A rootkit hides software on a system by concealing files, processes, or other signs that operators would normally inspect.
The hiding may sit in user software or deeper in the system, so the usual tools can report a clean machine that is not clean.
How it works
The goal is persistence with silence: the component stays across restarts and lies about its presence.
Other unwanted programs sometimes rely on that concealment so their own files do not show up in a casual search.
Detection is hard because the reporter may be the thing that is lying.
Trusted external scans, known good boots, and comparisons from outside the suspect system matter more than a single local status window.
Concrete examples
- A server process list never shows a component that still answers on a hidden channel.
- File listings skip a folder that a boot from clean media can see on the same disk.
- Security tools on the host stay quiet while an outside sensor sees unexpected traffic from that host.
Protective measures
- Boot suspected machines from known clean media when you need a view the installed system cannot fake.
- Compare file inventories and startup items with a trusted baseline taken before the incident.
- Prefer reinstall of critical hosts when concealment is confirmed, because a local cleanup may be lied to.
- Collect logs on a separate system so a hiding component cannot edit the only copy of the evidence.