Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I know that rootkits operate as part of the kernel, driver or service running on the system, injecting themself into DLLs or installing as a legitimate applications.

If I were to scan the system with sigverif.exe, would the files injected with the rootkit have broken signatures?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Unlikely. Most rootkits hide themselves so that any access with the standard Win32 APIs would display the original file (if it was patched) and ignore any extra files/services added by the rootkit.

Also, sigverif only verifies files it knows to be signed – any additional files would simply be ignored.

RootkitRevealer is a more reliable tool. Some really nasty rootkits are only visible when comparing an online and offline scans (for example, from Windows itself and from a Linux CD).

share|improve this answer
    
Very usefull, thanks –  Dean Aug 19 '11 at 16:36
    
How can you compare those 2? Is there a utility that does that? –  Dean Aug 19 '11 at 16:40
    
@Dean: There should be, but I'm not aware of any :( –  grawity Aug 19 '11 at 16:42
    
Fair enough, thanks for the answer. –  Dean Aug 19 '11 at 17:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.