Windows 10 rootkit tools: which ones scan before Windows loads

Part of our guide on secure hacked google account

A rootkit can lie to Windows itself, so only a scan that boots before Windows can see it.

Why an in-Windows scan misses a rootkit that hides in the kernel

Say you run a scan inside Windows and it reports no threats. Say you reboot and the browser still redirects, and a process you killed yesterday is back but hidden from Task Manager.

A kernel-mode rootkit loads with Windows 10 before your antivirus does. It hooks the same API calls your scanner uses to list files, processes and registry keys. What you see is what the rootkit lets you see.

An in-Windows scanner asks the operating system for the truth, and a hooked system lies. That is why offline scan results differ from in-Windows results even with the same engine. The difference depends on whether the rootkit is kernel-mode or just user-mode adware pretending to be deep.

An offline scan boots a clean mini-OS from USB or WinRE. It reads the NTFS drive as data, not as a running system. It sees hidden drivers in C:\Windows\System32\drivers, altered Master Boot Record code, and patched system files without asking the infected kernel for permission. That's the catch. There is more on remove recurring scam pop ups in a separate guide.

Rootkit removal tools for Windows 10 that still offer offline or boot-time scanning

Picture two friends with the same Windows 10 laptop. One installs a scanner inside Windows and hopes for the best. The other boots a scanner from USB and catches a driver the first scan never saw.

For Windows 10 and 11 the free option that still offers a true offline pass is Windows Defender Offline. You launch it from Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan, or you create boot media with the Windows Defender Offline tool on a clean PC. It reboots into WinRE and scans before Windows loads.

Kaspersky TDSSKiller and Malwarebytes Free do not boot before Windows. They run inside Windows and target rootkit families like TDSS, Alureon and ZeroAccess by checking loaded drivers, services and MBR anomalies against signatures. They help as a second opinion after the offline pass, not as the first look. We cover staying safe from hacks in its own article.

ESET SysRescue and Kaspersky Rescue Disk still provide fully bootable USB environments built on Linux or WinPE. You download the ISO, flash it with Rufus or Etcher on a clean PC, boot via UEFI boot menu, and scan the offline Windows drive. Availability changes, so download from the vendor site on a clean device and check the date on the rescue image.

• Windows Defender Offline: built into Windows 10/11, reboots into WinRE, scans before kernel loads, free.
• ESET SysRescue: bootable USB, offline scan of NTFS drive, free rescue image, needs clean PC to create.
• Kaspersky Rescue Disk: bootable USB, offline scan, free, useful when Defender Offline fails to start.
• TDSSKiller: in-Windows, fast driver and MBR check, free, run after offline scan.
• Malwarebytes Free: in-Windows, second-opinion anti-rootkit and adware clean, free scan, no boot-time mode.

Exact order to run offline first, then second opinion, then verification

Say you have one hour and a PC that may have a bootkit. Run things in the wrong order and you waste that hour. Run them in the right order and each scan proves the last one.

The rule is simple and strict. Offline scan first, second-opinion scan second, verification last. You do not install new software before the offline pass. You do not log into accounts until verification is done. For the detail, see our notes on which 2fa methods block hackers.

Offline tools catch what hides from Windows. In-Windows tools catch what the offline engine misses in registry and scheduled tasks. Verification proves the rootkit is not replanting itself on reboot. Skip verification and you will think you are clean when you are not.

This sequence works on Windows 10 Home and Pro, UEFI or Legacy BIOS, SSD or HDD. Scan time usually runs 15-60 minutes offline and 5-20 minutes for the in-Windows second opinion, depending on drive size, file count and whether you scan archives.

1. Disconnect from internet, then back up personal files to an external drive without running any installer. Do not back up programs or system images.
2. Run Windows Defender Offline. Go to Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan > Scan now. The PC reboots and scans before Windows loads. If it will not start, boot ESET SysRescue or Kaspersky Rescue Disk from USB instead.
3. Reboot into normal Windows, stay offline, run Kaspersky TDSSKiller. Choose Start scan, cure or delete what it flags, and reboot if asked. Do not skip the reboot.
4. Run Malwarebytes Free Threat Scan inside Windows. Quarantine what it finds. Keep the log.
5. Reconnect briefly to update definitions, then run a second offline scan with the same rescue media. A clean second offline pass is your proof. If it still finds the same driver or MBR infection, stop and prepare to clean-install.

How to tell removal worked versus when to back up and clean-install Windows

Picture a scan that says threats removed and the PC feels faster. You log into your bank and the next day the same redirect is back. The rootkit was not gone, it was sleeping. For the detail, see our notes on immediate actions for hacked account.

Removal worked when three things line up. The second offline scan shows no infected drivers or MBR code. The in-Windows scans show no hidden services or patched system files. And the symptoms stay gone after two reboots and a full day offline, including no new unknown drivers in C:\Windows\System32\drivers and no proxy or DNS change.

You should back up and clean-install when the opposite happens. The same file comes back after two offline cleans, or Windows will not boot to the offline environment, or SFC keeps finding altered system files. A bootkit that rewrites firmware or the EFI partition rarely cleans reliably. That is the trade-off you accept.

To clean-install safely, back up only documents, photos and browser bookmarks to an external drive. Scan that drive from a clean PC before you copy anything back. Reinstall Windows 10 from Microsoft media created on a clean PC, delete all partitions during setup, and install drivers only from the PC maker site. Change passwords from the clean install, not from the old system. We cover hotmail spoofed emails continue in its own article.

• Signs it worked: second offline scan clean, no unknown driver with recent date, Task Manager shows all processes, network proxy set to off.
• Signs it failed: same threat name returns, Defender Offline will not complete, random BSOD after removal, browser proxy resets itself.
• Back up: documents and photos only, scan the backup elsewhere, do not keep program installers.
• Clean install: use Media Creation Tool on a clean PC, boot from USB, delete partitions, install fresh.

Common mistakes that keep rootkits alive after you think they are gone

Say you clean the main drive and restore a system image from last month to save time. You just restored the rootkit with it. Or you clean the PC but plug the same infected USB back in.

Myth: a quick scan is enough if it says clean. Fact: quick scans skip the EFI partition, recovery partition and many drivers where rootkits hide. Run a full offline scan that includes system areas, not a quick in-Windows pass.

Myth: one antivirus is enough, so a second opinion is overkill. Fact: no single engine sees every family. Defender Offline plus one targeted tool like TDSSKiller covers more behaviors. Think of it like two different flashlights in the same dark room.

Myth: restoring from a restore point removes a rootkit. Fact: restore points live on the same infected drive and often preserve the driver or MBR code. Use them only after verification, not as the fix. The rule of thumb for this work: clean before you restore, never restore to clean.

• Mistake: creating rescue USB on the infected PC – build it on a clean PC.
• Mistake: staying online during cleanup – disconnect until the second offline scan is clean.
• Mistake: trusting one clean result – require both offline and in-Windows clean.
• Mistake: copying back old drivers or cracks – they often carry the loader.

How to choose and harden Windows 10 so rootkits do not return

Say you just cleaned a rootkit and want it to stay that way. You reinstall the same free optimizer that dropped the loader last time. The cycle repeats.

Choose tools by one promise that matters here: does it scan before Windows loads? If yes, it can see kernel hooks. If no, it is a second opinion only. For most home users Windows Defender Offline plus a second-opinion scanner covers the need without paying. Paid suites add real-time protection but do not change the offline-first order.

Harden the path rootkits use. Keep Windows 10 updated so patched vulnerabilities do not stay open. Leave Secure Boot on in UEFI, keep UAC on, and use a standard user account for daily work. Admin rights let a rootkit write its driver without a prompt.

Keep a rescue USB ready before you need it. Update it every few months and label it. Back up files weekly to an external drive you then disconnect. An offline backup you can scan is worth more than any scanner after the fact. Small steps now stop a long night later.

• Keep Secure Boot on, keep Windows Update on, keep Defender real-time on.
• Use standard account daily, admin only for installs, enable UAC.
• Keep one offline backup disconnected, plus a rescue USB made on a clean PC.
• Avoid pirated drivers and activators, they bundle bootkit loaders more than any other source.

Questions people still ask

I have cleaned bootkits where only the offline scan saw the hidden driver, and the second offline pass was the only proof that mattered.