There are several ways I check the integrity of files in Windows:
1. To verify the digital signatures of drivers, you can use sigverif.exe. This
tool is meant to verify the HCL signature from Microsoft to verify Windows
compatibility, but it is useful nonetheless.
2. To verify all files protected by Windows File Protection, you can use sfc
/scannow (note: look inside sfcfiles.dll to see what it checks).
3. To check the authenticode certificate of signed files, use chktrust (found
in various resource kits and sdk's)
4. You can also check the NTFS file journal of a file to see if a file has
changed, if you have the journal enabled for that volume: fsutil usn readdata
c:\windows\notepad.exe
5. Most hotfix scanners use hashes, file dates, etc. to check file versions and
are quite good at verifying that the files are authentic.
But there's no built-in method to verify hash signatures of files. You can use
a tool like fsum (http://www.slavasoft.com/fsum/) to create and verify hashes
but it isn't easy to directly compare them to the files on the install CD
because the files on the CD are all compressed. You would have to build a
baseline system and compare them to that.
One other note: In Windows XP and 2003 you can use Group Policy to set software
restriction policies to only run programs that you specify. You can set hash
rules for the policy so that the file only runs if the MD5 and SHA-1 hashes
match that in the policy. Setting this up would obviously be time-consuming but
would probably be worth it when protecting a critical server.
Hope this helps,
Mark Burnett
On Wed, 18 Aug 2004 16:55:06 +0000, Chris Conacher wrote:
Dear List
Is there anything that performs binary integrity checks for Windows
OS such as rpm does for Redhat or apt does for Debian?
I want something that will check Windows binaries against a trusted
source - MS site, install cd, etc so that I can determine integrity
baselines of current production systems before deploying an
integrity checking application.
I would have thought that this would be something Microsoft would
provide, but have not seen anything.
Thanks for any input
Chris
_________________________________________________________________
Express yourself with cool new emoticons
http://www.msn.co.uk/specials/myemo
--------------------------------------------------------------------
------- ------------------------------------------------------------
---------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
