What is the BEST alternative if you discover that a rootkit has been installed on one of your computers?

Copying system files from another system may miss rootkit components embedded in the kernel, boot record, or firmware, leaving the system still compromised.

Trap and trace is a network monitoring technique used to identify an attacker's origin, not a remediation step for an already-installed rootkit.

Deleting identified files does not guarantee complete removal because rootkits often hide additional components that standard file operations cannot see or reach.

Reloading from a previous backup risks restoring an already-infected state if the backup was taken after the rootkit was installed, or may not remove kernel-level hooks.

Rootkits can modify the kernel, boot sector, or core system binaries, meaning the compromised OS cannot be trusted to accurately report its own state or fully remove the infection. Reloading from known good original media (such as vendor-supplied installation media) guarantees a clean, uncompromised baseline. This is the only method that eliminates the risk of reintroducing a rootkit that may have persisted in a backup or partial file copy.