Malware - rootkit theory
Malware is a catch-all term for any type of malicious software, regardless of how it works, its intent, or how it's distributed. This could include:
- Virus - Must be triggered by host, can replicate
- Worms - Self-propagating
- Trojan Horse - Disguised but don't replicate
- Ransomware on the rise thanks to crypto
- Backdoors, evasion, ... Who knows...
- Adware, spyware, (browser hijack), fake software
- Rootkits - comes from Linux, as an admin has "root" privilege. Rootkits that run in the kernel are hard to detect
The kernel is the computer program at CORE of the operating system:
The Windows kernel is written (mostly) in C programming language:
- As long as OS is running, kernel running in memory to:
- schedule, launch and end processes (hit CTRL ALT DEL Task Manager to see processes)
- init and run drivers (programs that communicate with hardware), allocate memory, etc
- Windows code stored (mostly) in DLLs:
- DLL - dynamic link library - libraries of Windows code (where Windows keeps all the code it needs to run)
- there is a kernel dll, user dll, etc that use other dlls: