Rootkit scanner

Rootkits itself have the goal to keep itself hidden by intercepting system calls or overwriting common system binaries. A rootkit scanner has the goal to uncover any suspicious behavior of standard system calls or commands. This can be achieved by inspecting binaries, process listings, and traces on the disk.