What Is Rootkit?

Rootkits are the secret agents of the computer world. They lurk in the shadows and sneak into your system without you knowing—all while stealing your passwords, installing spyware, and altering data. You can't see them, but they're there. You can't stop them once they've gotten in, but luckily there are ways to protect yourself against them! A typical rootkit usually consists of thousands of lines of code, often hidden in system drivers, device drivers or other processes that run at the highest level in an operating system's kernel. Rootkits can be installed remotely over the Internet, via USB stick or CD-ROM, on a local network via e-mail attachments or malicious websites, or locally through physical access to an infected machine. When installed on a computer running Microsoft Windows, it is also possible for rootkits to hide from detection by changing Windows Registry entries and installing software components that monitor attempts to detect them. Rootkits are sneaky. They also hide in the shadows, waiting for you to let your guard down. You might think your anti-malware software is on high alert, but that rootkit is still there, waiting for its chance to strike. Rootkits can also target your computer's hypervisor, kernel, and firmware—which means they can altogether disable or destroy the anti-malware software installed in an infected computer. That way, even if you have system administrators watching over your shoulder, they won't be able to detect the intrusion! When done well, a rootkit attack will look just like normal behavior—but it's anything but average! One of the most effective ways to sneak a rootkit onto your system is to disguise it as a Trojan. Even if you're not looking for a Trojan, you can spot a rootkit because it will hide in plain sight.