Which of the following malware types would MOST likely require reimaging?

Botnets are network-based malware that can typically be disconnected and removed with endpoint security tools without requiring a full reimage.

Spyware operates at the application layer and can generally be detected and removed by anti-spyware or antivirus software without reimaging.

Rootkits operate below the operating system layer, hooking into the kernel or bootloader to hide their presence and persist across reboots. Because they compromise the integrity of the OS itself, antivirus tools running within that OS cannot reliably detect or remove all traces. Reimaging the machine is the only way to ensure the system is fully clean.

Keyloggers are application-layer threats that standard antivirus and anti-malware tools can usually detect and remove without needing a reimage.