Prevention Guide: Detecting and removing rootkits in Windows

This guide, written entirely by Microsoft's Kurt Dillard, introduces you to a highly-destructive form of malware: Rootkits are stealthy tools used by hackers to control your Windows operating systems without detection. How can you detect a rootkit on your Windows system -- and if one is detected how should you remove it? Get help with this collection of tips that answer frequently asked rootkits questions. You'll also find an accompanying webcast, which offers detailed expert advice on how to troubleshoot rootkits. Check back often as more tips will be added over the coming weeks. -- Robyn Lorusso, Editor

Defining rootkits

• Tip: Adware, rootkits and worms: Translating malware speak
• Tip: What is a rootkit?
• Tip: Recognize your wares: Spyware vs. adware
• Column: Rootkit Battle: Rootkit Revealer vs. Hacker Defender

Understanding how rootkits work

• Tip: How does an attacker install a rootkit?
• Tip: How do user-mode rootkits work compared to kernel-mode rootkits?

Detecting and removing rootkits

• Webcast: Detailed expert advice: Detecting and removing rootkits in Windows
• Tip: Technical overview: How can I detect and remove rootkits from Windows?
• Windows Security Clinic: Rooting out a rootkit
• Rootkits Q&A: Getting a handle on rootkit detection

About the author: Kurt Dillard is a program manager with Microsoft Solutions for Security. He has collaborated on many solutions published by this team, including "Windows Server 2003 Security Guide" and "Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP". He has also co-authored two books on computer software and operating systems.