootkit intercepts the request and returns a sanitised list. Bootkits go further by infecting the Master Boot Record, which means the malicious code runs before Windows even finishes loading.

Microsoft Defender is a solid baseline product, but it relies on file system minifilters and user-mode hooks that an established rootkit can simply disable. Many small businesses in suburbs around Melbourne and Adelaide still treat Defender as their only line of defence, and that is exactly the gap cybercriminals exploit. Once the threat is running at ring 0, scanning from within the live operating system is like asking the fox to count the hens.

Warning signs that point to a hidden infection

Performance weirdness is usually the first clue. The fan spins up for no reason, programs take longer to launch, and file searches crawl. Network activity is another giveaway; the modem lights flicker away even when no one is browsing. Some users in Brisbane have reported phantom outbound connections to overseas IPs showing up in their router logs.

Phishing remains the most common entry point, and Scamwatch has flagged several campaigns impersonating Australia Post and the big banks. Clicking the wrong link can drop a loader that fetches the rootkit in stages. If anything looks off, it pays to lodge a report through ReportCyber so the ACSC has visibility on emerging patterns.

Setting up a boot-time and offline scan

The trick to catching a hidden rootkit is scanning from outside the live operating system. Windows includes a Microsoft Defender Offline feature that boots into a minimal environment, runs a full scan, and then restarts back into normal Windows. It can be triggered from the Windows Security app or by booting from a USB recovery drive.

Before kicking off an offline scan, disconnect from the network. Pull the Ethernet cable, switch off Wi-Fi, and if the household relies on a Telstra or TPG modem, power it down too. Cutting the connection stops the rootkit from phoning home or downloading fresh payloads while the scanner is working. If the main PC cannot reach the internet to grab the offline tool, use a mate's laptop or head to a local library in Perth or Hobart to download it onto a clean USB stick.

Running dedicated rootkit removal tools

After the offline scan, follow up with a dedicated rootkit hunter. Kaspersky TDSSKiller, Malwarebytes Anti-Rootkit, and Bitdefender's Rootkit Remover are all free utilities that target specific kernel-level families. Run them one at a time, reboot between each, and note anything they flag.

Manual cleanup is sometimes still required. Boot into Safe Mode with Command Prompt, open Disk C in Explorer with hidden and system files visible, and look for unfamiliar executables in System32, Drivers, and Tasks folders. Anything that does not belong to a known Microsoft component should be researched before deletion. Backing up the registry first is a smart move, since a wrong edit in the Tasks folder can brick the boot sequence.

For broader malware advice and removal walkthroughs, the Pc Malware Expert site collects step-by-step guides covering trojans, ransomware, and other nasties on Windows and Mac.

Comparing free rootkit removal utilities

Tool	Scan type	Targets	Needs reboot	Cost
Kaspersky TDSSKiller	Kernel scan	TDSS, Sinowal, Whistler	No	Free
Malwarebytes Anti-Rootkit	Offline scan	Generic rootkits	Yes	Free
Bitdefender Rootkit Remover	Boot-time scan	MBR infections	Yes	Free
Microsoft Defender Offline	Offline scan	Broad signatures	Yes	Built-in
GMER	Kernel scan	Hidden processes, SSDT hooks	No	Free

Each tool has strengths, so running two of them back-to-back catches more than any single scanner. Once the scans come back clean, change every password stored on the affected machine from a separate device, enable multi-factor authentication, and keep an eye on bank statements over the following weeks.