Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a database or repository of the legitimate checksums for Microsoft system files? We think we have a 0day on DNS for Windows 2003 SP2 using IRC for command and control. (Latest McAfee does not see an issue). I want to compare our customer's dns.exe and associated DLLs with the real ones. (I will grab a fresh SP2 and hotfixed system to do this, but wonder how to do this in future without needed to do this.)

share|improve this question
up vote 1 down vote accepted

Have you tried the System File Checker? It is designed to scan Windows sytem files and replace the "bad" ones. It's pretty easy to run from the command-line:

sfc /scannow
share|improve this answer
SFC, IIRC, compares the files to the ones on the original install disc and will therefore have different checksums/modification dates/file sizes/etc for any updated file. Am I wrong about this? – Kevin M May 13 '10 at 4:03
I wasn't aware of this utility (I'm not a Windows guy), but will check it out. – martyvis May 13 '10 at 21:39

You need to verify that Windows file protection was on and run the system file checker (SFC) see this KB article for the registry entries to check and SFC/WFP options. Newer versions of windows verify that the exe/DLL for OS files is signed by microsoft before loading.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.