Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Check persistence mechanisms, kernel activity, logs, suspicious files, and monitoring alerts—but treat every result as an indicator, not proof that the server is clean. Rootkits can undermine what the running system reports. If evidence points to privileged compromise, involve your incident-response team and plan for a trusted rebuild or restore rather than assuming manual cleanup makes the host safe.
Before you investigate: preserve evidence and limit risk
If the server may be part of an active incident, follow your organization’s incident-response process before changing files, restarting services, or running cleanup tools. Those actions can alter evidence. Coordinate with the security team about preserving logs, disk images, and other artifacts when an investigation may require them.
Record the observed symptoms and their times, and consider the server’s connections to other systems, accounts, and credentials. A suspicious process or login may be only one part of a wider compromise. CISA’s incident-response playbooks emphasize coordinated response, eradication, and continued monitoring; the right sequence depends on the incident and evidence needs.
Review common persistence mechanisms
Malware that returns after reboot may be using ordinary administration features rather than a conspicuously named “rootkit” file. Look for unexpected changes and compare them with a trusted baseline, configuration-management records, or known-good backups where available. CISA recommends collecting cron and systemd data and checking for additional SSH keys. Red Hat has reported modification of /etc/crontab as a persistence method in its Trickbot guidance.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems#1 Best Overall
Cron jobs and systemd units
- Review system-wide and user cron entries, including
/etc/crontaband scheduled jobs, for unfamiliar commands, paths, users, or recent changes. - Inspect systemd services and timers for unexpected units, unusual execution paths, or changes that do not match the server’s intended configuration.
- Check ownership, timestamps, and configuration-management history where available. An unfamiliar entry warrants investigation; a familiar-looking name does not establish that it is legitimate.
Accounts, shells, and SSH access
- Check for unexpected user or privileged accounts and changes to login shells.
- Review SSH
authorized_keysfiles for keys that are not recognized by the account owner or administrator. - Correlate account and key changes with approved access records. Do not remove suspicious entries before preserving evidence if incident procedures require it.
Inspect kernel indicators without treating them as a clean bill of health
Review loaded kernel modules and kernel messages for unfamiliar modules, suspicious loading, or activity that does not fit the server’s normal role. CISA identifies lsmod output and dmesg as useful artifacts in a rootkit investigation; they are clues to assess, not integrity guarantees. A module name that looks familiar is not, by itself, evidence that the module is safe.
Interpret what you find against the operating system, hardware, kernel, and approved software configuration for that host. If you suspect a kernel-level rootkit, confidence in observations made from the running system is limited; escalate rather than relying on a single command or scanner result.
Rank #2
Preserve and examine logs and suspicious files
Preserve and review relevant files under /var/log and available journald data. Look for unusual logins, privilege changes, service activity, and configuration changes, then correlate those events with alerts and known administrative work. Red Hat notes that malware compromise can resemble other forms of attacker activity in logs and monitoring, so no single symptom proves a rootkit.
Collect suspicious executable files, including ELF files found in writable temporary locations such as /dev/shm/tmp and /var/tmp, for analysis. Preserve timestamps and surrounding context when your incident procedures call for evidence handling. Avoid executing an unknown file on the affected host.
Correlate findings and interpret scanner results cautiously
Compare persistence changes, kernel indicators, logs, observed system behavior, and IDS or EDR alerts rather than relying on one signal. A scanner can contribute evidence, but a clean scan does not establish that the host is trustworthy: rootkits may hide activity, and a compromised system may not report its state reliably. Red Hat’s general guidance on rootkits, Trojans, and malware and its HiddenWasp guidance support treating suspected compromise as a matter for broader analysis and trusted restoration.
Choose examination, specialist response, or recovery
Use your organization’s incident-response process to decide how to proceed. Specialist incident-response or digital-forensics help is particularly useful when evidence must be preserved, the scope is unclear, or suspected privileged access makes host-based findings unreliable. Consider these questions with the security team:
Rank #4
- Evidence: Must logs, disk images, or other artifacts be preserved before changes are made?
- Scope: Could related servers, accounts, credentials, or network activity also be affected?
- Trust: Is there credible evidence of rootkit or privileged compromise that undermines confidence in the running host?
- Recovery: Is a known-clean backup or trusted image available, and can restored data be checked before the server returns to service?
- Coverage: Does the eradication plan address multiple possible persistence mechanisms and include monitoring afterward?
When compromise is credible, Red Hat says compromised systems should usually be erased and reinstalled or restored from a trusted backup. CISA recommends clean reimaging, scanning for malicious code, and monitoring after eradication; its playbook also advises rebuilding hardware if rootkits are involved. The appropriate recovery path depends on severity, evidence requirements, and confidence in the recovery source—not on a universal rule for every server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.After recovery, keep watching for recurrence
Before returning a restored server to service, validate the recovery source and check restored data for malicious code. Revisit accounts, SSH keys, scheduled jobs, systemd units, and other relevant configuration as part of eradication, then monitor for renewed suspicious activity. CISA recommends continued monitoring after eradication because removing one observed item may not address every persistence mechanism.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
