Re:False detection on file tcpip.sys
by acqq on Sunday October 27, 2013 @03:19PM
(#6623080)
Even without any specific tool, you can observe the "Properties" of the binaries from Explorer and see the signature of the files that are signed. And when the fix isn't signed, of course, nothing can be checked.
[ Parent
| on HN ]
Actually windows does these checks automatically and replaces system files with signs of corruption/bad cert. You can force this check by using System File Checker tool in cmd:
sfc /scannow