GridinSoft Threat Intelligence
Rootkit detection reports
Low-level components designed to hide activity, persistence, or system changes.
Detection category
Rootkit threat reports
Low-level components designed to hide activity, persistence, or system changes. ThreatInfo groups these records so analysts and users can review related filenames, hashes, and GridinSoft detection names from one place.
This category page groups related ThreatInfo records so users can compare file names, hashes, publishers, and GridinSoft detection names in one place.
Observed detection families
Common Rootkit verdicts
These are the most frequent GridinSoft detection names in the latest reports shown below. Repeated families help users recognize whether a file belongs to a broader campaign or bundled software cluster.
Analyst focus
What to check first
Use this page as a starting point: open the exact file report, compare the MD5 hash, and run a local scan before deciding whether the file is safe.
- A known filename appearing with an unexpected hash or location.
- Publisher, product, or certificate data that does not match the file origin.
- Repeated detections from the same family across recent reports.
Frequent metadata
Publishers and products
GridinSoft Anti-Malware
Scan for Rootkit detections
If a file from this category appears on your computer, verify the exact report and run a full system scan. GridinSoft Anti-Malware is used to detect and remove threats listed in ThreatInfo reports.
Use the MD5 value from the report. A filename alone is not enough because unrelated files can share the same name.
Check the publisher, product name, certificate, and file path for mismatches or unfamiliar install locations.
If the file is unexpected, scan the device and remove related startup entries, bundled components, and leftover files.
Recent reports
Latest Rootkit file records
Questions
Rootkit FAQ
How should I use this category page?
Use it to find recent reports in the same detection family, then open the exact file report and compare the hash, publisher, path, and detection name.
Why can the same filename have different verdicts?
Attackers and bundlers often reuse common filenames, so the MD5 hash and metadata are more reliable than the name alone.
What should I do if a listed file exists on my device?
Do not rely on the filename only. Verify the hash, review the file location, and run a full system scan before keeping or removing it.