Editing Malware (section)

====Rootkits====
{{Main|Rootkit}}

Once malicious software is installed on a system, it is essential that it stays concealed, to avoid detection. Software packages known as ''rootkits'' allow this concealment, by modifying the host's operating system so that the malware is hidden from the user. Rootkits can prevent a harmful [[process (computing)|process]] from being visible in the system's list of [[process (computing)|processes]], or keep its files from being read.<ref>{{cite web|last=McDowell|first=Mindi|title=Understanding Hidden Threats: Rootkits and Botnets|url=http://www.us-cert.gov/ncas/tips/ST06-001|access-date=6 February 2013|publisher=US-CERT|archive-date=29 March 2017|archive-url=https://web.archive.org/web/20170329025139/https://www.us-cert.gov/ncas/tips/ST06-001|url-status=dead}}</ref>

Some types of harmful software contain routines to evade identification and/or removal attempts, not merely to hide themselves. An early example of this behavior is recorded in the [[Jargon File]] tale of a pair of programs infesting a Xerox [[CP-V operating system|CP-V]] time sharing system:

{{blockquote|Each ghost-job would detect the fact that the other had been killed, and would start a new copy of the recently stopped program within a few milliseconds. The only way to kill both ghosts was to kill them simultaneously (very difficult) or to deliberately crash the system.<ref>{{cite web|url=http://catb.org/jargon/html/meaning-of-hack.html|title=The Meaning of 'Hack'|publisher=Catb.org|access-date=15 April 2010|archive-date=13 October 2016|archive-url=https://web.archive.org/web/20161013133924/http://www.catb.org/jargon/html/meaning-of-hack.html|url-status=live}}</ref>}}