A rootkit is a software, a malicious one to be specific. Rootkits are programs that help shady people access a device’s or computer’s system destined only for authorized users only. These programs are often bundled together.
因此，rootkit 允许用户访问网络或系统中没有授权的某些部分。Rootkit 特别危险，因为它们会 "绑架 "设备，让运行它们的人接管小工具或计算机。
With a rootkit, users can erase files, as well as obtain new ones or modify the already existing ones. They can also access system components and processes. This is why rootkits are widely considered dangerous software in the cybersecurity industry.
Hackers are very adept in using rootkits. The word “root” means a computer’s administrative privileges, which are the ones that hackers often target to take over a device or an entire system.
它们是恶意软件吗？
Whether rootkits are malware or not, is still up for debate. For example, there are law enforcement agencies that use them to fight crime, and even parents implement them to monitor their children’s computer activity closely. They have office applications as well.
令人遗憾的是，rootkit 因卷入黑客丑闻和被用来入侵系统而受到人们的广泛关注。
In fact, most rootkits can be installed in a specific system via a Trojan horse or a computer virus. These trick the user into doing it without even knowing. However, the software, per se, should not be considered malware.
它们是如何传播的？
Rootkits effectively work as spyware tools for hackers and cybercriminals. They can’t spread by themselves as regular worms do. The most obvious method they have to multiply is tricking the users into installing it themselves by the irresponsible management of cybersecurity.
Rootkit 还可用于创建僵尸网络。它们是由大量受感染文件组成的群体，通常用于在未经授权的情况下挖掘加密货币、执行分布式拒绝服务（DDoS）攻击和其他犯罪活动。
Hackers often try to scare users into installing malware in their systems, usually by showing “security alerts” saying that the device has been infected and that action is needed. This is found in sites and services of dubious nature.
垃圾邮件甚至即时信息应用程序中的附件也可能导致用户意外下载 rootkit，使黑客和网络犯罪分子在没有任何上级管理员命令的情况下控制设备。
如何检测 Rootkit？
借助先进的软件，您可以快速检测设备中的病毒和间谍软件。不过，目前仍没有明确的解决方案来检测 rootkit，至少不是那么容易。不过，有些事情还是可以做到的。
内存扫描可以搜索系统中的 rootkit，但只有少数扫描是自动进行的。而且，即使是自动扫描也不能笼统地检测 rootkit：它们是针对特定 rootkit 而设计的。
要检测 rootkit，应仔细查看计算机在特定时间段内的行为。任何可疑的行为都可能意味着你的在线完整性和安全性已经因为该软件的存在而受到损害。
业界的建议是，如果你是已安装 rootkit 的受害者，应执行系统重建，因为你无法知道有多少文件被入侵，或者你是否设法删除了所有文件。
如何防范 Rootkit？
It is very tedious to remove the rootkit from a given device, so the best way is to stay protected while browsing the web. Doing it would mean reformatting the computer, and that may be inconvenient for some reasons, mainly time and the possible loss of data.
Using a VPN to protect yourself is a wise choice. Since VPNs (Virtual Private Networks) can encrypt your shared content and your online identity, hackers trying to install rootkits in your device will most likely fail.
If you want a reliable, trustworthy VPN brand, choose a paid one, such as IPBurger VPN. It is a perfect example of how robust encryption and responsible data management can help you fend off hackers trying to gain access to your administrative privileges via rootkit installation.
如何删除它们？
由于 rootkit 可以帮助网络犯罪分子控制任何设备，因此不容易清除。我们可以使用杀毒软件和/或反恶意软件来对付特定的 rootkit，但它们并不能对付所有的 rootkit：有些 rootkit 非常复杂，特别难以清除。
在某些情况下，用户需要执行复杂的内存转储分析，才能找到并删除某些 rootkit。这些软件应用程序往往会很好地隐藏在文件或系统中。
此外，还有精确的反 rootkits 软件演示，专门用于打击和删除特定的 rootkits。
如何避免？
Browsing the web responsibly is the best way to avoid rootkits. Don’t click or download any attachments for unknown or untrustworthy sites, ignore or delete spam email, and generally think before you click when you sit down in front of a computer.
Also, you should use antivirus software with a proven track record of success. Anti-malware software can work, as well, as they can put firewalls that block unauthorized network connections.
如果需要下载附件，应先禁用 Office 中的宏，以及 Foxit Reader 和 Adobe Reader 中的 JavaScript 操作。切记保持操作系统的驱动程序为最新版本。
