Home

Rootkit or rootkit virus is a form of malware. Rootkits using a special technique to manipulate the behavior of the environment it is running on. To return fake (manipulate) data in the chain.

Rootkit code

If we look into the rootkit term we can see that it is a contain two words.

The first word is root as the superuser under Linux and Unix operation system.

The second word is kit as a kit of tools.

We can say that rootkit is a kit of tools that one can use to make you a root aka superuser. It can be done on the current operating system that you are running on.

Under windows operation system the root user is known as the administrator or admin. In windows, the kit tries to give its operation administrator privilege to control the system and brack security.

In modern days, after Windows XP, with the introduction of Windows Vista, there was a big change in the operating system. The changes where mainly in the kernel. Part of this was due to rootkit behavior. As in the kernel, there is no privilege check once you get in. To block rootkit from loading into kernel mode new architecture was designed.

Rootkit turn to bootkit:

A new term was invented – bootkit. A bootkit can describe as a rootkit that infected the system boot. It is able to start before other drivers started or loaded once the system rebooted. By loading the bootkit before other drivers, like antivirus drivers, the rootkit was able to maintain control of the infected system.

How rootkit virus work?

A rootkit is using a technique to manipulate the default operating system behavior. In both kernel mode and user mode. By doing that it can hide objects on the system.

In windows, everything is referring as an object. It includes file, process, users etc. A rootkit can hide an object from being seen by manipulate the default system behavior, using a hook, filter drivers and other techniques.

Rootkit manipulation example:

An example of that can be the way we show files in the folder. There is two main API function that the system uses to list files and folders in the system.

The API function is FindFirstFile and FindNextFile. You can read about them in the Microsoft MSDN library.

If we use a hooking technique in the kernel level, that each time when something is looking on files in the system, instead of using the real API function we provide our own functions, we can program the function to not show special files (like files that start with a special name) in the list.

How to develop a rootkit or rootkit scanner is out of the scope of this article.

This about it, if we can hide files, we can hide users, running software (process) and even network connection, and if our hook was started before the antivirus driver, and we develop it to bypass antivirus the antivirus will not be able to know about it!

What is User and Kernel Mode:

User Mode: This area is where the application is running, it is what the user uses and see, like the web browser, word, and other software.
Kernel Mode: This area is for all the drivers and other objects that control by the kernel, there is no access for users.

How to remove rootkit:

There are some types of rootkit removal tools. Some of them will scan your system for knowing the signature of the rootkit, some use method of rootkit base behavior.

It can include a hooking technique and reading special operation system locations.

The other will scan your entire hard disk offline. While the operating system does not run from it, aka using the external bootable hard disk (or CD/USB)

What is the best rootkit remover?

For the live scan, you can use your antivirus as most of them has an inner anti-rootkit scanner in them.

You can also download some other rootkit removal tools like GMER and Rootkit Revealer tools from the internet.

What rootkit can do and how?

We know what rootkit is. A rootkit can be present as the defensive module in the malware. Rootkit technology use methods to make the malware more stealth. Malware scanner will not be able to find it.

Rootkit scanner needs to search the unknown to find signature or behavior of rootkits. We know of rootkits that manipulate hardware behavior, in present days.

There were studies of rootkit that live in the memory of the system. This rootkit is able to detect a running scanner. By copy itself to another memory location. Making it possible to hide from the scanner. Using fileless techniques.

A hardware rootkit can inject itself into the hardware memory, like BIOS, video and network card, the real danger with this type of rootkit is that even formation, or replacing your hard drive will not clean the rootkit.

During operation system install. The operation system probe for device information. The hardware that contains the rootkit virus will hook it into the system and the infection starts again.