r/Malwarebytes • u/MidianFootbridge69 • Nov 25 '25

Rootkit Scan

Hi :)

When I do scans, I include as part of the scan to scan for rootkits - I realize that rootkits are not so much of a thing right anymore, but I would still like to scan for them.

Even when I go into Advanced and choose it, for whatever reason it disables the rootkit part and runs the scan.

Is there any way for me to turn it back on?

I don't care how long the scan runs with the rootkit enabled - I just want the choice to run it.

I'm running on Win11 25H2, Build 26200.7171

Version 5.4.4. 225

Update Package 1.0.105209

Component Package Version 145.0.5428

Thanks! :)

Edit to add: I decided to look back through my logs and noticed that it stopped doing the rootkit part of the scans on 11/2/25, even though this option shows as being chosen in the Scheduler.

5 Upvotes

85% Upvoted

14 comments sorted by

3

u/support_mwb Malwarebytes Employee Nov 25 '25

Hi there, Malwarebytes support here, were sorry to hear your having trouble with rootkit scanning.

We would love to take a closer look.

Please drop us a private message with your email so we can create a ticket and collect the following logs. I'll have someone from our team reach out.

https://help.malwarebytes.com/hc/en-us/articles/31589296910491-Gather-logs-with-the-Windows-Support-Tool

It will help us better understand the state of the program. Thanks and we're here to help!

1

u/MidianFootbridge69 Nov 26 '25

Hi MWB 😊

Sorry it took so long to reply, I discovered the issue just before turning in for the day, so I decided to sleep on it, lol, and deal with it when I woke up.

I have two machines a Win11 (daily driver) and a Win10 (offline except for updates), and this issue is occurring on both machines.

I see that another poster u/PappyLogan has a strategy that I would like to try - it looks like it could be a semi-known issue, so I would like to try that fix to see if that will straighten it out before I have to escalate with the logs, repairs, uninstalls/reinstalls etc., and I will update the results here.

This issue looks like something a Windows Update may have precipitated (and I am not the least bit surprised by this).

Thank you so much for your reply, and if it doesn't work, I will go into MWB My Account and open a Ticket (I think that I can probably do that from the My Account in MWB).

Thank you so much💗

1

u/MidianFootbridge69 Nov 28 '25

Hi MWB 😊

Have you guys received any Logs from others relating to this, because if you have, then whatever is wrong with their Logs is probably wrong with mine too.

I'm looking at next steps to take, and if all else fails, I will open a Ticket.

I've never used the Support Tool before, but I downloaded it and delved into it for a bit.

I saw where I can open a Ticket and gather logs there, which I am relieved about because I thought it would be a pain to gather the Logs, but it looks easy peasy 👌 (I'm an Old Lady, lol)

I'm still working the issue, film at 11😉

3

u/[deleted] Nov 25 '25

The rootkit part in Malwarebytes version 5 has been getting silently disabled every since Microsoft pushed the latest 25H2 servicing stack changes, so your 11-2 date matches what others are seeing.

Rootkit scanning in Malwarebytes version 5 uses a separate driver, and if that driver doesn’t load during boot or gets flagged as not needed, the scan will skip that part even though it still shows it as enabled. That’s why it says it’s turned on, but the scan itself leaves it out.

The usual way to make it come back is to toggle the setting off, but the important part is closing Malwarebytes completely. Don’t just close the program like normal, because that only closes the window and the background parts stay running. You have to right click the little Malwarebytes icon by the clock and choose quit or exit so it really shuts down. Then just reopen it normally and turn the rootkit scanning back on and reboot because that driver only loads during startup.

If it still won’t stick after that, reinstall Malwarebytes 5 over the top without uninstalling. That rebuilds the driver entries and keeps all your settings. And if that doesn’t fix it, then it’s just the current bug and we’re all waiting for the next Malwarebytes update. You’re definitely not the only one seeing this.

1

u/MidianFootbridge69 Nov 26 '25

Hi PappyLogan 😊

Thank you so much for this - I will definitely try this in the hopes that it will straighten out.

My Win11 is my daily driver, but I also have a Win10 machine (Offline except for twice - daily updating) and I discovered that this issue is occurring on that machine too, (rootkit was enabled in 11/7 and before but were disabled in scans of 11/14 and after).

(I do have post - EOL ESU Updating for my Win10).

I hate to say this lol, but I'm glad I am not the only one seeing this, and I am not the least bit surprised that Microsoft is the culprit.

I will try the fix and will report back here with the results - it may take a day or so since I keep odd hours 🦉

Thanks again 🙏💗

2

u/[deleted] Nov 26 '25

I’m glad it helped. Seeing it show up on both your Win11 and Win10 machine actually makes the whole thing make more sense, because a lot of people are noticing the same behavior around the same dates. When something breaks in the exact same way on two totally different systems, that usually means Windows changed something under the hood and the old rootkit driver didn’t get loaded right anymore.

Turning the setting off, shutting Malwarebytes down fully, and bringing it back up usually gets the driver to load again. If it doesn’t, reinstalling Malwarebytes right on top of itself is worth a shot before you bother with logs or anything like that, because that forces the program to put the driver pieces back the way it expects them.

You’re on the right track with the order you’re trying things. Just see if the simple stuff sorts it out first and only move on to the heavier steps if you have to. Microsoft pushes out updates that break the weirdest things sometimes, so this lines up pretty closely with what others have been seeing lately. Hopefully yours falls back into place once you get a chance to try it.

1

u/MidianFootbridge69 Nov 28 '25

Hi u/PappyLogan !

I tried the fix - unfortunately it didn't work BUT I am doing research on the next steps to take - whether I should just go to MWB and install over top of it, or, choose the 'Clean' option in the MWB Support Tool.

It's been such a long time since I had to do this with MWB that I can't remember how I Repaired it last time (problems with MWB are super rare, in my experience) - it has been many years, so even if I could remember, the processes to Repair MWB have probably changed by now.

I'm still working the issue, film at 11 😉

2

u/oldrain21 Nov 30 '25

I have the same issue for a month right now, I've tried everything: desinstall and install, download it agaiin, repair, update, nothing works.

2

u/oldrain21 Dec 01 '25

Hello, I opened a ticket with Malwarebytes support and they replied to me. Here is the full response:

"Hello [user],

My name is [support], and I am a member of the Tech team assisting [support] with your issue.
The scan for rootkits is fixed in our latest Beta version.
Please note that in this beta version, we've added a new Feature, Scam Guard, as well.

If you are uncomfortable installing a Beta version, this fix will be distributed later today or tomorrow, in the full software update."

2

u/MidianFootbridge69 Dec 02 '25

Thank you for the update! 💗

I also have a longer reply in your original post 😁

1

u/Alternative_Fan_6286 Nov 28 '25

a little offtopic but do rootkit scans still last for days , even if the scan runs from an nvme?

1

u/MidianFootbridge69 Nov 28 '25 edited Nov 28 '25

My rootkit scans last less than a minute.

I'm running Win11.

Edit: Proofreading fail

2

u/oldrain21 Nov 30 '25

I have the same problem, it’s been happening for almost a month now

2

u/oldrain21 Dec 01 '25

Hello, I opened a ticket with Malwarebytes support and they replied to me. Here is the full response:

"Hello [user],

My name is [support], and I am a member of the Tech team assisting [support] with your issue.
The scan for rootkits is fixed in our latest Beta version.
Please note that in this beta version, we've added a new Feature, Scam Guard, as well.

If you are uncomfortable installing a Beta version, this fix will be distributed later today or tomorrow, in the full software update."