Advanced tool for detecting potentially dangerous rootkit software. The author of the program is Mark Russinovich known for detecting a loud rootkit installed in DRM systems from Sony. RootkitRevealer searches for a Windows-based API to access the registry and file systems that most often indicate the presence of a rootkit running in user mode or kernel mode.

Suspicious processes are presented in the form of a detailed list containing the location in the System Register or the path on the disk, time, size and description. RootkitRevealer detects all rootkits published at www.rootkit.com, including AFX, Vanquish, HackerDefender. It is worth noting that rootkits such as Fu, which do not hide their presence in the system, are not detected.

1. a programme designed for persons with appropriate IT knowledge. We do not recommend the program to inexperienced users.

Items that are presented by the program should not be automatically classified as rootkits. We recommend to remove them only after a detailed analysis and backup of the hard disk (or at least the system registry). The program should be launched from a user with administrative privileges.

The program is not currently running from the command line. The reason for not making a command line version available is that malware developers have started to react to RootkitRevealer by checking its name. Therefore, RootkitRevealer currently scans the system by registering its copy as a service with a random name.

This type of run is not conducive to the command line interface, although you can still run a parameter program to run an automatic scan and save the report to a file.