News for hackers. Stuff that matters.
Re:False detection on file tcpip.sys by timsally on Sunday October 27, 2013 @02:49PM (#6622951)
Ouch. To make things even worse, the executable 'kaspersky_tcpip_fix.exe' to fix the problem is (1) not delivered over HTTPS and (2) not signed by Kaspersky (it is unsigned). So not only are you unable to receive an authenticated update to your antivirus database to fix the problem because your network is down, but you have no assurances that the offline tool provided to you to fix the problem actually came from Kaspersky.

For those that are curious, you can use a tool distributed by Microsoft called Sigcheck to display signature information (http://technet.microsoft.com/en-us/sysinternals/bb897441.asp...).

Re:False detection on file tcpip.sys by acqq on Sunday October 27, 2013 @03:19PM (#6623080)
Even without any specific tool, you can observe the "Properties" of the binaries from Explorer and see the signature of the files that are signed. And when the fix isn't signed, of course, nothing can be checked.
Re:False detection on file tcpip.sys by arnnr on Sunday October 27, 2013 @10:12PM (#6624688)
Actually windows does these checks automatically and replaces system files with signs of corruption/bad cert. You can force this check by using System File Checker tool in cmd: sfc /scannow