A technician suspects a rootkit has been installed and needs to be removed. Which of the following would BEST resolve the issue?

A rootkit is a type of malicious software designed to gain administrative-level control over a computer system while remaining undetected. Due to its deep integration into the operating system (OS), often at the kernel or even firmware level, it can subvert the very security and monitoring tools used to find it. Standard anti-malware software may be rendered ineffective. Therefore, the most thorough and reliable method to ensure complete removal is to completely wipe the system's storage and perform a clean reinstallation of the OS from a trusted, known-good source. This process guarantees the eradication of the rootkit and any associated malware.

A. Application updates are a preventative security measure to patch vulnerabilities but do not remove an existing, deeply embedded infection like a rootkit.
B. Anti-malware software is often ineffective against rootkits, as the rootkit can hide its presence and interfere with the software's ability to scan and remove it.
D. A file restore only replaces specific files and does not address the rootkit's core components, which are integrated into the operating system itself.

1. National Institute of Standards and Technology (NIST). (2013). Guide to Malware Incident Prevention and Handling for Desktops and Laptops (NIST Special Publication 800-83, Revision 1). In Section 4.4, "Eradication and Recovery," the document states, "For some incidents, the most effective and efficient way to recover is to reimage the infected hosts. This is particularly true for hosts that have been compromised by rootkits or other advanced malware." (p. 4-6).

2. Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 6, "Malicious Software," the text discusses the difficulty of rootkit removal: "Once a rootkit is on a system, detection and removal can be very difficult... it may be necessary to completely reinstall the operating system on a compromised machine." This textbook is widely used in university computer science and cybersecurity curricula.

3. Microsoft Support. (n.d.). Recovery options in Windows. Microsoft's official documentation for end-users and technicians outlines that for severe system corruption or malware infections that cannot be otherwise resolved, the ultimate recovery options are to "Reset this PC" (which reinstalls Windows) or to "Use installation media to reinstall Windows," which is a clean installation. This is the vendor-recommended procedure for intractable malware like rootkits.