verying Windows binaries after corruption/rootkit/bitrot
Posted: Fri Sep 27, 2013 8:24 pm
I don't know if this is the right board, but here we go.
How can I verify that the stock Windows system files have not been corrupted. I know that certain rootkits can alter them and stay undetected (not alter the checksum). I believe modern Windows' have system file protection and W8 has secureboot, but is there a straightforward way I can verify the binaries, or use third party tools that can.
If all the system files are binary identical across different deployments then an altered binary can be detected, right?
I am saying all this because some POS rootkit it randomly calling shutdown.exe to restart my machine and then change the partition type to hidden(0x17). fixmbr, fixboot, and offline scanning have been tried already
How can I verify that the stock Windows system files have not been corrupted. I know that certain rootkits can alter them and stay undetected (not alter the checksum). I believe modern Windows' have system file protection and W8 has secureboot, but is there a straightforward way I can verify the binaries, or use third party tools that can.
If all the system files are binary identical across different deployments then an altered binary can be detected, right?
I am saying all this because some POS rootkit it randomly calling shutdown.exe to restart my machine and then change the partition type to hidden(0x17). fixmbr, fixboot, and offline scanning have been tried already