How can I safely remove suspected rootkit malware from my laptop?

The safest approach for a suspected rootkit is a completely clean Windows installation from a USB installer created on a known-clean computer. Before installing, disconnect the laptop from the internet, boot from the installer, delete every existing partition on the internal drive, and install Windows to the unallocated space. This erases the operating system and personal files, so don’t back up files by simply copying everything; scan any files you keep from a separate clean system first. Afterward, install all Windows and firmware updates, change important passwords from a clean device, and enable two-factor authentication.

Don’t connect backup drives or copy personal data onto the laptop until it has been reinstalled and updated. Create the Windows installer using another computer, and verify that you’re downloading the tools from the official Microsoft or Malwarebytes websites rather than from a random video description.

You can run Malwarebytes and Microsoft Defender’s offline scan as additional checks, but repeated detections after removal are a good reason not to trust the current installation. Also, missing audio or captions switching languages can be caused by driver, browser, or accessibility settings and doesn’t necessarily prove the malware is fighting back. If the problem returns after a clean reinstall, update the laptop’s BIOS or firmware and check the hardware manufacturer’s support tools.