What is a Rootkit?
A rootkit is a special type of malware that embeds itself deep into the operating system at a level that allows it to manipulate the information the operating system sends back to the user as well as applications. This means that rootkits can completely control the operating system as well as hide any presence of its existence.
Rootkits have been around for about 20 years and were originally developed for non-malicious purposes and not even for the Windows operating system. As the years progressed, it became apparent to cyber-criminals that the employment of rootkits was the way to go, and therefore, we have rootkit malware like Zero Access and Rustock.
The biggest issue with rootkits, beyond their intended operations, is how to get rid of them. See, rootkits embed themselves into the operating system in such a way that allows many legitimate and important function calls and data to be passed through their oversight. Think of it like a hard-water filter installed on your water pipe system right outside of the point where the water enters your house. If you tried to remove that filter, you would then have a problem with your water correctly getting into your house. In the same regard, if you removed a rootkit, you might inadvertently break some vital functionality of the operating system; in the worst case, it might even make your system un-bootable.
To put our foot down and fight back against stubborn rootkit malware, Malwarebytes has developed a new product designed specifically for the detection and removal of rootkits: Malwarebytes Anti-Rootkit.
What can it do?
At a high level, this is what Malwarebytes Anti-Rootkit, or ”MBAR”, can do for you:
Kills what other tools cannot. Those nasty rootkits, MBR infectors and the nastiest of nasty Trojans and blended threats like ZeroAccess
Goes well beyond other malware removal tools and repairs broken services and system files often damaged by many infections.
The same incredible heuristics used by Malwarebytes Anti-Malware for detecting the latest 0-hour threats is applied to the anti-rootkit definitions used by MBAR to find and kill the latest rootkits
It uses our Chameleon self-protection to keep it running even when threats try to shut it down
Malwarebytes Anti-Rootkit scans your systems drivers, hard drive sectors, and system files to seek out rootkit activity and remove it from your system. This means that MBAR will delve into the dark crevices of your system where rootkits like to hide and disrupt their ability to link into the operating system and modify data, disrupt system calls, etc.
Once it removes the links, it will use the Malwarebytes Anti-Rootkit engine to detect all additional rootkit files and set them for removal. After this, the system will require a restart that allows Malwarebytes Anti-Rootkit to remove the malware before it has a chance to embed itself into the system again.
Why is it necessary?
In the distant past, malware consisted of a few viruses that destroy data and worms that try to spread malware as far as they could. In those days, a simple antivirus/anti-malware solution would be the answer for nearly all computer security issues. However, currently we deal with much more advanced, targeted and nefarious types of malicious software such as rootkits. Therefore, it is necessary to be able to protect your system against these threats that conventional antivirus/anti-malware solutions cannot.
In addition, think back to the water filter analogy, where breaking the connection between the water filter and the pipes could cause serious damage to the water system. Malwarebytes Anti-Rootkit not only removes the rootkits or evil water filter but also repairs the damage it made to the system by reestablishing links and fixing vital services that had been modified by the rootkit, in essence it ensures that your water is flowing. It does this with a tool known as fixdamage.exe that is included with the Malwarebytes Anti-Rootkit ZIP file.
