O Windows intencionalmente tenta impedi-lo de acessar diretamente o hardware - é uma questão importante. ;) Então, se o Windows foi comprometido por um Rootkit (especialmente um kernel) então você praticamente precisa acessar o sistema de arquivos de outro sistema operacional (Windows ou não - mas não o sistema operacional infectado). ) para fazer qualquer coisa com os arquivos da infecção.
De Wikipedia :
"The fundamental problem with rootkit detection is that if the operating system has been subverted, particularly by a kernel-level rootkit, it cannot be trusted to find unauthorized modifications to itself or its components. Actions such as requesting a list of running processes, or a list of files in a directory, cannot be trusted to behave as expected. In other words, rootkit detectors that work while running on infected systems are only effective against rootkits that have some defect in their camouflage, or that run with lower user-mode privileges than the detection software in the kernel"
De página MS 'RootkitRevealer :
"Is there a sure-fire way to know of a rootkit's presence?
In general, not from within a running system. A kernel-mode rootkit can control any aspect of a system's behavior so information returned by any API, including the raw reads of Registry hive and file system data performed by RootkitRevealer, can be compromised. While comparing an on-line scan of a system and an off-line scan from a secure environment such as a boot into an CD-based operating system installation is more reliable, rootkits can target such tools to evade detection by even them."
Espero que ajude ...