Hashes of system processes?

Question

Malware

The task arose to write a program that checks system processes (Task Manager -> Processes) by hash for possible modification.



For example, if a virus disguises itself as explorer.exe, then the program compares the "correct hash" (of the original explorer.exe) and the current hash (of the infected explorer.exe), after which, if the hashes do not match, it informs the user about it. Thus, the program should scan all running system processes.

Now the question itself is - is there a list of original hashes of system processes, such as explorer.exe, on the Internet?

Answer 1

What prevents to take the original from a distra? This is the first. Secondly, in order to constantly monitor hashes for changes, rather strong computing power is needed. There will be brakes like from a wretched Casper in due time.

Answer 2

Since new updates are constantly arriving in Windows, system files (including executable ones) change regularly.
PS: Your idea was implemented back in the days of DOS.