How can I verify that a Windows XP POS operating system executable is authentic?
up vote
11
down vote
favorite
I have a 3rd party firewall that alerted me that msiexec.exe was replaced by another version. The timing didn't correspond to an OS update, so I was worried a bad actor replaced the exe. How can I verify the signature of the exe?
EDIT:
I found this link at Microsoft which shows this, and it matches on byte size and file date:
I'd feel better if it had a hash too, but it looks like it's not nefarious.
As suggested in harrymc's answer, I ran sfc /scannnow and it came out clean. Thanks!
digital-signature windows-xp-embedded
asked Dec 12 at 20:31
Dale
266112
add a comment |
up vote
11
down vote
favorite
I have a 3rd party firewall that alerted me that msiexec.exe was replaced by another version. The timing didn't correspond to an OS update, so I was worried a bad actor replaced the exe. How can I verify the signature of the exe?
EDIT:
I found this link at Microsoft which shows this, and it matches on byte size and file date:
I'd feel better if it had a hash too, but it looks like it's not nefarious.
As suggested in harrymc's answer, I ran sfc /scannnow and it came out clean. Thanks!
digital-signature windows-xp-embedded
asked Dec 12 at 20:31
Dale
266112
2
Suspicious indeed, as XP is not in active support. You could maybe check the history in Windows Update and runsfc /scannow, if they exists in XP Embedded. Reboot the device before starting.
– harrymc
Dec 12 at 20:43
1
sfc /scannowis exactly what I needed!
– Dale
Dec 12 at 20:48
1
Since you like it, I added it as an answer.
– harrymc
Dec 12 at 20:51
add a comment |
up vote
11
down vote
favorite
up vote
11
down vote
favorite
I have a 3rd party firewall that alerted me that msiexec.exe was replaced by another version. The timing didn't correspond to an OS update, so I was worried a bad actor replaced the exe. How can I verify the signature of the exe?
EDIT:
I found this link at Microsoft which shows this, and it matches on byte size and file date:
I'd feel better if it had a hash too, but it looks like it's not nefarious.
As suggested in harrymc's answer, I ran sfc /scannnow and it came out clean. Thanks!
digital-signature windows-xp-embedded
asked Dec 12 at 20:31
Dale
266112
I have a 3rd party firewall that alerted me that msiexec.exe was replaced by another version. The timing didn't correspond to an OS update, so I was worried a bad actor replaced the exe. How can I verify the signature of the exe?
EDIT:
I found this link at Microsoft which shows this, and it matches on byte size and file date:
I'd feel better if it had a hash too, but it looks like it's not nefarious.
As suggested in harrymc's answer, I ran sfc /scannnow and it came out clean. Thanks!
digital-signature windows-xp-embedded
digital-signature windows-xp-embedded
asked Dec 12 at 20:31
Dale
266112
asked Dec 12 at 20:31
Dale
266112
edited Dec 12 at 20:53
asked Dec 12 at 20:31
Dale
266112
asked Dec 12 at 20:31
Dale
266112
asked Dec 12 at 20:31
Dale
266112
266112
2
Suspicious indeed, as XP is not in active support. You could maybe check the history in Windows Update and runsfc /scannow, if they exists in XP Embedded. Reboot the device before starting.
– harrymc
Dec 12 at 20:43
1
sfc /scannowis exactly what I needed!
– Dale
Dec 12 at 20:48
1
Since you like it, I added it as an answer.
– harrymc
Dec 12 at 20:51
add a comment |
2
Suspicious indeed, as XP is not in active support. You could maybe check the history in Windows Update and runsfc /scannow, if they exists in XP Embedded. Reboot the device before starting.
– harrymc
Dec 12 at 20:43
1
sfc /scannowis exactly what I needed!
– Dale
Dec 12 at 20:48
1
Since you like it, I added it as an answer.
– harrymc
Dec 12 at 20:51
2
2
Suspicious indeed, as XP is not in active support. You could maybe check the history in Windows Update and run
sfc /scannow, if they exists in XP Embedded. Reboot the device before starting.– harrymc
Dec 12 at 20:43
Suspicious indeed, as XP is not in active support. You could maybe check the history in Windows Update and run
sfc /scannow, if they exists in XP Embedded. Reboot the device before starting.– harrymc
Dec 12 at 20:43
1
1
sfc /scannow is exactly what I needed!– Dale
Dec 12 at 20:48
sfc /scannow is exactly what I needed!– Dale
Dec 12 at 20:48
1
1
Since you like it, I added it as an answer.
– harrymc
Dec 12 at 20:51
Since you like it, I added it as an answer.
– harrymc
Dec 12 at 20:51
add a comment |
1 Answer
1
active
oldest
votes
up vote
15
down vote
accepted
Windows XP Embedded POSReady is now on extended support until April 9, 2019.
This means no new features and fewer bug fixes and patches.
It is entirely possible that this update was legitimate, but is better checked.
It is also possible that the firewall detected just now a change that happened
some time in the past.
Possible checks:
- Verify the history in Windows Update,
- Run
sfc /scannowto check system integrity.
Reboot the device before starting, just in case.
answered Dec 12 at 20:51
harrymc
251k11259558
15
XP POS (essentially XP embedded) is for one more year.
– Joshua
Dec 12 at 22:31
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1383112%2fhow-can-i-verify-that-a-windows-xp-pos-operating-system-executable-is-authentic%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
15
down vote
accepted
Windows XP Embedded POSReady is now on extended support until April 9, 2019.
This means no new features and fewer bug fixes and patches.
It is entirely possible that this update was legitimate, but is better checked.
It is also possible that the firewall detected just now a change that happened
some time in the past.
Possible checks:
- Verify the history in Windows Update,
- Run
sfc /scannowto check system integrity.
Reboot the device before starting, just in case.
answered Dec 12 at 20:51
harrymc
251k11259558
15
XP POS (essentially XP embedded) is for one more year.
– Joshua
Dec 12 at 22:31
add a comment |
up vote
15
down vote
accepted
Windows XP Embedded POSReady is now on extended support until April 9, 2019.
This means no new features and fewer bug fixes and patches.
It is entirely possible that this update was legitimate, but is better checked.
It is also possible that the firewall detected just now a change that happened
some time in the past.
Possible checks:
- Verify the history in Windows Update,
- Run
sfc /scannowto check system integrity.
Reboot the device before starting, just in case.
answered Dec 12 at 20:51
harrymc
251k11259558
15
XP POS (essentially XP embedded) is for one more year.
– Joshua
Dec 12 at 22:31
add a comment |
up vote
15
down vote
accepted
up vote
15
down vote
accepted
Windows XP Embedded POSReady is now on extended support until April 9, 2019.
This means no new features and fewer bug fixes and patches.
It is entirely possible that this update was legitimate, but is better checked.
It is also possible that the firewall detected just now a change that happened
some time in the past.
Possible checks:
- Verify the history in Windows Update,
- Run
sfc /scannowto check system integrity.
Reboot the device before starting, just in case.
answered Dec 12 at 20:51
harrymc
251k11259558
Windows XP Embedded POSReady is now on extended support until April 9, 2019.
This means no new features and fewer bug fixes and patches.
It is entirely possible that this update was legitimate, but is better checked.
It is also possible that the firewall detected just now a change that happened
some time in the past.
Possible checks:
- Verify the history in Windows Update,
- Run
sfc /scannowto check system integrity.
Reboot the device before starting, just in case.
answered Dec 12 at 20:51
harrymc
251k11259558
edited Dec 13 at 11:09
answered Dec 12 at 20:51
harrymc
251k11259558
answered Dec 12 at 20:51
harrymc
251k11259558
answered Dec 12 at 20:51
harrymc
251k11259558
251k11259558
15
XP POS (essentially XP embedded) is for one more year.
– Joshua
Dec 12 at 22:31
add a comment |
15
XP POS (essentially XP embedded) is for one more year.
– Joshua
Dec 12 at 22:31
15
15
XP POS (essentially XP embedded) is for one more year.
– Joshua
Dec 12 at 22:31
XP POS (essentially XP embedded) is for one more year.
– Joshua
Dec 12 at 22:31
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1383112%2fhow-can-i-verify-that-a-windows-xp-pos-operating-system-executable-is-authentic%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
Suspicious indeed, as XP is not in active support. You could maybe check the history in Windows Update and run
sfc /scannow, if they exists in XP Embedded. Reboot the device before starting.– harrymc
Dec 12 at 20:43
1
sfc /scannowis exactly what I needed!– Dale
Dec 12 at 20:48
1
Since you like it, I added it as an answer.
– harrymc
Dec 12 at 20:51