Should We Enable Rootkit Scanning?

[Gator5000e]

Version 3.1.2.1733 has been running well on my Windows 10 system. The option to scan for Rootkits is disabled by default, it seems. I was wondering if this should be on full time, or if not, how that feature should be used. The Help section explains what a rootkit is, but doesn't really discuss when you should or shouldn't use the feature. So any thoughts or suggestions would be appreciated. 

 

Thanks. 

[nikhils]

Hello @Gator5000e

Rootkit scanning uses specialized  techniques which increases scan times hence the Rootkit scanning is disabled by default.

If you are concerned about rootkits one suggestion is to add a daily scheduled scan with the option to scan for Rootkits and set the scheduled scan to run with low priority which ill have lesser impact on your systems resources.

Let us know if you need help to configure the scan.

Thank you,

[Gator5000e]

Thanks for the reply. I am not sure if I should be concerned about Rootkits.....I guess I should be. And can a rootkit scan be set to run overnight on a weekly basis or something like that? 

[nikhils]

That is correct. You can schedule either a  overnight scan or a weekly rootkit scan.

Thank you

[exile360]

If you've got a reasonably speedy system, activating rootkit scanning should only add a few minutes to your scan times at most, especially if you have an SSD rather than an HDD.

[Gator5000e]

I do have an SSD.  I will try a manual scan over night and see what happens. 

Thanks for the helpful replies

[Firefox]

20 minutes ago, Gator5000e said:

can a rootkit scan be set to run overnight on a weekly basis or something like that? 

Remember that the computer needs to be on and awake for it to perform the scan...

[Gator5000e]

I don't have my computer hibernate or sleep over night. I just have the monitors turn off after a period of inactivity. 

[Twidget2869]

On 5/18/2017 at 6:29 PM, nikhils said:

Hello @Gator5000e

Rootkit scanning uses specialized  techniques which increases scan times hence the Rootkit scanning is disabled by default.

If you are concerned about rootkits one suggestion is to add a daily scheduled scan with the option to scan for Rootkits and set the scheduled scan to run with low priority which ill have lesser impact on your systems resources.

Let us know if you need help to configure the scan.

Thank you,

You are so right, it took an ENTIRE EXTRA SEVEN SECONDS.  It took longer to click on the check box to enable it than it took for it to actually run... If you can't afford an extra 7 seconds...

[Tomiply]

On 5/18/2017 at 5:57 PM, exile360 said:

If you've got a reasonably speedy system, activating rootkit scanning should only add a few minutes to your scan times at most, especially if you have an SSD rather than an HDD.

There's no way this is true. I have 5600X and an NVMe SSD, and a normal scan takes one minute for me, maybe a few seconds over one minute. Even a full virus scan of my whole PC with my antivirus only takes like 10 minutes. I enabled rootkit scanning and it took 1 hour and 31 minutes.

[Tomiply]

On 1/24/2020 at 11:28 AM, Twidget2869 said:

You are so right, it took an ENTIRE EXTRA SEVEN SECONDS.  It took longer to click on the check box to enable it than it took for it to actually run... If you can't afford an extra 7 seconds...

That's weird, I have a 5600X and a super fast NVMe SSD. A normal scan takes slightly over one minute for me, but when I enabled rootkit scanning, it took 1 hour and 31 minutes. That's 1 hour and 30 minutes longer. I was very surprised, because me PC is lightning fast at whatever it does, especially scans. 

[Porthos]

You are posting to a 2 yr old topic. Additional protection has been added.

37 minutes ago, Tomiply said:

A normal scan takes slightly over one minute for me, but when I enabled rootkit scanning, it took 1 hour and 31 minutes. That's 1 hour and 30 minutes longer.

That is why it is not enabled by default.

It is recommend rootkit be turned on only where there is an issue for removing something with the normal scan. Rootkit is slightly more dangerous as it has to disable some whitelisting to remediate some rootkits.

Maybe once a month if really want to use rootkit. But honestly, we rarely see rootkit files anymore and the newer engine can remove most of them anyways even without rootkit on.