How can I verify that a Windows XP POS operating system executable is authentic?











up vote
7
down vote

favorite












I have a 3rd party firewall that alerted me that msiexec.exe was replaced by another version. The timing didn't correspond to an OS update, so I was worried a bad actor replaced the exe. How can I verify the signature of the exe?



EDIT:
I found this link at Microsoft which shows this, and it matches on byte size and file date:



Versions and Sizes of files



I'd feel better if it had a hash too, but it looks like it's not nefarious.



As suggested in harrymc's answer, I ran sfc /scannnow and it came out clean. Thanks!






digital-signature windows-xp-embedded







share|improve this question




















  • 2




    Suspicious indeed, as XP is not in active support. You could maybe check the history in Windows Update and run sfc /scannow, if they exists in XP Embedded. Reboot the device before starting.
    – harrymc
    7 hours ago










  • sfc /scannow is exactly what I needed!
    – Dale
    7 hours ago










  • Since you like it, I added it as an answer.
    – harrymc
    7 hours ago















up vote
7
down vote

favorite












I have a 3rd party firewall that alerted me that msiexec.exe was replaced by another version. The timing didn't correspond to an OS update, so I was worried a bad actor replaced the exe. How can I verify the signature of the exe?



EDIT:
I found this link at Microsoft which shows this, and it matches on byte size and file date:



Versions and Sizes of files



I'd feel better if it had a hash too, but it looks like it's not nefarious.



As suggested in harrymc's answer, I ran sfc /scannnow and it came out clean. Thanks!






digital-signature windows-xp-embedded







share|improve this question




















  • 2




    Suspicious indeed, as XP is not in active support. You could maybe check the history in Windows Update and run sfc /scannow, if they exists in XP Embedded. Reboot the device before starting.
    – harrymc
    7 hours ago










  • sfc /scannow is exactly what I needed!
    – Dale
    7 hours ago










  • Since you like it, I added it as an answer.
    – harrymc
    7 hours ago













up vote
7
down vote

favorite









up vote
7
down vote

favorite











I have a 3rd party firewall that alerted me that msiexec.exe was replaced by another version. The timing didn't correspond to an OS update, so I was worried a bad actor replaced the exe. How can I verify the signature of the exe?



EDIT:
I found this link at Microsoft which shows this, and it matches on byte size and file date:



Versions and Sizes of files



I'd feel better if it had a hash too, but it looks like it's not nefarious.



As suggested in harrymc's answer, I ran sfc /scannnow and it came out clean. Thanks!






digital-signature windows-xp-embedded







share|improve this question















I have a 3rd party firewall that alerted me that msiexec.exe was replaced by another version. The timing didn't correspond to an OS update, so I was worried a bad actor replaced the exe. How can I verify the signature of the exe?



EDIT:
I found this link at Microsoft which shows this, and it matches on byte size and file date:



Versions and Sizes of files



I'd feel better if it had a hash too, but it looks like it's not nefarious.



As suggested in harrymc's answer, I ran sfc /scannnow and it came out clean. Thanks!






digital-signature windows-xp-embedded




digital-signature windows-xp-embedded






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited 7 hours ago

























asked 7 hours ago









Dale

246110




246110








  • 2




    Suspicious indeed, as XP is not in active support. You could maybe check the history in Windows Update and run sfc /scannow, if they exists in XP Embedded. Reboot the device before starting.
    – harrymc
    7 hours ago










  • sfc /scannow is exactly what I needed!
    – Dale
    7 hours ago










  • Since you like it, I added it as an answer.
    – harrymc
    7 hours ago














  • 2




    Suspicious indeed, as XP is not in active support. You could maybe check the history in Windows Update and run sfc /scannow, if they exists in XP Embedded. Reboot the device before starting.
    – harrymc
    7 hours ago










  • sfc /scannow is exactly what I needed!
    – Dale
    7 hours ago










  • Since you like it, I added it as an answer.
    – harrymc
    7 hours ago








2




2




Suspicious indeed, as XP is not in active support. You could maybe check the history in Windows Update and run sfc /scannow, if they exists in XP Embedded. Reboot the device before starting.
– harrymc
7 hours ago




Suspicious indeed, as XP is not in active support. You could maybe check the history in Windows Update and run sfc /scannow, if they exists in XP Embedded. Reboot the device before starting.
– harrymc
7 hours ago












sfc /scannow is exactly what I needed!
– Dale
7 hours ago




sfc /scannow is exactly what I needed!
– Dale
7 hours ago












Since you like it, I added it as an answer.
– harrymc
7 hours ago




Since you like it, I added it as an answer.
– harrymc
7 hours ago










1 Answer
1






active

oldest

votes

















up vote
7
down vote



accepted










Suspicious indeed, as XP is not in active support.



Possible actions:




  • Verify the history in Windows Update,

  • Run sfc /scannow to check system integrity.


Reboot the device before starting, just in case.






share|improve this answer

















  • 4




    XP POS (essentially XP embedded) is for one more year.
    – Joshua
    5 hours ago











Your Answer








StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1383112%2fhow-can-i-verify-that-a-windows-xp-pos-operating-system-executable-is-authentic%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes








up vote
7
down vote



accepted










Suspicious indeed, as XP is not in active support.



Possible actions:




  • Verify the history in Windows Update,

  • Run sfc /scannow to check system integrity.


Reboot the device before starting, just in case.






share|improve this answer

















  • 4




    XP POS (essentially XP embedded) is for one more year.
    – Joshua
    5 hours ago















up vote
7
down vote



accepted










Suspicious indeed, as XP is not in active support.



Possible actions:




  • Verify the history in Windows Update,

  • Run sfc /scannow to check system integrity.


Reboot the device before starting, just in case.






share|improve this answer

















  • 4




    XP POS (essentially XP embedded) is for one more year.
    – Joshua
    5 hours ago













up vote
7
down vote



accepted







up vote
7
down vote



accepted






Suspicious indeed, as XP is not in active support.



Possible actions:




  • Verify the history in Windows Update,

  • Run sfc /scannow to check system integrity.


Reboot the device before starting, just in case.






share|improve this answer












Suspicious indeed, as XP is not in active support.



Possible actions:




  • Verify the history in Windows Update,

  • Run sfc /scannow to check system integrity.


Reboot the device before starting, just in case.







share|improve this answer












share|improve this answer



share|improve this answer










answered 7 hours ago









harrymc

250k11258556




250k11258556








  • 4




    XP POS (essentially XP embedded) is for one more year.
    – Joshua
    5 hours ago














  • 4




    XP POS (essentially XP embedded) is for one more year.
    – Joshua
    5 hours ago








4




4




XP POS (essentially XP embedded) is for one more year.
– Joshua
5 hours ago




XP POS (essentially XP embedded) is for one more year.
– Joshua
5 hours ago


















draft saved

draft discarded




















































Thanks for contributing an answer to Super User!


  • Please be sure to answer the question. Provide details and share your research!

But avoid …



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.





Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


Please pay close attention to the following guidance:


  • Please be sure to answer the question. Provide details and share your research!

But avoid …



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1383112%2fhow-can-i-verify-that-a-windows-xp-pos-operating-system-executable-is-authentic%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







-

Popular posts from this blog

What visual should I use to simply compare current year value vs last year in Power BI desktop

Image
0 I have column SubToBind that shows current year ratio and column PY SubToBind which shows previous year ratio. How can I simply create a card that would be displaying them both in a nice way? Something like that: I cannot achieve that with regular card, I also tried Card with States by OKViz but also unable to see both values. In KPI visual - I dont like the word "Goal", it will confuse end users. Are there any cards or other visuals that would do the job? Thanks powerbi dax powerbi-embedded share | improve this question edited Jun 11 '18 at 20:11 Oleg ...
Read more

How to ignore python UserWarning in pytest?

Image
up vote 1 down vote favorite I am using openpyxl for parsing .xlsm files, and pytest for testing. When I open a file, I get the: OpenPyxl -> UserWarning: Data Validation extension is not supported and will be removed That is not really a problem bcs. program works and I can't change the .xlsm file to fix that. But... When I run pytest with something like: def test_wrong_file_format(): assert check_excel(open_excel('file.xlsm')) == True I will get the warning i mentioned altought check_excel(open_excel('file.xlsm')) returns True and the test should suceed... Is there a nice way to tell the pytest that "It's not a bug it's a feature" and tests should pass even when they get this warning? Is there other way than using something like: with pytest.warns(UserWarning): ...
Read more

Alexandru Averescu

Image
Alexandre Averescu Alexandru Averescu Naissance 3 avril 1859 Babele, Ismail  (ro) près de Izmaïl (principauté de Moldavie) Décès 2 octobre 1938 (à 79 ans) [ 1 ] Bucarest Origine   Roumanie Arme cavalerie Grade Maréchal Années de service 1901-1917 Commandement chef d'état-major général 2 e  armée 3 e  armée Groupe d'armée sud armée du Danube Conflits Guerre russo-turque de 1877-1878 Deuxième guerre balkanique Première Guerre mondiale Faits d'armes Bataille de Turtucaia/Tutrakan Bataille de Mărăști Distinctions Autres fonctions 3 fois président du Conseil des ministres ministre des Affaires étrangères ministre sans portefeuille conseiller de la Couronne modifier   Alexandre Averescu (en roumain : Alexandru Averescu .mw-parser-output .prononciation>a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/8/8a/Loudspeaker.svg/11px-Loudspeaker.svg.png")center ...
Read more