A list of Windows rootkit detection and removal tools

Question

A list of rootkit detection and/or removal tools from publicly trusted sources:

Name, Vendor, Latest release

RootkitRevealer, Sysinternals, November 1 2006

Rootkit Unhooker, ep_x0ff (now working at Microsoft according to Rootkit.com), December 2007

F-Secure Blacklight, F-Secure, Unknown

GMER, GMER, March 2009

Microsoft Malicious Software Removal Tool, Microsoft, April 2009

IceSword, Unknown, September 2005

Please add any trusted tools that you know of to the list.

Solution 1

RootkitRevealer

RootkitRevealer is an advanced rootkit detection utility. It runs on Windows NT 4 and higher and its output lists Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit. RootkitRevealer successfully detects many persistent rootkits including AFX, Vanquish and HackerDefender (note: RootkitRevealer is not intended to detect rootkits like Fu that don't attempt to hide their files or registry keys).

Solution 2

F-secure blacklight (free, Windows)

Solution 3

GMER, GMER, March 2009

One of the most complete and updated scanner/fixer, I found that it could find the most rootkits, and has a steady stream of updates.

Solution 4

I have had occasional success using the Ultimate Boot CD for Windows so that I can run an "offline" scan of the infected system. The Achilles Heel of most well-known root kit scanners is that the root kits know about them as well. See: http://www.microsoft.com/emea/itsshowtime/sessionh.aspx?videoid=359

View more solutions