What is a Rootkit Malware?

                 

Computer viruses and other malware are real threats. And rootkits might be the most dangerous, both in the damage they can cause and the difficulty you might have in finding and removing them.

Rootkits are a type of malware that are designed so that they can remain hidden on your computer. But while you might not notice them, they are active. Rootkits give cybercriminals the ability to remotely control your computer.

Rootkits can contain a number of tools, ranging from programs that allow hackers to steal your passwords to modules that make it easy for them to steal your credit card or online banking information. Rootkits can also give hackers the ability to subvert or disable security software and track the keys you tap on your keyword, making it easy for criminals to steal your personal information.

Because rootkits can hijack or subvert security software, they are especially hard to detect, making it likely that this type of malware could live on your computer for a long time causing significant damage. Sometimes the only way to completely eliminate a well-hidden rootkit is to erase your computer’s operating system and rebuild from scratch.

How do rootkits get on your computer? You might open an email and download a file that looks safe but is actually a virus. You might also accidentally download a rootkit through an infected mobile app.

Types of rootkits

1. Hardware or firmware rootkit

Hardware or firmware rootkits can affect your hard drive, your router, or your system’s BIOS, which is the software installed on a small memory chip in your computer’s motherboard. Instead of targeting your operating system, they target the firmware of your device to install malware which is difficult to detect. Because they affect hardware, they allow hackers to log your keystrokes as well as monitor online activity. Although less common than other types, hardware or firmware rootkits are a severe threat to online safety.

2. Bootloader rootkit

The bootloader mechanism is responsible for loading the operating system on a computer. Bootloader rootkits attack this system, replacing your computer’s legitimate bootloader with a hacked one. This activates the rootkit even before your computer’s operating system is fully loaded.

3. Memory rootkit

Memory rootkits hide in your computer’s random-access memory (RAM) and use your computer’s resources to carry out malicious activities in the background. Memory rootkits affect your computer’s RAM performance. Because they only live in your computer’s RAM and don’t inject permanent code, memory rootkits disappear as soon as you reboot the system – though sometimes further work is needed to get rid of them. Their short lifespan means they tend not to be perceived as a significant threat.

4. Application rootkit

Application rootkits replace standard files in your computer with rootkit files and may even change the way standard applications work. These rootkits infect programs like Microsoft Office, Notepad, or Paint. Attackers can obtain access to your computer every time you run those programs. Because the infected programs still run normally, rootkit detection is difficult for users – but antivirus programs can detect them since they both operate on the application layer.

5. Kernel mode rootkits

Kernel mode rootkits are among the most severe types of this threat as they target the very core of your operating system (i.e., the kernel level). Hackers use them not only to access the files on your computer but also to change the functionality of your operating system by adding their own code.

6. Virtual rootkits

A virtual rootkit loads itself underneath the computer’s operating system. It then hosts the target operating systems as a virtual machine, which allows it to intercept hardware calls made by the original operating system. This type of rootkit does not have to modify the kernel to subvert the operating system and can be very difficult to detect.

How to detect rootkits

Detecting the presence of a rootkit on a computer can be difficult, as this kind of malware is explicitly designed to stay hidden. Rootkits can also disable security software, which makes the task even harder. As a result, rootkit malware could remain on your computer for a long time causing significant damage.

Possible signs of rootkit malware include:

1. Blue screen

A large volume of Windows error messages or blue screens with white text (sometimes called “the blue screen of death”), while your computer constantly needs to reboot.

2. Unusual web browser behaviour

This might include unrecognized bookmarks or link redirection.

3. Slow device performance

Your device may take a while to start and perform slowly or freeze often. It might also fail to respond to input from the mouse or keyboard.

4. Windows settings change without permission

Examples might include your screensaver changing, the taskbar hiding itself, or the incorrect date and time displaying – when you haven’t changed anything.

5. Web pages don’t function properly

Web pages or network activities appear intermittent or don’t function properly because of excessive network traffic.

A rootkit scan is the best way to detect a rootkit infection, which your antivirus solution can initiate. If you suspect a rootkit virus, one way to detect the infection is to power down the computer and execute the scan from a known clean system.

Behavioural analysis is another method of rootkit detection. This means that instead of looking for the rootkit, you look for rootkit-like behaviours. Whereas targeted scans work well if you know the system is behaving oddly, a behavioural analysis may alert you to a rootkit before you realize you are under attack.