What are rootkits? In today’s lesson find out what they are , what they are for, how they work and how to protect yourself from rootkits!
In the lesson on the most common types of malware, we already talked about rootkits : malicious programs created to allow attackers to gain control over your operating system.
Today, let’s take a closer look at this type of malware.
What Are Rootkits?
The term Rootkit consists of two words: Root indicates the Administrator account in Linux and Unix operating systems, and Kit is the term used to indicate a set of programs.
With Rookit today we commonly indicate a program (or a set of programs) created mainly to control the operating system of a computer without the need for authorization from the administrator user.
By itself, this does not mean that a Rootkit is necessarily malicious.
In fact, there are some legitimate RootKits , which serve legitimate programs to run on your system.
For example, Daemon Tools , Alcohol 120% or User Profile Hive Cleanup Service (program from Microsoft) use legitimate rootkits to function.
However, the vast majority of RootKits in circulation today are considered malware : that is, they are malicious programs used for illegitimate purposes .
Just think there is a whole multi-billion dollar spyware industry running on malicious rootkits !
Some rootkits (such as Greek, Zeus, Stuxnet and Flame) have infected hundreds of millions of computers in the past years.
This is why the term Rootkit has therefore taken on a negative connotation and is associated with malware.
What Are Malicious Rootkits For?
Illegal Rootkits have two primary functions, as Microsoft also explains on the Rootkits page .
The first function is to allow an attacker to enter your computer , without you noticing it, and launch specific applications . This is one of the most common purposes of rootkits.
The second most common function is to record specific activities on the computer .
Basically, the rootkit allows someone to control your computer without your knowledge, and to spy on the use of your computer.
Anyone who accesses your computer via rootkit can run files, monitor your activities by accessing log files, and change system settings.
How Do Rootkits Get Into Computer?
The Rootkit can get into your computer in several ways .
For example, just click on the wrong link while browsing the Internet, download a program that contains the rootkit and run the program: at this point the rootkit will install itself on your computer without your knowledge.
You can also pave the way for rootkits by downloading specific documents (e.g. PDFs) from the Internet that contain hidden programs, and opening them once downloaded.
Sometimes just clicking on suspicious email links is enough!
Generally, once rootkits are in and installed on your system, they disguise themselves.
In practice, they modify system settings to trick your defense programs (antivirus and antimalware) into not being detected. Without going into too much detail, know that there are several ways that rootkits blend in, and that is why they manage to escape antivirus and antimalware.
How to Defend Against Rootkits?
First, it’s always best to prevent by following the basic rules for virus protection .
But unlike other types of malware, the symptoms of rootkits are extremely difficult to notice, so you may have a rootkit on your computer and not notice it.
You may perceive a drop in Internet speed due to increased traffic to and from your computer and the use of available bandwidth by the rootkit, but it is an extremely vague symptom that could very well stem from a thousand other reasons.
Although the file extensions that Rootkits generally infect are known (.dat, .exe, _nav.dat, _navps.dat, .sys etc) unless you are a Windows expert it will be impossible for you to understand from system files present on your computer if there is anything suspicious.
My advice therefore is to periodically carry out checks with specific anti-rootkit programs .
As already mentioned above, in fact, rootkits are able to escape, in the vast majority of cases, the common antivirus and antimalware, for which programs specifically created to identify rootkits are needed.
I suggest the following free antirootkit programs :
- Malwarebytes AntiRootkit
- Kaspersky TDSSKiller
- GMER
- RootRepeal
- Avast Anti-Rootkit
- Sophos Anti-Rootkit
- Bitdefender Rootkit Remover
Conclusions
In this lesson, you learned what rootkits are .
Now you know that they pose a great danger to your computer, and that they are almost impossible to detect with the naked eye or with common programs.
For this I recommend that you periodically scan your computer with specific antirootkit tools.
In the next lessons I’ll explain how to best use these programs.
