How to Remove Rootkits

What is a Rootkit?

Of all the nasty, evil, sneaky malware ever to infect millions of computers, the species know as the "rootkit" may well be the nastiest, evilest, and sneakiest. Rootkits are very difficult to detect; even harder to find once their effects have been detected; and eradicating them is extremely difficult.

A rootkit is a software package - a "payload" in hacker parlance - that is injected into your system via one of the many vectors available: vulnerabilities in application software that uses the Internet; USB flash drives; CD/DVDs of data or bootlegged software, etc. But left to itself, a rootkit-laden software package does no harm. It just sits on your hard drive.

The payload package must be "run" or executed to do its damage. Often you will run the payload intentionally, because it appears to be some useful program that you just downloaded. But you may also trigger a payload by opening an existing, perfectly harmless application that runs macros, such as Microsoft Word or Excel. If the payload was accompanied by a cunningly written macro, the macro will run automatically when Word or Excel is opened and then the macro will execute the payload package.

One precaution you can take against rootkits, and other forms of malware, is to turn off the "auto-run macro" feature of any software you use that has it. That prevents a macro from triggering a payload unless you manually run a macro you don't recognize. Obviously, you shouldn't. Ever. Even if Mom emailed the document containing the macro to you.

What Does a Rootkit Do?

When a rootkit payload is executed it may do several sneaky things.

• It may start services running in RAM and hide them from Windows Task Manager or another application that monitors services.
• It may copy its own insidious files over identically named system files, so there's no "new" filename there when you look.
• It may and often does hide the files it writes from your operating system so you can't even see them at all. This trick can even hide rootkits from antivirus software.

Once the rootkit is active on your system, it can do all sorts of nasty things. Keystroke logging, password stealing, spam spewing, and surreptitious monitoring of your activities are all possible. And worse, you may not realize that any of this is happening. If you sense that your computer or Internet connection is slower than it should be, it's a good idea to scan for rootkits.

Removing a Rootkit

Eradicating a rootkit once it's entrenched in your operating system is very difficult. So system administrators often don't dig out rootkits. Instead, they back up all data files from the infected machine; reformat the hard drive; and restore the operating system and executable applications. Where did the sysadmins get a perfect copy of all those things from which to restore them?

This is where regularly scheduled hard drive imaging becomes a very good idea. If you make an exact duplicate of your hard drive while it is not infected with a rootkit payload, you can restore your system to the way it was before an infection. (See my related article on making a Hard Drive Backup Image.

If you haven't been making disk images regularly, or you suspect the rootkit is also embedded in your disk image discs, then you can try a rootkit removal utility. There are several free and paid products available. Here are some I recommend, because they come from trusted sources and have achieved a good reputation for detecting and removing rootkits:

• F-Secure Blacklight is a rootkit detector that works by finding objects that are hidden from both users and security tools. BlackLight examines your system at a deep level and gives you the option to remove any nasty malware or rootkits that are detected.
• Sophos Anti-Rootkit is an advanced rootkit detection program which can be operated from a friendly graphical interface or the command line.
• Trend Micro Rootkit Buster scans your system's hidden files, registry entries, active processes, driver software, and can even detect Master Boot Record rootkits.

Since rootkits are sneaky and hard to detect, you might not even know if you've been infected. To stay safe I recommend that you use a firewall, install both anti-virus and anti-malware software, and periodically do a rootkit scan with one or more of the tools listed above.

Got something to say about rootkits? Post your comments and questions below...