Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that rootkits operate as part of the kernel, driver or service running on the system, injecting themself into DLLs or installing as a legitimate applications.

If I were to scan the system with sigverif.exe, would the files injected with the rootkit have broken signatures?

share|improve this question
up vote 4 down vote accepted

Unlikely. Most rootkits hide themselves so that any access with the standard Win32 APIs would display the original file (if it was patched) and ignore any extra files/services added by the rootkit.

Also, sigverif only verifies files it knows to be signed – any additional files would simply be ignored.

RootkitRevealer is a more reliable tool. Some really nasty rootkits are only visible when comparing an online and offline scans (for example, from Windows itself and from a Linux CD).

share|improve this answer
    
Very usefull, thanks – Dean Aug 19 '11 at 16:36
    
How can you compare those 2? Is there a utility that does that? – Dean Aug 19 '11 at 16:40
    
@Dean: There should be, but I'm not aware of any :( – grawity Aug 19 '11 at 16:42
    
Fair enough, thanks for the answer. – Dean Aug 19 '11 at 17:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .