Article · Wikipedia archive · Last revised Jun 13, 2026

RootkitRevealer

RootkitRevealer is a proprietary freeware tool for rootkit detection on Microsoft Windows by Bryce Cogswell and Mark Russinovich. It runs on Windows XP and Windows Server 2003. Its output lists Windows Registry and file system API discrepancies that may indicate the presence of a rootkit. It is the same tool that triggered the Sony BMG copy protection rootkit scandal.

Last revised
Jun 13, 2026
Read time
≈ 1 min
Length
240 w
Citations
8
Source
Sysinternals RootkitRevealer
DevelopersBryce Cogswell and Mark Russinovich
Final release
1.7 / November 1, 2006 (2006-11-01)
Written inMicrosoft C++1: 07:08 
Operating systemWindows XP and Windows Server 2003
PlatformIA-32
Size231 KB
Available inEnglish
TypeSecurity software
LicenseClosed-source freeware
Websitetechnet.microsoft.com/en-us/sysinternals/bb897445

RootkitRevealer is a proprietary freeware tool for rootkit detection on Microsoft Windows by Bryce Cogswell and Mark Russinovich.234 It runs on Windows XP and Windows Server 2003 (32-bit-versions only). Its output lists Windows Registry and file system API discrepancies that may indicate the presence of a rootkit. It is the same tool that triggered the Sony BMG copy protection rootkit scandal.5

RootkitRevealer is no longer being developed.1: 08:16 

See also

See also

References

References

  1. Russinovich, Mark; Margosis, Aaron (28 July 2011). Mark Russinovich and Aaron Margosis: Introducing Windows Sysinternals Administrator's Reference. Channel 9. Microsoft Corporation. Retrieved 10 November 2011.
  2. Kleiman, D.; Hunter, L.E. (2006). Winternals Defragmentation, Recovery, and Administration Field Guide. Syngress. p. 143. ISBN 978-0-08-048987-2. Retrieved 2025-02-28.
  3. Pyles, J. (2009). PC Technician Street Smarts: A Real World Guide to Comptia A+ Skills. Serious skills. John Wiley & Sons, Incorporated. p. 380. ISBN 978-0-470-59351-6. Retrieved 2025-02-28.
  4. Todd, A.; Benson, J.; Peterson, G.; Franz, T.; Stevens, M.; Raines, R. (2007). "Analysis of Tools for Detecting Rootkits and Hidden Processes". Advances in Digital Forensics III (PDF). Vol. 242. New York, NY: Springer New York. p. 89–105. doi:10.1007/978-0-387-73742-3_6. ISBN 978-0-387-73741-6. Retrieved 2025-02-28.
  5. Russinovich, Mark (31 October 2005). "Sony, Rootkits and Digital Rights Management Gone Too Far". Mark's Blog. Retrieved 10 November 2011.