11

I have a 3rd party firewall that alerted me that msiexec.exe was replaced by another version. The timing didn't correspond to an OS update, so I was worried a bad actor replaced the exe. How can I verify the signature of the exe?

EDIT: I found this link at Microsoft which shows this, and it matches on byte size and file date:

Versions and Sizes of files

I'd feel better if it had a hash too, but it looks like it's not nefarious.

As suggested in harrymc's answer, I ran sfc /scannnow and it came out clean. Thanks!

  • 2
    Suspicious indeed, as XP is not in active support. You could maybe check the history in Windows Update and run sfc /scannow, if they exists in XP Embedded. Reboot the device before starting. – harrymc Dec 12 '18 at 20:43
  • 1
    sfc /scannow is exactly what I needed! – Dale Dec 12 '18 at 20:48
  • 1
    Since you like it, I added it as an answer. – harrymc Dec 12 '18 at 20:51
15

Windows XP Embedded POSReady is now on extended support until April 9, 2019. This means no new features and fewer bug fixes and patches. It is entirely possible that this update was legitimate, but is better checked. It is also possible that the firewall detected just now a change that happened some time in the past.

Possible checks:

  • Verify the history in Windows Update,
  • Run sfc /scannow to check system integrity.

Reboot the device before starting, just in case.

  • 15
    XP POS (essentially XP embedded) is for one more year. – Joshua Dec 12 '18 at 22:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.