How to Use RKill Before a Malware Scan in Windows

Updated on November 7, 2026

RKill attempts to stop known malware processes so your antivirus can run. After it finishes, run your malware scanner in the same Windows session. Use the scanner’s results to decide what needs removal.

What does RKill do?

Tool or scan	What it does	When to use it
RKill	Stops known malware processes and repairs some settings that prevent security tools from opening.	A suspected infection is blocking your normal scanner.
An antivirus full scan	Checks files and other locations, then handles threats it detects.	You need to investigate or remove an infection.
Microsoft Defender Offline	Restarts into Windows Recovery Environment and scans outside the usual Windows session.	A persistent threat is difficult to investigate while Windows is running.

RKill produces a log of its actions. The files behind stopped processes still need to be checked by a scanner. See the publisher’s RKill download and description.

How to run RKill and scan afterward

1. Save your work. Update your antivirus and its detection information if you can, and have the scanner ready.
2. Download RKill from BleepingComputer’s page. Run it and follow any Windows permission prompt.
3. Let it finish and read the log it opens. Keep a copy if you need help with the infection.
4. Run your antivirus scan immediately. Allow the scanner to handle any threats it finds, then follow its cleanup and restart instructions.

Complete that scan before choosing to restart Windows. Processes set to launch at startup can return after a restart. The developer explains the sequence in the RKill introduction.

What to do if RKill will not run

If malware closes RKill as soon as it opens, BleepingComputer provides the same tool under alternate filenames on its download page. If your security software flags the download, check the specific alert and publisher guidance before running it.

If you can open Windows Security, another option is Virus & threat protection > Scan options > Microsoft Defender Antivirus (offline scan) > Scan now. Save open files first, since this scan restarts the PC. Microsoft describes the scan options in its Windows Security guide.

How to read the results

A list of stopped processes records what RKill did. A short or empty log also needs to be followed by a scanner. Check your antivirus results and Protection history for the outcome. Our Microsoft Defender quarantine guide explains how to review detected items.

Frequently asked questions

Does RKill remove malware files?

It stops processes and repairs some blocking settings. Run an antivirus or antimalware scan afterward to check and remove the files involved.

Should I restart after RKill?

Run your scanner first in the same Windows session. Restart when the scanner’s cleanup instructions call for it.

Does an empty RKill log mean my PC is clean?

It means RKill recorded little or no action. Use your scanner’s findings and follow-up checks to assess the PC.

Why are there RKill downloads with different names?

The publisher offers alternate filenames because some malware blocks programs by name. Use the copies on the official download page.

Can I use Microsoft Defender instead?

You can run a full scan or Defender Offline through Windows Security. RKill can help when a running process prevents your regular scanner from opening.