1

Is there a database or repository of the legitimate checksums for Microsoft system files? We think we have a 0day on DNS for Windows 2003 SP2 using IRC for command and control. (Latest McAfee does not see an issue). I want to compare our customer's dns.exe and associated DLLs with the real ones. (I will grab a fresh SP2 and hotfixed system to do this, but wonder how to do this in future without needed to do this.)

2 Answers 2

1

Have you tried the System File Checker? It is designed to scan Windows sytem files and replace the "bad" ones. It's pretty easy to run from the command-line:

sfc /scannow
2
  • SFC, IIRC, compares the files to the ones on the original install disc and will therefore have different checksums/modification dates/file sizes/etc for any updated file. Am I wrong about this?
    – Kevin M
    May 13, 2010 at 4:03
  • I wasn't aware of this utility (I'm not a Windows guy), but will check it out.
    – martyvis
    May 13, 2010 at 21:39
0

You need to verify that Windows file protection was on and run the system file checker (SFC) see this KB article for the registry entries to check and SFC/WFP options. Newer versions of windows verify that the exe/DLL for OS files is signed by microsoft before loading.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .