Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteFor a supported Windows 10 or Windows 11 PC with a credible rootkit concern, start with Microsoft Defender Offline. It restarts the computer and scans from outside the normal Windows environment, making it a stronger first step against malware designed to hide while Windows is running. If you want a second opinion, Malwarebytes documents an optional rootkit check in a Custom Scan, but it takes longer and can produce false positives. No scanner can guarantee that a system is clean.
Which free rootkit scanner should you use?
| Option | How it scans | Best fit | Important limits |
|---|---|---|---|
| Microsoft Defender Offline | Restarts Windows and scans from a trusted environment outside the usual Windows kernel. | A first scan when a Windows 10 or 11 infection is suspected. | Requires a restart; prerequisites and supported hardware vary. A clean result is not a guarantee. |
| Malwarebytes for Windows Custom Scan | Offers an optional “Scan for rootkits” setting in Advanced Scan > Custom Scan. | A second opinion when the feature is available in the installed product. | Increases scan time; the vendor warns results are more likely to be false positives. ARM-based devices do not have this setting. |
| Microsoft bootable Defender Offline media | Runs a scan from bootable CD/DVD/USB media. | Legacy Windows 7 SP1 or Windows 8.1 workflows. | Legacy method; making the USB media reformats it and erases existing contents. |
A rootkit is designed to conceal malware or its activity by interfering with what the operating system reports. Microsoft warns that once a rootkit infects a device, its own reported state may not be trustworthy. That is why an offline scan is a sensible starting point when the suspicion is concrete, rather than relying only on a scan performed inside the potentially compromised Windows session. See Microsoft’s Defender Offline documentation and its general scan guidance.
Run Microsoft Defender Offline on Windows 10 or 11
Check support and prerequisites
On Windows 10 version 1607 or newer and Windows 11, the scan can be launched from Windows Security. Microsoft’s documented support list also includes x64 Windows 10 and Windows 11, plus x86/x64 Windows 8.1 and Windows 7 SP1 for the offline scan; ARM versions of Windows 10 and 11 and Windows Server SKUs are excluded. The endpoint guidance requires local administrator privileges and Windows Recovery Environment (WinRE) to be enabled. If BitLocker protects the system drive, suspend protection before starting to avoid a recovery-key prompt on restart. Check Microsoft’s current platform and prerequisite guidance for your device.
Start the scan
- Save open documents and other work; the scan restarts the computer.
- Open Windows Security and go to Virus & threat protection.
- Select Scan options, choose Microsoft Defender Offline scan, then select Scan now.
- Confirm the restart. The computer scans outside the ordinary Windows environment and then restarts back into Windows.
- After signing back in, open Windows Security > Virus & threat protection > Protection history to review the outcome.
Microsoft Learn gives about 15 minutes as the scan’s approximate duration; the time on an individual device can vary. Follow Microsoft’s full Defender Offline instructions if the option is missing or the scan cannot start.
#1 Best Overall
- Less chaos, more calm. The refreshed design of Windows 11 enables you to do what you want effortlessly.
- Biometric logins. Encrypted authentication. And, of course, advanced antivirus defenses. Everything you need, plus more, to protect you against the latest cyberthreats.
- Make the most of your screen space with snap layouts, desktops, and seamless redocking.
- Widgets makes staying up-to-date with the content you love and the news you care about, simple.
- Stay in touch with friends and family with Microsoft Teams, which can be seamlessly integrated into your taskbar. (1)
Use Malwarebytes as an optional second opinion
Malwarebytes’ help documentation describes rootkit scanning as an optional feature in Malwarebytes for Windows. Availability can depend on the installed product and interface, so do not assume every edition, plan, region, or version offers the same option. The vendor’s current instructions identify the feature with Malwarebytes Device Protection & Antivirus; check the app you have rather than assuming feature parity.
- In Malwarebytes, open Scanner > Advanced Scan > Custom Scan.
- Enable Scan for rootkits.
- Select C: so the entire system drive is included, then configure the remaining scan options.
- Start the scan and review any detections before taking action.
Malwarebytes says this option adds significant scan time and warns that results are more likely to be false positives because rootkits have become increasingly rare. The option is available only for Custom Scans and is unavailable on ARM-based devices, according to its rootkit scanning instructions and scan settings documentation.
Rank #2
- Dual USB-A & USB-C Bootable Drive – compatible with nearly all Windows PCs, laptops, and tablets (UEFI & Legacy BIOS). Works with Surface devices and all major brands.
- Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
- Complete Windows Repair Toolkit – includes tools to remove viruses, reset passwords, recover lost files, and fix boot errors like BOOTMGR or NTLDR missing.
- Reinstall or Upgrade Windows – perform a clean reinstall of Windows 7 (32bit and 64bit), 10, or 11 (amd64 + arm64) to restore performance and stability. (Windows license not included.). Includes Full Driver Pack – ensures hardware compatibility after installation. Automatically detects and installs drivers for most PCs.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
What a clean scan or a discrepancy means
A clean result means the scanner did not report a detection; it does not prove that no rootkit exists. Rootkits can interfere with system reporting, and Microsoft Sysinternals cautions that detection from within a running system has inherent limits: “In general, not from within a running system.” It also says “there will never be a universal rootkit scanner.” Read Microsoft Sysinternals’ RootkitRevealer documentation for an explanation of the issue.
A discrepancy is not proof of infection, either. RootkitRevealer compares what high-level Windows APIs report with lower-level filesystem and registry data. Benign filesystem details or changes that occur while a scan is running can create differences. Treat a finding as a reason to investigate, not as a verdict by itself.
Recommended Free Tools
Rank #3
- Does Not Fix Hardware Issues - Please Test Your PC hardware to be sure everything passes before buying this USB Windows 11 Software Recovery USB.
- Make sure your PC is set to the default UEFI Boot mode, in your BIOS Setup menu. Most all PC made after 2013 come with UEFI set up and enabled by Default
- Does Not Include A KEY CODE, LICENSE OR A COA. Use your Windows KEY to preform the REINSTALLATION option
- Free tech support
What to do if the scanner finds something—or the problem persists
- Review the detection in the security product’s history or results view and follow its supported quarantine or removal workflow. Avoid deleting unfamiliar system files manually based only on a scan report.
- Install operating-system and app updates, be cautious with suspicious websites and email, and keep important files backed up. Microsoft describes a 3-2-1 backup approach: three copies, on two storage types, with one offsite copy. See its rootkit guidance.
- If suspected rootkit problems continue after attempted removal, Microsoft strongly recommends reinstalling the operating system and security software, then restoring data from backup. A compromised system’s own reports may not be sufficient to establish that cleanup succeeded.
Legacy option: bootable media for Windows 7 SP1 or 8.1
Microsoft documents bootable CD/DVD/USB media for Defender Offline on Windows 7 SP1 and Windows 8.1. Its instructions specify at least 250 MB of free space. Creating the USB media reformats the drive and erases its contents, so back it up first; if possible, create the media on a clean computer. For Windows 10 version 1607 or newer and Windows 11, the documented path is to launch Offline Scan from Windows Security instead. See Microsoft’s media and version instructions.
Quick Recap
Rank #4
- MICROSOFT WINDOWS 11 PRO (INGLES) FPP 64-BIT ENG INTL USB FLASH DRIVE
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
