What is Rootkit? Why I should be worried? Rootkits are nasty pieces of malware. They can listen for commands from their masters, steal sensitive data, and send it to their masters or provide an easy access backdoor for their masters. They're designed to be stealthy with the ability to hide themselves from plain view. Sometimes they'll replace utilities such as ls or ps with their own Trojan versions that will show all files or processes on the system except for the ones that are associated with the rootkit. Rootkits can infect any operating system even our beloved Linux. In order to plant a rootkit an attacker has to have already gained administrative privileges on a system. It can affect any operating system Rootkits can be divided into two basic types. Traditionally, rootkits replaced binaries, such as ls, ifconfig, inetd, killall, login, netstat, passwd, pidof, or ps with Trojaned versions. These Trojaned versions have been written to hide certain processes or information from the administrator. The second type of rootkit is the loadable kernel module (LKM). A kernel rootkit is loaded as a driver or kernel extension. Both types can be a real problem. If you suspect that a computer has been infected with a rootkit, you will need to run a rootkit checker on the system to perform rootkit malware scanner and ensure that the filesystem has not been compromised.