Rootkit

A rootkit is a type of malware whose main purpose is concealment. It modifies the operating system, drivers or even firmware so that processes, files, network connections and registry entries belonging to an attacker stay invisible to normal tools.

Why it matters

Standard security tools rely on the operating system to report what is running. If the operating system itself has been altered, those reports cannot be trusted. Rootkits therefore let other malware survive for long periods and make clean-up difficult. The name comes from "root", the Unix administrator account, plus "kit", the toolset.

Example

A user notices that a laptop is slow, yet the task manager shows nothing unusual. A scan run from a separate, known-clean boot environment finds a hidden driver that the live system was filtering out of every listing. Because the compromise reached a low level, the team reinstalls the system from trusted media.

Common misconceptions

• "Antivirus always finds them." Deep rootkits can hide from software running inside the compromised system.
• "Only Windows is affected." Rootkits have been seen on Linux, macOS and other platforms.
• "Deleting the file fixes it." Persistence mechanisms may restore it.

Related

• Malware
• Trojan
• Root user
• Firmware

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.