Rootkits allow attackers to steal data from your computer, exploit its processing power, and monitor user activities. There are two main ways to detect a rootkit in the system: the first implies detecting a rootkit on a running computer, the other – detecting a rootkit in a data image (or on a non-functioning computer). The paper provides practical examples, thus allowing readers to repeat the experiments without too much difficulty.