How to Detect a Rootkit

Posted on July 27th, 2009 by Marck

(1 votes, average: 1 out of 5)

Loading ...

No Comments (Post Comment)

Republish

Designers and developers of malware use many tools and strategies to compromise secure computer systems and networks. It’s very important to safeguard the computer against existing and potential threats from malware, spyware, viruses, and worms. One way that a person can breach and compromise your computer or network security is to use a device called a rootkit.

What is a Rootkit?

A rootkit is a malicious program or system protocol designed to take over a computer system, or to provide a “backdoor” for other malware to take over or infect your computer system. Unlike other computer viruses or worms that can wreak havoc on your computer system in many ways, rootkits are specifically designed to grant access to the computer system:

Stealth and cloaking. Rootkits conceal themselves in such a way that security programs and protocols may ignore them.
Backdoors. A rootkit can provide special protocols and privileges to a third-party to access your computer.
Non-hostile applications. Some legitimate applications can sometimes emulate rootkits. They are most commonly found in emulation tools and some security software.

Detecting and Preventing Rootkits

One issue with rootkits is that they are constantly updated; even with all sorts of computer security protocols programmed every day to specifically eliminate rootkits, people who program them continue to develop and update the rootkit, or make new ones. It doesn’t mean, though, that you’re hopeless against rootkits. You should still take the time to detect them, and to prevent rootkits from infecting your computer:

Anti-virus software. While anti-virus software may not necessarily remove a rootkit, it can intercept and quarantine viruses and malware that may have entered your computer system because of a rootkit.
Secondary boot device. Another way to detect a rootkit would be to use another booting device (like a copy of Linux on a USB disk) to access your computer, scan system files, and take the steps needed to remove the rootkit).
Rootkit removal tools. Some security software developers like Sophos develop tools and utilities that are specifically designed to scan your system for rootkits, and remove the program from your computer.

Rootkits can be very dangerous systems that can compromise your entire computer or network. With these tips, you can detect rootkits and take the steps needed to remove them.