Home / server / Questions / 141352
Accepted
martyvis
Asked: 2010-05-13 18:49:25 +0800 CST

md5sum or sha1sum of legitmate microsoft system files

  • 772

Is there a database or repository of the legitimate checksums for Microsoft system files? We think we have a 0day on DNS for Windows 2003 SP2 using IRC for command and control. (Latest McAfee does not see an issue). I want to compare our customer's dns.exe and associated DLLs with the real ones. (I will grab a fresh SP2 and hotfixed system to do this, but wonder how to do this in future without needed to do this.)

windows anti-virus malware domain-name-system security

2 Answers

  1. Best Answer

    Have you tried the System File Checker? It is designed to scan Windows sytem files and replace the "bad" ones. It's pretty easy to run from the command-line:

    sfc /scannow
    • 1

  2. You need to verify that Windows file protection was on and run the system file checker (SFC) see this KB article for the registry entries to check and SFC/WFP options. Newer versions of windows verify that the exe/DLL for OS files is signed by microsoft before loading.

    • 0