How to Remove a Rootkit

PDF download Download Article
PDF download Download Article

Removing rootkits can be difficult, as they often bury themselves deep into the operating system. If you're worried you have a rootkit, follow our guide for locating and removing it from your Windows PC or Mac.

Steps

PDF download Download Article
  1. {"smallUrl":"https:\/\/www.wikihow.com\/images\/thumb\/3\/31\/Remove-a-Rootkit-Step-1-Version-4.jpg\/v4-460px-Remove-a-Rootkit-Step-1-Version-4.jpg","bigUrl":"\/images\/thumb\/3\/31\/Remove-a-Rootkit-Step-1-Version-4.jpg\/aid2227597-v4-728px-Remove-a-Rootkit-Step-1-Version-4.jpg","smallWidth":460,"smallHeight":345,"bigWidth":728,"bigHeight":546,"licensing":"<div class=\"mw-parser-output\"><p>License: <a target=\"_blank\" rel=\"nofollow noreferrer noopener\" class=\"external text\" href=\"https:\/\/en.wikipedia.org\/wiki\/Fair_use\">Fair Use<\/a> (screenshot)<br>\n<\/p><\/div>"}
    Rootkits are hard to detect on Windows as they often disguise themselves as drivers or as critical files. Some signs that you may have a rootkit include:
    • Your device is running slow, but your antivirus software is not detecting anything.
    • You are unable to copy or find files you know exist on your machine (this is commonly used as DRM to prevent the copying or redistribution of music, movies, or video games).
    • Your device obviously has malware on it, but your antivirus software does not detect anything.
    • Your device takes a long time to start up.
    • Your hardware has stopped working correctly.
    • Other devices (like your router) are reporting that your device is using it even if you are not actively using them.
    2. Advertisement
Method 1
Method 1 of 3:

On Windows

PDF download Download Article
  1. {"smallUrl":"https:\/\/www.wikihow.com\/images\/thumb\/0\/08\/Remove-a-Rootkit-Step-2-Version-4.jpg\/v4-460px-Remove-a-Rootkit-Step-2-Version-4.jpg","bigUrl":"\/images\/thumb\/0\/08\/Remove-a-Rootkit-Step-2-Version-4.jpg\/aid2227597-v4-728px-Remove-a-Rootkit-Step-2-Version-4.jpg","smallWidth":460,"smallHeight":345,"bigWidth":728,"bigHeight":546,"licensing":"<div class=\"mw-parser-output\"><p>License: <a target=\"_blank\" rel=\"nofollow noreferrer noopener\" class=\"external text\" href=\"https:\/\/en.wikipedia.org\/wiki\/Fair_use\">Fair Use<\/a> (screenshot)<br>\n<\/p><\/div>"}
    To do so, open Windows Security, go to Virus & threat protection, and choose "Quick scan". You can also run a full scan.
    • Microsoft Defender will inform you if you need to run Microsoft Defender Offline.
  2. {"smallUrl":"https:\/\/www.wikihow.com\/images\/thumb\/b\/b7\/Remove-a-Rootkit-Step-3-Version-4.jpg\/v4-460px-Remove-a-Rootkit-Step-3-Version-4.jpg","bigUrl":"\/images\/thumb\/b\/b7\/Remove-a-Rootkit-Step-3-Version-4.jpg\/aid2227597-v4-728px-Remove-a-Rootkit-Step-3-Version-4.jpg","smallWidth":460,"smallHeight":345,"bigWidth":728,"bigHeight":546,"licensing":"<div class=\"mw-parser-output\"><p>License: <a target=\"_blank\" rel=\"nofollow noreferrer noopener\" class=\"external text\" href=\"https:\/\/en.wikipedia.org\/wiki\/Fair_use\">Fair Use<\/a> (screenshot)<br>\n<\/p><\/div>"}
    From the same screen as Virus & threat protection, choose "scan options" and choose "Microsoft Defender Offline scan". Your PC will restart.
  3. {"smallUrl":"https:\/\/www.wikihow.com\/images\/thumb\/8\/85\/Remove-a-Rootkit-Step-4-Version-3.jpg\/v4-460px-Remove-a-Rootkit-Step-4-Version-3.jpg","bigUrl":"\/images\/thumb\/8\/85\/Remove-a-Rootkit-Step-4-Version-3.jpg\/aid2227597-v4-728px-Remove-a-Rootkit-Step-4-Version-3.jpg","smallWidth":460,"smallHeight":345,"bigWidth":728,"bigHeight":546,"licensing":"<div class=\"mw-parser-output\"><p>License: <a target=\"_blank\" rel=\"nofollow noreferrer noopener\" class=\"external text\" href=\"https:\/\/en.wikipedia.org\/wiki\/Fair_use\">Fair Use<\/a> (screenshot)<br>\n<\/p><\/div>"}
    If your PC detected rootkits, it will inform you that it was able to remove them.
  4. {"smallUrl":"https:\/\/www.wikihow.com\/images\/thumb\/0\/05\/Remove-a-Rootkit-Step-5-Version-3.jpg\/v4-460px-Remove-a-Rootkit-Step-5-Version-3.jpg","bigUrl":"\/images\/thumb\/0\/05\/Remove-a-Rootkit-Step-5-Version-3.jpg\/aid2227597-v4-728px-Remove-a-Rootkit-Step-5-Version-3.jpg","smallWidth":460,"smallHeight":345,"bigWidth":728,"bigHeight":546,"licensing":"<div class=\"mw-parser-output\"><p>License: <a target=\"_blank\" rel=\"nofollow noreferrer noopener\" class=\"external text\" href=\"https:\/\/en.wikipedia.org\/wiki\/Fair_use\">Fair Use<\/a> (screenshot)<br>\n<\/p><\/div>"}
    If a rootkit has caused a deep infection, then the only way to remove the rootkit is to reinstall Windows. Do this from an external media device instead of using the built-in Windows installer.
  5. {"smallUrl":"https:\/\/www.wikihow.com\/images\/thumb\/3\/3f\/Remove-a-Rootkit-Step-6-Version-3.jpg\/v4-460px-Remove-a-Rootkit-Step-6-Version-3.jpg","bigUrl":"\/images\/thumb\/3\/3f\/Remove-a-Rootkit-Step-6-Version-3.jpg\/aid2227597-v4-728px-Remove-a-Rootkit-Step-6-Version-3.jpg","smallWidth":460,"smallHeight":345,"bigWidth":728,"bigHeight":546,"licensing":"<div class=\"mw-parser-output\"><p>License: <a target=\"_blank\" rel=\"nofollow noreferrer noopener\" class=\"external text\" href=\"https:\/\/en.wikipedia.org\/wiki\/Fair_use\">Fair Use<\/a> (screenshot)<br>\n<\/p><\/div>"}
    Some rootkits are able to infect the BIOS, which will require a repair to fix. If you still have a rootkit after a repair, you may need to get a new PC.
    6. Advertisement
Method 2
Method 2 of 3:

On Mac

PDF download Download Article
  1. {"smallUrl":"https:\/\/www.wikihow.com\/images\/thumb\/e\/ef\/Remove-a-Rootkit-Step-7-Version-3.jpg\/v4-460px-Remove-a-Rootkit-Step-7-Version-3.jpg","bigUrl":"\/images\/thumb\/e\/ef\/Remove-a-Rootkit-Step-7-Version-3.jpg\/aid2227597-v4-728px-Remove-a-Rootkit-Step-7-Version-3.jpg","smallWidth":460,"smallHeight":345,"bigWidth":728,"bigHeight":546,"licensing":"<div class=\"mw-parser-output\"><p>License: <a target=\"_blank\" rel=\"nofollow noreferrer noopener\" class=\"external text\" href=\"https:\/\/en.wikipedia.org\/wiki\/Fair_use\">Fair Use<\/a> (screenshot)<br>\n<\/p><\/div>"}
    Mac updates do not just add new features; they also remove malware, including rootkits, and fix security holes. Apple has numerous built-in security features to protect from malware, including rootkits.
  2. {"smallUrl":"https:\/\/www.wikihow.com\/images\/thumb\/4\/48\/Remove-a-Rootkit-Step-8-Version-3.jpg\/v4-460px-Remove-a-Rootkit-Step-8-Version-3.jpg","bigUrl":"\/images\/thumb\/4\/48\/Remove-a-Rootkit-Step-8-Version-3.jpg\/aid2227597-v4-728px-Remove-a-Rootkit-Step-8-Version-3.jpg","smallWidth":460,"smallHeight":345,"bigWidth":728,"bigHeight":546,"licensing":"<div class=\"mw-parser-output\"><p>License: <a target=\"_blank\" rel=\"nofollow noreferrer noopener\" class=\"external text\" href=\"https:\/\/en.wikipedia.org\/wiki\/Fair_use\">Fair Use<\/a> (screenshot)<br>\n<\/p><\/div>"}
    If your Mac detects a malicious program, it will ask you to move it to the Trash. That way, malware, including rootkits, cannot cause problems on your machine.
  3. {"smallUrl":"https:\/\/www.wikihow.com\/images\/thumb\/c\/c2\/Remove-a-Rootkit-Step-9-Version-3.jpg\/v4-460px-Remove-a-Rootkit-Step-9-Version-3.jpg","bigUrl":"\/images\/thumb\/c\/c2\/Remove-a-Rootkit-Step-9-Version-3.jpg\/aid2227597-v4-728px-Remove-a-Rootkit-Step-9-Version-3.jpg","smallWidth":460,"smallHeight":345,"bigWidth":728,"bigHeight":546,"licensing":"<div class=\"mw-parser-output\"><p>License: <a target=\"_blank\" rel=\"nofollow noreferrer noopener\" class=\"external text\" href=\"https:\/\/en.wikipedia.org\/wiki\/Fair_use\">Fair Use<\/a> (screenshot)<br>\n<\/p><\/div>"}
    Unfortunately, there are no known rootkit detectors on macOS. If you still suspect a rootkit is on your device, you should reinstall macOS. Doing so removes most apps and any possible rootkits on your machine.
  4. {"smallUrl":"https:\/\/www.wikihow.com\/images\/thumb\/a\/a7\/Remove-a-Rootkit-Step-10-Version-3.jpg\/v4-460px-Remove-a-Rootkit-Step-10-Version-3.jpg","bigUrl":"\/images\/thumb\/a\/a7\/Remove-a-Rootkit-Step-10-Version-3.jpg\/aid2227597-v4-728px-Remove-a-Rootkit-Step-10-Version-3.jpg","smallWidth":460,"smallHeight":345,"bigWidth":728,"bigHeight":546,"licensing":"<div class=\"mw-parser-output\"><p>License: <a target=\"_blank\" rel=\"nofollow noreferrer noopener\" class=\"external text\" href=\"https:\/\/en.wikipedia.org\/wiki\/Fair_use\">Fair Use<\/a> (screenshot)<br>\n<\/p><\/div>"}
    Some rootkits are able to infect the BIOS, which will require a repair to fix. If you still have a rootkit after a repair, you may need to get a new Mac.
    5. Advertisement
Method 3
Method 3 of 3:

On iOS

PDF download Download Article
  1. {"smallUrl":"https:\/\/www.wikihow.com\/images\/thumb\/1\/1b\/Remove-a-Rootkit-Step-11-Version-3.jpg\/v4-460px-Remove-a-Rootkit-Step-11-Version-3.jpg","bigUrl":"\/images\/thumb\/1\/1b\/Remove-a-Rootkit-Step-11-Version-3.jpg\/aid2227597-v4-728px-Remove-a-Rootkit-Step-11-Version-3.jpg","smallWidth":460,"smallHeight":345,"bigWidth":728,"bigHeight":546,"licensing":"<div class=\"mw-parser-output\"><p>License: <a target=\"_blank\" rel=\"nofollow noreferrer noopener\" class=\"external text\" href=\"https:\/\/en.wikipedia.org\/wiki\/Fair_use\">Fair Use<\/a> (screenshot)<br>\n<\/p><\/div>"}
    Unfortunately, there are no known rootkit detectors on iPhone. Rootkits can be difficult to remove and they often manifest themselves as developer profiles or hide themselves in jailbreaks.
  2. {"smallUrl":"https:\/\/www.wikihow.com\/images\/thumb\/7\/7c\/Remove-a-Rootkit-Step-12-Version-3.jpg\/v4-460px-Remove-a-Rootkit-Step-12-Version-3.jpg","bigUrl":"\/images\/thumb\/7\/7c\/Remove-a-Rootkit-Step-12-Version-3.jpg\/aid2227597-v4-728px-Remove-a-Rootkit-Step-12-Version-3.jpg","smallWidth":460,"smallHeight":345,"bigWidth":728,"bigHeight":546,"licensing":"<div class=\"mw-parser-output\"><p>License: <a target=\"_blank\" rel=\"nofollow noreferrer noopener\" class=\"external text\" href=\"https:\/\/en.wikipedia.org\/wiki\/Fair_use\">Fair Use<\/a> (screenshot)<br>\n<\/p><\/div>"}
    To do so, turn off your phone while it is connected to your computer. On iPhone 8 and later, press the volume up then volume down then power keys and hold the power button for three seconds. Then hold the power and volume down buttons together for ten seconds. Then release the power button and continue holding the volume down button. This will enter recovery mode.
    • On iPhone 7, you do not have to press the volume up and volume down keys at the beginning.
    • On iPhone 6s and earlier, use the home button instead.
  3. {"smallUrl":"https:\/\/www.wikihow.com\/images\/thumb\/d\/d5\/Remove-a-Rootkit-Step-13-Version-2.jpg\/v4-460px-Remove-a-Rootkit-Step-13-Version-2.jpg","bigUrl":"\/images\/thumb\/d\/d5\/Remove-a-Rootkit-Step-13-Version-2.jpg\/aid2227597-v4-728px-Remove-a-Rootkit-Step-13-Version-2.jpg","smallWidth":460,"smallHeight":345,"bigWidth":728,"bigHeight":546,"licensing":"<div class=\"mw-parser-output\"><p>License: <a target=\"_blank\" rel=\"nofollow noreferrer noopener\" class=\"external text\" href=\"https:\/\/en.wikipedia.org\/wiki\/Fair_use\">Fair Use<\/a> (screenshot)<br>\n<\/p><\/div>"}
    This will erase all data but also remove any jailbreaks and/or rootkits present on your iOS device. You can recover your downloaded apps using iCloud or iTunes backup.
    4. Advertisement


Community Q&A

Search
Add New Question
  • Question
    Isn't Kaspersky spyware?
    Achaius Dimalibot
    Community Answer
    It's not spyware. It is an antivirus software, and it also works like Windows Defender.
    Thanks! We're glad this was helpful.
    Thank you for your feedback.
    If wikiHow has helped you, please consider a small contribution to support us in helping more readers like you. We’re committed to providing the world with free how-to resources, and even $1 helps us in our mission. Support wikiHow
    Yes No
    Not Helpful 1 Helpful 0
Ask a Question
200 characters left
Include your email address to get a message when this question is answered.
Submit
      Advertisement

      Tips

      Submit a Tip
      All tip submissions are carefully reviewed before being published
      Submit
      Thanks for submitting a tip for review!

      You Might Also Like

      Turn Off Microsoft Defender in Windows 10: Temporarily or Permanently
      How to Check Your Smartphone for Pegasus Spyware
      How to
      Remove the System Volume Information Folder from a Flash Drive
      How to
      Remove a Virus
      Install Antivirus on Your Windows or Mac Computer: Easy Guide
      How to
      Disable Avast Antivirus
      How to Remove and Prevent Malware on a Computer
      How to
      Remove a Worm Virus
      How to
      Disable AVG
      2 Easy Ways to Manually Remove Adware on a Computer
      How to
      Enable Google Play Protect
      How to
      Remove Newfolder.Exe Virus
      How to
      Perform an Offline Scan with Windows 10 Defender
      How to
      Stop Norton Antivirus Startup
      Advertisement

      About This Article

      In other languages
      Thanks to all authors for creating a page that has been read 53,131 times.

      Is this article up to date?

      Advertisement