Can signature verification expose a rootkit?

Question

I know that rootkits operate as part of the kernel, driver or service running on the system, injecting themself into DLLs or installing as a legitimate applications.

If I were to scan the system with sigverif.exe, would the files injected with the rootkit have broken signatures?

score 4 · Accepted Answer · answered Aug 19 '11 at 16:35

4

Unlikely. Most rootkits hide themselves so that any access with the standard Win32 APIs would display the original file (if it was patched) and ignore any extra files/services added by the rootkit.

Also, sigverif only verifies files it knows to be signed – any additional files would simply be ignored.

RootkitRevealer is a more reliable tool. Some really nasty rootkits are only visible when comparing an online and offline scans (for example, from Windows itself and from a Linux CD).

answered Aug 19 '11 at 16:35

u1686_grawity

426,297
64
894
966

How can you compare those 2? Is there a utility that does that? – Dean Aug 19 '11 at 16:40
@Dean: There *should* be, but I'm not aware of any :( – u1686_grawity Aug 19 '11 at 16:42

Can signature verification expose a rootkit?

1 Answers1