Not a problem for the rootkit. They contain a plethora of tools designed to sanitize the intrusion to evade detection. There are tools to clean log files and erase evidence of the intruders actions. There are also tools for hiding the files and processes that the intruder may place on the system and even to hide port and protocol connections.
Until recently, the rootkit has been the bane of those with insecure Linux or Unix systems, but users of Microsoft operating systems were spared this headache.
Recently, Kevin Poulsen wrote an article on SecurityFocus regarding the advent of Windows rootkits (Windows Root Kits a Stealthy Threat). Unlike normal Trojan and backdoor programs that operate on a user or application level, these new tools interact directly with the kernel- the heart of the Windows operating system. Doing so allows it perform on a higher level and evade detection by firewall software, antivirus software and other security applications.
One of the problems is that there is no way to truly know how many of these rootkits exist. If they do what they're designed to do they should not be discovered. We only know about the ones that failed to achieve their ultimate goal- evading detection.
What do you do if you find that you have been victimized by a rootkit? That could spark a good debate. You could remove the root kit files, close ports you dont want open and change your name and password. The problem is that you have no idea what tools, backdoors, or other malicious utilities still live on your computer undetected. If you are on a network- you have no idea how many other systems have been infiltrated or how many other backdoors may have been opened.
Ideally, you should probably format the hard drive and rebuild the computer from scratch or from a clean, known-good image, but this time add extra security to keep your system from getting hacked again. If you are on a network you may need to scan or investigate each machine to try and determine whether any others have been victimized and cleanse them as well.
