Necromanhcer

Hey guys! I know I am brand new to the forum but I am not brand new to the security field. Then again, I'm not close to a pro. I have a computer that whenever you shutdown it will re-image itself and reset to a standard computer. You can locally logon or you can use a net logon. I was wondering how you'd go about RATing that. Would a rootkit remove the reset function but still leave it lookings like an ordinary one? Thanks!