Checking ntoskrnl for rootkit
06 Feb 2007
This is not new, but I needed it the other day and wanted to post it here for memory. In Microsoft's kernel debugger tool 'kd' the following command checks for binary corruption in every loaded module. Note also that you can do this with Sysinternal's 'LiveKd' for easier on the fly debugging.
kd> !for_each_module !chkimg @#ModuleName
Make sure you have trusted modules to compare against first. And point to them before running the above command with:
kd> .exepath c:Windowssystem32
kd> !for_each_module !chkimg @#ModuleName
Make sure you have trusted modules to compare against first. And point to them before running the above command with:
kd> .exepath c:Windowssystem32