Uninstalling the rootkit

You can uninstall the rootkit from the machine using the installation script.

To uninstall, run the following command in the module-creation folder:

sudo ./install.sh remove

What the removal does

The uninstall script performs the following steps:

1. Unloads the kernel module using rmmod. If the module is currently hiding itself, it first writes toggle to /proc/epirootkit to make it removable.
2. Deletes the driver directory at /lib/modules/<kernel-version>/kernel/drivers/rk_file_epirootkit/.
3. Cleans /etc/modules to prevent the module from loading on reboot.
4. Runs depmod to update the module dependency database.
5. Cleans build artifacts via make clean.

Manual removal

If the install script is unavailable, you can remove the module manually:

sudo rmmod epirootkit
sudo rm -rf /lib/modules/$(uname -r)/kernel/drivers/rk_file_epirootkit/
sudo depmod