Kernel rootkit detected

What is ROOTKIT-DETECTED?

Kernel rootkit detected (ROOTKIT-DETECTED) is a critical-severity fault affecting the malware/security. A kernel-level rootkit has been detected on the system. Rootkits modify the Windows kernel, bootloader, or firmware to hide their presence from standard antivirus tools. They intercept system calls to conceal malicious processes, files, and network connections. Detection is typically only possible with specialized offline scanners or Secure Boot verification checks. Another common trigger is exploitation of signed driver vulnerabilities. See the troubleshooting steps below for the fix.

Common Causes

• Malicious software with kernel driver
• Bootkit infection from compromised boot media
• Exploitation of signed driver vulnerabilities

Step-by-Step Fix Guide

• 1
  Boot from Windows Defender Offline scan USB

  A confirmed kernel rootkit typically requires a complete OS reinstallation to guarantee system integrity — no tool can reliably verify that every component has been cleaned.

• 2
  Rebuild BCD and MBR from Windows recovery

  Secure Boot with a fresh OS install prevents bootkit-type rootkits from persisting across reinstallation.

• 3
  Consider full system wipe — rootkits are rarely fully removable

  Try "Consider full system wipe — rootkits are rarely fully removable" next if the issue persists — it addresses a secondary cause.

Commands & Diagnostics

Frequently Asked Questions