What is a Rootkit and How to Detect It
A rootkit is a type of malicious software designed to gain unauthorized access to a computer while hiding its presence. They are notoriously difficult to detect because they can modify the very system tools you would use to find them.
Detection Tools
Because rootkits hide themselves, you need specialized tools to find them. The two most common are `rkhunter` and `chkrootkit`.
- rkhunter (Rootkit Hunter): Scans for known rootkits, backdoors, and suspicious system changes.
- chkrootkit: Checks system binaries for rootkit modifications.
We have a detailed guide on how to use these tools here: Scanning for Malware and Rootkits.
What to Do If You Find a Rootkit
If a scanner detects a rootkit, the server should be considered fully compromised. The only 100% safe way to recover is to wipe the server and restore your data from a clean, trusted backup made before the compromise occurred.
