Our verdict: RKill is a first-aid tool for an infected PC where malware blocks your security software from starting. It only stops processes and repairs a few settings, so you must run a real scanner right after it. The last version dates from 2018.
About RKill
RKill was developed at BleepingComputer.com. When it runs, it terminates known malware processes, removes incorrect executable file associations and fixes policies that stop you from using certain tools. When it finishes, it shows a log file with the processes it terminated. It is a small 32-bit program that runs on both 32-bit and 64-bit Windows without installation.
RKill does not delete any files. BleepingComputer warns not to reboot after running it, because malware set to start automatically would simply start again; instead, scan the PC right away with an anti-malware or antivirus program. Because some malware blocks programs by file name, the download page offers RKill under several names, such as iExplore.exe and WiNlOgOn.exe. The current version is 2.9.1, last updated in November 2018.
What it does well
- Stops malware processes. Terminates known malware processes that block security software.
- Repairs file associations. Removes incorrect associations for executable files set by malware.
- Fixes blocking policies. Resets policies that prevent you from running certain tools.
- Log file. Shows a log of every process it terminated when it finishes.
- Renamed copies. Offered under several file names to get past malware that blocks it by name.
Who it is for
Good fit
People cleaning an infected PC where malware stops the antivirus or other tools from starting.
Look elsewhere
Anyone expecting malware removal or ongoing protection; RKill deletes nothing and only stops processes.
Pros and cons
Pros
- Free and portable
- Helps when malware blocks security tools
- Renamed copies get past name-based blocking
- Clear log of what it stopped
Cons
- Removes no files; a separate scanner is required
- Last updated in 2018
- Effect is lost after a reboot if malware autostarts
How to install RKill
Download RKill from the official BleepingComputer page and run it; no installation is needed. If malware closes it, try one of the renamed copies such as iExplore.exe. Do not reboot afterwards: run a full scan with your antivirus or a second-opinion scanner straight away.
Questions about RKill
Is RKill free?
Yes. RKill is free to download from BleepingComputer. The developer accepts optional donations.
Does RKill remove malware?
No. It only terminates malware processes and fixes some settings. Run an antivirus or anti-malware scan immediately afterwards to remove the infection.
Why are there several RKill file names?
Some malware blocks programs by file name. If RKill is closed by malware, try a renamed copy such as iExplore.exe or WiNlOgOn.exe.
