Malware · critical

How to fixROOTKIT-DETECTED

Kernel rootkit detected

What this error means

Kernel rootkit detected (ROOTKIT-DETECTED) is a critical-severity fault affecting the malware/security. A kernel-level rootkit has been detected on the system. Rootkits modify the Windows kernel, bootloader, or firmware to hide their presence from standard antivirus tools. They intercept system calls to conceal malicious processes, files, and network connections. Detection is typically only possible with specialized offline scanners or Secure Boot verification checks. Another common trigger is exploitation of signed driver vulnerabilities. See the troubleshooting steps below for the fix.

Before you begin

Save open work and back up important files. Note any recent driver or hardware changes. If Windows cannot start, use the startup guide first.

Work through these checks

0 of 3 complete
01Boot from Windows Defender Offline scan USB

Boot from Windows Defender Offline scan USB.

Use the instructions for your exact device and operating system. Check the manufacturer’s documentation before changing firmware, hardware, or system settings.

I need help
02Rebuild BCD and MBR from Windows recovery

Rebuild BCD and MBR from Windows recovery.

Use the instructions for your exact device and operating system. Check the manufacturer’s documentation before changing firmware, hardware, or system settings.

I need help
03Consider full system wipe — rootkits are rarely fully removable

Consider full system wipe — rootkits are rarely fully removable.

Use the instructions for your exact device and operating system. Check the manufacturer’s documentation before changing firmware, hardware, or system settings.

I need help

Possible causes

  • Malicious software with kernel driver
  • Bootkit infection from compromised boot media
  • Exploitation of signed driver vulnerabilities