Malware · critical

How to fixROOTKIT-DETECTED

Kernel rootkit detected

What this error means

Kernel rootkit detected (ROOTKIT-DETECTED) is a critical-severity fault affecting the malware/security. A kernel-level rootkit has been detected on the system. Rootkits modify the Windows kernel, bootloader, or firmware to hide their presence from standard antivirus tools. They intercept system calls to conceal malicious processes, files, and network connections. Detection is typically only possible with specialized offline scanners or Secure Boot verification checks. Another common trigger is exploitation of signed driver vulnerabilities. See the troubleshooting steps below for the fix.

Before you begin

Save open work and back up important files. Use instructions for your exact device and software version. If Windows cannot start, see the startup guide.

Work through these checks

0 of 3 complete
01Boot from Windows Defender Offline scan USB
  1. Boot from Windows Defender Offline scan USB
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
02Rebuild BCD and MBR from Windows recovery
  1. Rebuild BCD and MBR from Windows recovery
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
03Consider full system wipe — rootkits are rarely fully removable
  1. Consider full system wipe — rootkits are rarely fully removable
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors

Possible causes

  • Malicious software with kernel driver
  • Bootkit infection from compromised boot media
  • Exploitation of signed driver vulnerabilities