Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a tool that will check integrity of system files in Win7 and search for invalid or changed ones. I would like to find which files were changed by rootkit installed on system. It would be nice if there existed some databases with system files names and corresponding hashes (original and updated by Windows Update).

share|improve this question
up vote 6 down vote accepted

Use sfc /scannow command.

This command (System File Checker) scans the integrity of all protected Windows 7 system files and replaces incorrect corrupted, changed, or damaged versions with the correct versions if possible.

You can read this tutorial on how to use it:

How to Repair Windows 7 System Files with System File Checker

share|improve this answer
I already tried sfc /verifyonly and everything was OK. But i guess there is some change in system files because i have some rootkit installed, and to modify my view on file system it should change some system files? – watbywbarif Feb 23 '11 at 7:36
For every anti-virus measure, there's a virus to beat it (was that Sun Tsu?) – Kara Marfia Feb 23 '11 at 7:45
@Kara: Hehe, that is true, but reverse of this statement is also true ;) So if I want to kill this shit without reinstall of OS I want to learn how. – watbywbarif Feb 23 '11 at 9:19
some rootkits are installed in user's folder - search under Users for .exe and .dll if any they shouldn't be there. Also check with something like HijackThis to see what is loading during the boot – jet Feb 23 '11 at 16:19
Although this did not fix my problem it seams like good tool to check system integrity. Thx! – watbywbarif Feb 24 '11 at 10:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .