How to remove rootkit virus? Where to download free rootkit detection and removal software? A rootkit virus, trojan, spyware and worm is a malware program that has administrator level access to all the network system. What it does is it burrows itself deep into the system and hides itself, making it almost invisible and hard to be removed and detected by antivirus.
Usually rootkit malware monitor traffic, keystroke and allow backdoor access for spreading viruses and trojans, some even turn your computer into a botnet – a term known as sending out spam mail via your computer without you ever knowing.
It is hard for normal antivirus to detect their presence because rootkit tend to bootup along with windows before the antivirus is booted up. Most antivirus now comes with rootkit detector and detection ability, not to mention the ability to remove these rootkit, however, if the rootkit malware is presence prior to the installation of the new antivirus, then it is not possible for the antivirus to detect it.
↓ 01 – avast! aswMBR
aswMBR is the rootkit scanner that scans for MBR/VBR/SRV rootkits. It can detect TDL4/3(Alureon), ZAccess, MBRoot (Sinowal), Whistler, SST, Cidox, Pihar and other malware. The current version of aswMBR uses “Virtualization Technology” to improve detection of stealth malware. Please note that to use this feature your machine & CPU must support hardware virtualization.
↓ 02 – GMER
GMER is an application that detects and removes rootkits. It scans for hidden processes, hidden threads, hidden modules, hidden services, hidden files, hidden disk sectors (MBR), hidden Alternate Data Streams, hidden registry keys, drivers hooking SSDT, drivers hooking IDT, drivers hooking IRP calls and inline hooks.
↓ 03 – Bitdefender Rootkit Remover
The Bitdefender Rootkit Remover deals with known rootkits quickly and effectively making use of award-winning Bitdefender malware removal technology. Unlike other similar tools, Bitdefender Rootkit Remover can be launched immediately, without the need to reboot into safe mode first (although a reboot may be required for complete cleanup).
Rootkit Remover deals easily with Mebroot, all TDL families (TDL/SST/Pihar), Mayachok, Mybios, Plite, XPaj, Whistler, Alipop, Cpd, Fengd, Fips, Guntior, MBR Locker, Mebratix, Niwa, Ponreb, Ramnit, Stoned, Yoddos, Yurn, Zegost and also cleans infections with Necurs (the last rootkit standing). Both x86 and x64 Rootkit Remover kits are available, please choose the appropriate one for your system.
↓ 04 – Kaspersky Lab TDSSKiller
Developed by Kaspersky Lab, TDSSKiller is a FREE handy tool that can quickly detect and remove both known and unknown rootkits, which are programs that can hide the presence of malware in your system. A rootkit for Windows systems is a program that penetrates into the system and intercepts the system functions (Windows API). It can effectively hide its presence by intercepting and modifying low-level API functions. Moreover it can hide the presence of particular processes, folders, files and registry keys. Some rootkits install its own drivers and services in the system (they also remain “invisible”). The TDSSKiller utility detects and removes the following malware:
- Malware family Rootkit.Win32.TDSS;
List of malicious programs: Rootkit.Win32.TDSS, Rootkit.Win32.Stoned.d, Rootkit.Boot.Cidox.a, Rootkit.Boot.SST.a, Rootkit.Boot.Pihar.a,b,c, Rootkit.Boot.CPD.a, Rootkit.Boot.Bootkor.a, Rootkit.Boot.MyBios.b, Rootkit.Win32.TDSS.mbr, Rootkit.Boot.Wistler.a, Rootkit.Win32.ZAccess.aml,c,e,f,g,h,i,j,k, Rootkit.Boot.SST.b, Rootkit.Boot.Fisp.a, Rootkit.Boot.Nimnul.a, Rootkit.Boot.Batan.a, Rootkit.Boot.Lapka.a, Rootkit.Boot.Goodkit.a, Rootkit.Boot.Clones.a, Rootkit.Boot.Xpaj.a, Rootkit.Boot.Yurn.a, Rootkit.Boot.Prothean.a, Rootkit.Boot.Plite.a, Rootkit.Boot.Geth.a, Rootkit.Boot.CPD.b, Backdoor.Win32.Trup.a,b, Backdoor.Win32.Sinowal.knf,kmy, Backdoor.Win32.Phanta.a,b, Virus.Win32.TDSS.a,b,c,d,e, Virus.Win32.Rloader.a, Virus.Win32.Cmoser.a, Virus.Win32.Zhaba.a,b,c, Trojan-Clicker.Win32.Wistler.a,b,c, Trojan-Dropper.Boot.Niwa.a, Trojan-Ransom.Boot.Mbro.d, e, Trojan-Ransom.Boot.Siob.a, Trojan-Ransom.Boot.Mbro.f.
Malwarebytes Anti-Rootkit BETA drills down and removes even deeply embedded rootkits. Malwarebytes Anti-Rootkit BETA is cutting edge technology for detecting and removing the nastiest malicious rootkits. Removes and repairs the latest rootkits and the damage they cause.
McAfee RootkitRemover is a stand-alone utility used to detect and remove complex rootkits and associated malware. Currently it can detect and remove ZeroAccess, Necurs and TDSS family of rootkits. McAfee Labs plans to add coverage for more rootkit families in future versions of the tool.
↓ 07 – Norton Power Eraser
Norton Power Eraser uses our most aggressive scanning technology to eliminate threats that traditional virus scanning doesn’t always detect, so you can get your PC back. Because Norton Power Eraser is an aggressive virus removal tool, it may mark a legitimate program for removal. However, you can always undo the results of a scan. It can also help detect and remove Potentially Unwanted Programs.
↓ 08 – Trend Micro RootkitBuster
Malicious software called rootkits can manipulate the components of the Microsoft Windows operating system to conceal how they cause harm. Rootkits can hide drivers, processes, and registry entries from tools using common system application programming interfaces (APIs). Trend Micro RootkitBuster scans hidden files, registry entries, processes, drivers, services, ports, and the master boot record (MBR) to identify and remove rootkits.
↓ 09 – UnHackMe | Free 30 Days
UnHackMe was initially created as anti-rootkit software (2005), but currently eliminates the following types of malicious software – Search redirecting, Popup ads, Potentially unwanted programs (PUPs), Unwanted processes, Slow browsing, Rootkits, Trojans, Spyware, Keyloggers and etc.
↓ 10 – AntiSpy
AntiSpy is a free but powerful anti virus and rootkits toolkit.It offers you the ability with the highest privileges that can detect,analyze and restore various kernel modifications and hooks.With its assistance,you can easily spot and neutralize malwares hidden from normal detectors.
↓ 11 – NoVirusThanks Anti-Rootkit
NoVirusThanks Anti-Rootkit is a sophisticated low-level system analysis tool whose main goal is to detect the presence of malware and rootkits. Hidden processes, hidden drivers, stealth DLL modules, code hooks etc. are just a few of the objects which can be detected in user space and system memory.
NoVirusThanks Anti-Rootkit is a must-have for anyone seeking true 32-bit Windows NT kernel security and system threat analysis. The vast detection range of industry standard rootkits is truly amazing especially without compromising system stability even in the most hostile, malware-plagued environments. It is recommended to use this software by experienced users. NoVirusThanks Anti-Rootkit is fully compatible with the following 32-bit Microsoft Windows Operating Systems: Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows Server 2012, Windows 7
↓ 12 – PCHunter anti-rootkit
PCHunter anti-rootkit is a free and handy toolkit for Windows with various powerful features for kernel structure viewing and manipulation. It offers you the ability with the highest privileges to detect, analyze and restore various kernel modifications and gives you a wide scope of the kernel. With its assistance, you can easily spot and neutralize malwares hidden from normal detectors.
↓ 13 – RADIX
Rootkits are dangerous programs that are downloaded from the Internet, or present in malicious purchased software, that once installed take over your computer without your knowledge. Rootkits can do anything from logging every one of your keystrokes, including user names and passwords, email messages or even your word processing documents and sending that data off to hackers, to executing programs in the background without your knowledge or permission.
And there’s nothing that you can do about it unless you take the time right now to install Radix. It’s your best hope against combating Rootkit Attacks. Here’s what Radix does…
- Detects and removes Rootkits using sophisticated methodologies.
- Detects and repairs drivers that have been modified by Rootkits.
- Detects and repairs computer processes modified by Rootkits.
- Detects and reveals hidden processes and files, including Alternate Data Streams (ADS).
- Allows the removal of “locked” or “unremovable” processes and files.
- Provides to dump memory areas from processes.
- Shows the Global Descriptor Table (GDT) for advanced Rootkit Detection capabilities.
- Shows the Import Address Table (IAT) for advanced Rootkit Detection capabilities.
- Shows the Interrupt Descriptor Table (IDT) for advanced Rootkit Detection capabilities.
- Shows hidden Registry Keys.
- Operates in both command line mode for power users, or as a graphical tool for regular users.
↓ 14 – Sophos Virus Removal Tool
Sophos Virus Removal Tool scans, detects, and removes any rootkit that is hidden on your computer using advanced rootkit detection technology. Rootkits can lie hidden on computers and remain undetected by antivirus software. Although new rootkits can be prevented from infecting the system, any rootkits present before your antivirus was installed may never be revealed. Sophos Virus Removal Tool will scan your computer and let you safely and reliably detect and remove any rootkit that might have hidden itself on your system.
↓ 15 – Emsisoft Emergency Kit
The Emsisoft Emergency Kit Scanner includes the powerful Emsisoft Scanner complete with graphical user interface. Scan the infected PC for Viruses, Trojans, Spyware, Adware, Worms, Dialers, Keyloggers and other malicious programs.
↓ 16 – Microsoft RootkitRevealer
RootkitRevealer is an advanced rootkit detection utility. It runs on Windows XP (32-bit) and Windows Server 2003 (32-bit), and its output lists Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit. RootkitRevealer successfully detects many persistent rootkits including AFX, Vanquish and HackerDefender (note: RootkitRevealer is not intended to detect rootkits like Fu that don’t attempt to hide their files or registry keys). If you use it to identify the presence of a rootkit please let us know!
The reason that there is no longer a command-line version is that malware authors have started targetting RootkitRevealer’s scan by using its executable name. We’ve therefore updated RootkitRevealer to execute its scan from a randomly named copy of itself that runs as a Windows service. This type of execution is not conducive to a command-line interface. Note that you can use command-line options to execute an automatic scan with results logged to a file, which is the equivalent of the command-line version’s behavior.
What Is A Rootkit Virus?
A rootkit is a stealthy type of software, it is designed to hide the existence of certain processes or programs from normal methods of detection and enable continued privileged access to a computer. Rootkit detection is difficult because a rootkit may be able to subvert the software that is intended to find it. In most cases, you will need a special antivirus software to root out the virus. Wikipedia has more on Rootkit.
How To Know If My Windows Is Infected With Rootkit?
The only way to know is to download one of these anti-rootkit detection software. In some cases, the rootkit virus found a way to disable your antivirus, the best method to clean your system is to perform a scan via DOS.
Preparation Before Cleaning The System
Rootkit detectors are a specific class of antivirus programs. Most of the time you are required to disable the ‘System Restore’ feature and boot into safe mode via F8 and perform the cleaning.
Computer Threats Info-graphic