"W" wrote:
> Which - if any - of Microsoft's operating systems have signed operating
> system files, so that it becomes next to impossible for a rootkit or trojan
> to interfere with the core OS files? I would like to know about the
> consumer as well as server operating systems.
Doesn't matter for a rootkit. Signing is irrelevant since the rootkit
loads before the OS loads (or hides itself from normal visibility in the
file system after the OS loads by stacking its handler in the file API).
No general-purpose OS can prevent itself from getting infected. They
don't need to replace any OS files but that has certainly happened.
|