verying Windows binaries after corruption/rootkit/bitrot

Discussions on more advanced topics such as monolithic vs micro-kernels, transactional memory models, and paging vs segmentation should go here. Use this forum to expand and improve the wiki!
Post Reply
garegin
Posts: 8
Joined: Tue Jan 01, 2013 11:57 am

verying Windows binaries after corruption/rootkit/bitrot

Post by garegin »

I don't know if this is the right board, but here we go.

How can I verify that the stock Windows system files have not been corrupted. I know that certain rootkits can alter them and stay undetected (not alter the checksum). I believe modern Windows' have system file protection and W8 has secureboot, but is there a straightforward way I can verify the binaries, or use third party tools that can.
If all the system files are binary identical across different deployments then an altered binary can be detected, right?
I am saying all this because some POS rootkit it randomly calling shutdown.exe to restart my machine and then change the partition type to hidden(0x17). fixmbr, fixboot, and offline scanning have been tried already
User avatar
dozniak
Member
Member
Posts: 723
Joined: Thu Jul 12, 2012 7:29 am
Location: Tallinn, Estonia

Re: verying Windows binaries after corruption/rootkit/bitrot

Post by dozniak »

First of all, this is the wrong forum.

Second, format c: and installing a Linux distro from a freshly downloaded DVD will solve the problem once and for good.
Learn to read.
Post Reply