Home/All tools/Security
Symbolic image for Botkiller
Security

Botkiller

Windows has dozens of places a program can register itself to start. Botkiller looks in all of them, scores what it finds — and changes nothing until you say so.

What it does

One scan covers more than forty locations: startup folders, the Run and RunOnce branches of the registry, scheduled tasks including hidden ones, services and driver services, Winlogon, AppInit DLLs, WMI subscriptions, Active Setup, BootExecute, LSA packages, print and port monitors, network providers, Winsock catalogs and a long row of Explorer and COM extensions. Every finding gets a risk score rather than a traffic light without a reason.

The workflow is deliberately slow: scan, look, back up, confirm, change. Preview is the default, a backup with a manifest is written under ProgramData before anything is touched, and a review dialog before the final step lets you deselect individual entries. Rollback runs from that same backup.

What it deliberately does not do is part of the design: it changes automatically only what is reversible in user mode. Winlogon, LSA, drivers and the shell extensions stay read-only by default. Deleting services, deleting or installing driver files, working in the kernel, hiding itself — none of that is built in. And the rootkit findings are heuristics, not proof: they show you where to look.

There is no screenshot for this program yet.

What you get out of it

  • More than forty autostart and persistence locations in one pass, not in ten registry windows.
  • Preview is the default — nothing changes while you are only looking.
  • A backup with a manifest before every change, and a rollback from it.
  • A review dialog before applying: deselect single entries before it counts.
  • Driver and rootkit inspection with signature checks, SHA-256 and PE anomalies.
  • Protected Windows components stay locked even when you choose “force”.

What people use it for

A sluggish start

First see everything that registers itself, then switch it off one at a time — with a backup in case something needed it.

After a detection

A virus scanner removes a file. The entries that launched it are often still there afterwards.

Before handing a machine on

One pass over what runs at start, removed in a way you can account for.

Botkiller requires administrator rights and changes what Windows runs at start. Preview is the default and a backup is written before every change — but forcing a change on an entry that is otherwise notify-only can damage or break a Windows installation. The program warns explicitly at that point. The rootkit findings are heuristics, not proof: they show where to look and do not replace review by a person.

Requirements

  • PlatformWindows 11
  • Runtime.NET Framework 4.7 · Administratorrechte
  • CategorySecurity

In this category