3
I know that rootkits operate as part of the kernel, driver or service running on the system, injecting themself into DLLs or installing as a legitimate applications.
If I were to scan the system with sigverif.exe
, would the files injected with the rootkit have broken signatures?
How can you compare those 2? Is there a utility that does that? – Dean – 2011-08-19T16:40:09.197
@Dean: There should be, but I'm not aware of any :( – user1686 – 2011-08-19T16:42:49.260