Microsoft Defender for Endpoint
Endpoint protectionRootkits Malware
In brief
The page now uses WDSI threat-description URLs for five malware entries and updates the Microsoft Defender Offline support link.
What Defender admins need to know
Administrators can use the updated links to access threat details and Defender Offline guidance.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Many modern malware families use rootkits to try to avoid detection and removal, including:
How to protect against rootkits
Microsoft security software includes many technologies designed specifically to remove rootkits. If you think you have a rootkit, you might need an extra tool that helps you boot to a known trusted environment.
Microsoft Defender OfflineMicrosoft Defender Offline can be launched from the Windows Security app and has the latest antimalware updates from Microsoft. It's designed to be used on devices that aren't working correctly because of a possible malware infection.
System Guard in Windows 10 protects against rootkits and threats that affect system integrity.
@@ -26,17 +26,17 @@ If asked a device to list all of the programs that are running, the rootkit migh Many modern malware families use rootkits to try to avoid detection and removal, including: -* [Alureon](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fAlureon)+* [Alureon](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Win32%2FAlureon) -* [Cutwail](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fCutwail)+* [Cutwail](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Win32%2FCutwail) * [Datrahere](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win64/Detrahere) (Zacinlo) -* [Rustock](https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Win32%2fRustock)+* [Rustock](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Win32%2FRustock) -* [Sinowal](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fSinowal)+* [Sinowal](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Win32%2FSinowal) -* [Sirefef](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fSirefef)+* [Sirefef](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Win32%2FSirefef) ## How to protect against rootkits @@ -54,7 +54,7 @@ For more general tips, see [prevent malware infection](prevent-malware-infection Microsoft security software includes many technologies designed specifically to remove rootkits. If you think you have a rootkit, you might need an extra tool that helps you boot to a known trusted environment. -[Microsoft Defender Offline](https://support.microsoft.com/help/17466/microsoft-defender-offline-help-protect-my-pc) can be launched from the Windows Security app and has the latest antimalware updates from Microsoft. It's designed to be used on devices that aren't working correctly because of a possible malware infection.+[Microsoft Defender Offline](https://support.microsoft.com/Windows/Security/Threat-Malware-Protection/virus-and-threat-protection-in-the-windows-security-app) can be launched from the Windows Security app and has the latest antimalware updates from Microsoft. It's designed to be used on devices that aren't working correctly because of a possible malware infection. [System Guard](https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/hardening-the-system-and-maintaining-integrity-with-windows-defender-system-guard/) in Windows 10 protects against rootkits and threats that affect system integrity.