Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A list of rootkit detection and/or removal tools from publicly trusted sources:

Name, Vendor, Latest release

RootkitRevealer, Sysinternals, November 1 2006

Rootkit Unhooker, ep_x0ff (now working at Microsoft according to, December 2007

F-Secure Blacklight, F-Secure, Unknown

GMER, GMER, March 2009

Microsoft Malicious Software Removal Tool, Microsoft, April 2009

IceSword, Unknown, September 2005

Please add any trusted tools that you know of to the list.


locked by HopelessN00b Dec 5 '14 at 7:52

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.


RootkitRevealer is an advanced rootkit detection utility. It runs on Windows NT 4 and higher and its output lists Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit. RootkitRevealer successfully detects many persistent rootkits including AFX, Vanquish and HackerDefender (note: RootkitRevealer is not intended to detect rootkits like Fu that don't attempt to hide their files or registry keys).


F-secure blacklight (free, Windows)


GMER, GMER, March 2009

One of the most complete and updated scanner/fixer, I found that it could find the most rootkits, and has a steady stream of updates.


I have had occasional success using the Ultimate Boot CD for Windows so that I can run an "offline" scan of the infected system. The Achilles Heel of most well-known root kit scanners is that the root kits know about them as well. See:


Rootkit Unhooker, ep_x0ff (now working at Microsoft), December 2007


For Linux:
chkrootkit, Pangeia Informatica (BSD Open Source) 12/17/2007
rkhunter, (GPL Open Source project) 12/31/2008


"ThreatExpert is an advanced automated threat analysis system designed to analyze and report the behavior of computer viruses, worms, trojans, adware, spyware, and other security-related risks in a fully automated mode." --

"Our free software, Sophos Anti-Rootkit scans, detects and removes any rootkit that is hidden on your computer using advanced rootkit detection technology." --

"SuperAntiSpyware. Detect and Remove Spyware, Adware and Remove Malware, Trojans, Dialers, Worms, KeyLoggers, HiJackers, Parasites, Rootkits, Rogue Security Products and many other types of threats." --

('sorry, new users aren't allowed to add hyperlinks'. Can someone edit this and activate the links please)


Not the answer you're looking for? Browse other questions tagged or ask your own question.