My Life in Tech: How to Find and Kill Rootkits on Your IT Systems

I’m on my third cup of coffee this morning, and I swear I can still feel the buzz from DefCon around the inside of my ears — particularly from the hardware hacking village that, by the way, was definitely on fire this year. But something that keeps me awake at night more than caffeine: rootkits. These things are nasty. They burrow in deep, hiding in places most security tools wouldn’t even consider checking, and can turn your entire IT infrastructure into a playground for the attacker without you ever knowing it. For the last 20 years, I’ve chased them down — through banks, manufacturing companies, even a legacy telecom system living on a surprisingly durable (but still vulnerable) PSTN network. And every time I think I’ve seen it all, somebody comes up with a sneakier way to hide them.

Quick Take

If you don’t have time to read, here’s what you need to know:

• Rootkits are made to be undetected. If you are waiting for an alert from your antivirus, you are waiting too long.
• They bind to the operating system at a low level, disguise malicious actions and evade traditional security products.
• Old-school removal methods don’t always succeed — sometimes the only option is a complete system overhaul.
• Forensics is key. If you can’t figure out how it slipped in, it will just repeat next week.

Okay, now let’s go a little deeper.

What is a Rootkit?

A rootkit is a type of malware that not only has administrative access to a system, but is actually hidden from detection. That’s the critical distinction between a rootkit and your standard-issue malware — it doesn’t just compromise a machine, though, it makes sure you don’t even know it is there.

These things can:

• Work on the kernel level. This grants attackers the maximum potential privileges.
• Change system files and processes. She patched or replaced system binaries to avoid detection.
• Intercept system calls. Which means, even all your fancy EDR solutions may miss the actual traffic flowing under the hood.

And here’s the terrifying bit — a huge number of rootkits are not even required to have admin access before they can be installed. If they take advantage of the right vulnerability (and let’s be real, there are always vulnerabilities), they can worm their way in without the troublesome admin permissions.

When I was assisting a financial institution in redefining its zero-trust architecture a few years back, I encountered a kernel-mode rootkit. The security team had all of the policies in place right on paper, but this thing was sitting on a core transaction server for months, intercepting requests in real-time. Worse? It was sending out data in a manner that appeared like normal traffic. It took deep forensic analysis to finally catch it.

How Rootkits Evade Detection

This is what makes rootkits so infuriating. They do not stand out. Indicators of Compromise (IoCs) are easily covered, forged or simply removed altogether. Some of the tricks they use to remain invisible:

• Hooking into the OS kernel. They change low-level system API calls. Do you ask the OS to prove running processes to you? It gives you a scrubbed list.
• Code injection into valid processes. That’s how they fly under the radar of security tools that only check for anomalous processes. If they live within a system service? Good luck tracking them.
• Modifying the Master Boot Record (MBR) or UEFI. Some advanced rootkits will even modify your boot firmware, so just reinstalling the OS doesn’t cure it.

Even a good antivirus solution won’t detect a well-designed rootkit. They depend heavily on database signatures, heuristic scans and user-level visibility. But rootkits cheat. They rewrite what the system sees, so even security tools are peering through a funhouse mirror.

Best Removal Methods

OK, this is where it gets a little complicated. When it comes to rootkit remediation, it is not simple. You don’t simply delete the infected file and move on. You need a strategy.

Check if You’re Compromised: Step 1

• Scan with a rootkit scanner, but don’t depend on a single tool. Try multiple:
  • GMER
  • chkrootkit
  • rkhunter
• Look for any suspicious system activity:
  1. The performance just drops for no reason
  2. Security logs that appear suspicious or tampered with
  3. Services that run on startup (especially if untitled or weirdly named)

Step 2: Attempt to Remove It … But Brace Yourself to Go Extremist

• Safe Mode Scan. Some rootkits won’t load when you boot in safe mode, which can make them easier to remove.
• Offline Scanning. From a clean live USB with forensic tools.
• Check MBR or UEFI. Defeating a boot infection requires a special tool to verify firmware integrity.

Step 3: If All Else Fails, Nuke the System

Listen. I know IT teams dislike hearing this, but at times, the only way to permanently remove a rootkit is:

• Reinstall the OS. And I mean from a known good image — not a backup that could already be compromised.
• Wipe & Flash Firmware. At UEFI/BIOS level — if that’s where the rootkit is embedded, nothing less than a full reflash will cleanse it.
• Secrets & Credentials Rotation. Given that, don’t assume that the rootkit failed to capture keystrokes or exfiltrate passwords. Assume all privileged credentials are compromised.

Let’s be honest: rootkits are a damn nightmare. But the ability to combat them is crucial.

Rootkit Detection Solutions by PJ Networks

PJ Networks is forensic-first. Why? Because if you don’t know how it got in, you won’t be able to remove it completely. Our rootkit detection is deeper than most optimized scans:

• Memory dump analysis to catch hidden process.
• We compare disk level info to in-memory lists of processes — if something is hiding we will see it.
• Kernel-level inspection of compromised systems for function hook hijacking

Recently, we discovered a previously undetected rootkit in a big bank’s infrastructure. Because it was intercepting API calls at the system level, it wasn’t triggering any alerts. Our tools detected data anomalies — and indeed, it was siphoning financial records in real time. The culprit? A supply chain compromise within an AI-powered safety resolution. (Don’t even get me started on AI-driven security… that’ll be a rant for another time.)

If you think your infrastructure is compromised — or simply want peace of mind — contact us. Because, after all, prevention is always cheaper than cleanup.

Conclusion

Rootkits represent the closest thing there is to invisible malware today. They burrow in deep, hijacking core system functions, and can run for months (or even years) before being detected.

If you’re using only your traditional antivirus solutions? You’re not secure.

• If you’re not consistently conducting deep forensic scans? You could already have been breached.
• If your reaction is, Eh, my systems run fine, I’d notice something? Trust me—you won’t.

Anti-rootkit vendors are doing an ongoing battle. But with the proper combination of forensics, memory analysis, and hands-on intelligence, you can stay one step ahead of even the trickiest threats.

Well if you’ll excuse me, I need one more coffee ahead of my next appointment.