Your rootkit remover might have reported that it has successfully removed a rootkit from your machine, but how...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
can you validate that? Certainly the only way to be 100% sure that a rootkit no longer exists on a machine is to reformat the hard drives and reinstall the OS. Let's take a closer a look at the nature of rootkits to see why they can be so difficult to remove.
Most applications run in what's called user mode. This setting restricts their ability to cause damage through inappropriate or inadvertent access to system processes. The name rootkit comes from the program's ability to obtain access to the core or "root" of a computer's operating system. User-mode rootkits that have obtained administrative privileges can modify the memory space of other applications in order to disguise what is happening within the operating system. They can intercept system calls and can, for example, hide processes, files and registry keys. This type of rootkit can be detected, however, by code running in what's called kernel mode.
Kernel mode is a trusted mode of operation for system services and device operations and allows privileged access to system memory and the full CPU instruction set. A rootkit operating in kernel mode is far more dangerous, as it can avoid detection by modifying the kernel component of the OS, giving it almost unrestricted potential for manipulation of the system. Corruption at such a low level means that it is difficult to detect and completely remove this type of rootkit. The Trojan Mebroot, for example, works by infecting the Master Boot Record (MBR). Boot records are reserved sectors on a disk that are used to load the operating system. Mebroot copies the original MBR to sector 62 on the hard disk, installs its own kernel loader to sectors 60 and 61, and copies a rootkit driver near to the end of the active boot partition. When the computer restarts, the infected MBR starts the kernel loader located in sectors 60 and 61, which patches the Windows Kernel in memory to load the rootkit driver. This malware then has virtual ownership of the infected machine.
A rootkit hypervisor is an even more powerful and dangerous beast. A hypervisor is a layer of virtualization software that runs between the operating system and hardware, acting as a virtual machine monitor. A rootkit hypervisor doesn't rely on hacking the kernel. It takes control by running the original operating system in a VM or virtual machine. By controlling the complete universe in which an operating system runs, it can deceive any operating system running inside it, thus defeating any security defenses running on the guest VM. This means there's really no practical way to detect it except through extreme measures.
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Michael Cobb
A flaw in the open source graphics library libpng enabling denial-of-service attacks was discovered. Expert Michael Cobb explains how the ...continue reading
Flaws in the Apple Notify function and iTunes can enable attackers to inject malicious script into the application side. Expert Michael Cobb explains...continue reading
Facebook's Delegated Recovery aims to replace knowledge-based authentication with third-party account verification. Expert Michael Cobb explains how ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.