For securitys sake I'm assuming my system is successfully compromised after a targeted and/or non-targeted attack.
I've downloaded some linux images and burned them to do a re-install. Since I can't trust my compromised system, I have to assume the images are automatically infected. I can't trust checksums since a rootkit could forge the result.
I think the only solution is to ask a friend to verify the cd with the sha256 checksums he/she would download from the linux distributors website after I've burned the cd on my system. This way I verify the image wasn't altered on my or his/her system.
Is this possible? What tools can I use? I've modified this script to calculate a sha256sum but they didn't match.