Is a Rootkit just a Trojan?

see above.

everyone is never going to agree, lets leave the above quote as a fitting end to this thread.

 

Another way - the simplist way - is to regard a trojan as a means of delivering a payload aka a rootkit (or other type of malware).

-- Tom

 

True that, lotuseclat79. When my system use to get infected (usually) with Trojans, before getting a router and Sandboxie, the Trojan would normally drop cookies that I needed to clean along with the malware. Supposedly though, Rootkits can be delivered by other types of malware besides Trojans.

 

Rootkits are not new and have been around for decades on Unix (the term "rootkit" actually refers to Unix's root account).

For years most desktop Windows systems had no notion of privileged or "root" accounts (as Unix does). Everything ran as "root" by default. Thus back then all malware automatically had root access and could do whatever it pleased. This was before UAC and all of that stuff.

Back then people just considered them trojans. Suddenly in the mid 2000's the term "rootkit" got borrowed from Unix by the AV companies to denote a "new" threat, when in fact it was the same threat that had been happening all along. If malware has root access it can do whatever it pleases, hide itself, mess with the kernel, etc.

The main difference is these days a lot of Windows malware attempts to hide itself, delete logs, etc. Traditional trojans in the Win95-98-ME days weren't so inconspicuous, mainly because they weren't as sophisticated. But there's no reason malware back then couldn't be considered "rootkits." It's just the term didn't become popular until the Vista days.

But rootkits that hide themselves have been in use on Unix systems long before the Windows world got wind of them. Typically on Unix systems the attacker uses a rootkit *after* he has already compromised the system in some other way. The rootkit merely guarantees him access to the machine at a later time. It is essentially a backdoor that has other functions that allow the deletion of all traces (delete log files, etc.)