3 ms·
How do you gather the hashes? The machine itself (obviously) couldn't do it, since the malware may have changed the system to always report correct hashes (and/
by danieldk 12y ago
How do you gather the hashes? The machine itself (obviously) couldn't do it, since the malware may have changed the system to always report correct hashes (and/or send the original binaries).
So, it means what you mean by 'externally' and how sophisticated you expect the malware to be.
- colordrops 12y agoFor pre-installed files, you have hashes that are publicly known. Afterward, you continue to set the hash with each modification to a file, and report it over the network or to an external device. If you can identify the time of infection, you know which hashes are good. After you get the infected machine, you pull out the drive and scan it externally, looking for bad hashes and files that shouldn't be there.