Rootkit
In plain terms
Malware that hides from the operating system itself. It doesn't show up in the list of programs, because it's the one deciding what that list displays.
Definition
A rootkit is a set of malicious components that installs itself at an elevated privilege level in order to hide its own presence and that of other programs from the operating system itself. Its own purpose isn't to cause direct harm, but to make what does cause harm invisible.
How it works
Ordinary software asks the system for the list of files and processes, and displays whatever answer it gets. A rootkit installs itself upstream of that answer: it alters what the system reports, so that its own files and processes are left off the list before any antivirus even queries it. That explains an otherwise baffling situation — a machine behaving abnormally while every tool run from it declares it clean. The methodological consequence is direct and holds beyond this entry: a system cannot reliably examine itself. A meaningful check comes from outside, by booting the device from independent media, or by observing what the machine sends out over the network.
Warning signs
- Persistent abnormal behavior while every check run from the machine reports nothing
- Antivirus software that disables itself, or can no longer update
- Discrepancies between what the machine reports and what's observed from another point: network traffic, file sizes, disk space
- A problem that returns identically after a disinfection declared successful
- Noticeably longer startup, or a secure-boot related message
How to verify
Don't draw conclusions from the suspected machine. Compare what it claims against an outside observation — traffic seen from the router, a boot from external media. It's tedious, which is also why the practical answer often goes straight to reinstalling.
What to do
Keep secure boot enabled and the system updated: that's what makes installation at this level difficult. Avoid using an administrator account day to day, since a rootkit needs elevated privileges to install itself.
If it already happened
Treat the machine as untrustworthy until it has been reinstalled, and change your passwords from another device, not from this one. A full system reinstall, including formatting, is the normal response here rather than an extreme measure. Back up your personal documents, not the programs or system files. On a work device, don't reinstall on your own initiative: notify IT, which may need the machine as is. Get help if the operation isn't something you're used to — cybermalveillance.gouv.fr directs you to service providers.
Frequently asked questions
- Why doesn't my antivirus see anything?
- Because it queries the system, and the system answers with whatever the rootkit wants it to answer. That's not a flaw in the antivirus: it's the limit of any check run from inside the machine under suspicion.
- Is reinstalling the system enough?
- In the large majority of situations an individual encounters, yes — provided you format the drive and don't restore an earlier system image. Don't reinstall the same programs from the same sources if one of them caused the problem.
Related attacks
Official sources
Also known as: rootkit, concealment tool, bootkit.
This article is part of the Malware family. Last updated: 2026-09-03.