Rootkits

In short: A rootkit is malicious software that hides itself and other malware from the operating system and from virus scanners.

In more detail: The name comes from “root”, the administrator account on Unix, and “kit”, the toolset. It makes sure processes, files and network connections do not appear in displays and lists.

In Depth

• Levels: Application level (replacing programs), kernel level (drivers or modules alter system calls), bootkits (start before the operating system in the boot sector or in firmware/UEFI).
• Why hard to find: Whoever manipulates the system itself can lie to checking tools.
• Detecting: Comparing inside and outside (view of the running system against an image from clean boot media), hints such as unexplained network load, special tools (rkhunter, chkrootkit, offline scanners).
• Prevention: Secure Boot, signed drivers, current updates, minimal privileges, no software from dubious sources.
• Removal: Usually only by reinstalling, for firmware infection by reflashing or replacing hardware.
• Not to confuse: Legitimate software (copy protection, anti-cheat) also uses kernel techniques but is not malicious code.

See also: Malware