When a system is suspected to be infected, one of the measures often recommended for cleaning the system (without actually taking the "nuke from orbit" approach) is to scan the drive with anti-malware tools from a known-trustworthy system. The way this is normally accomplished is by removing the drive from the suspect system, and attaching it externally or internally (as a non-system drive) to the trusted system. However, an alternative option in theory would be to scan the suspect system over the network.
For example, on a Windows system, an Administrator can read the entire contents of the system drive via the built-in share \\hostname\C$. A networked drive mapping can be made from the trusted system to the suspect system's C$ share, and then antimalware programs can be run against the mapped drive.
Is a remote file system scan in this way equivalent in effectiveness to an offline scan of the drive? Or, since the suspect system's OS is still running, are there common ways that rootkits can still hide their presence from the system being used for scanning over the network which would not be possible if the suspect system was actually offline?
Obviously, "nuke from orbit" is, as they say, "the only way to be sure". However, that option is not in-scope for this question. I'm only asking if a remote scan of a file system is just as effective against rootkits as an actual offline scan of the same system.
