My Dell Mini Forum

Dreizehn · **BotNet on Win7 (Torrent downloaders beware!) -** 05-20-2009, 07:06 AM

Cybercriminals Launch Tainted Windows 7 RC| Malware Blog | Trend Micro
"A file being hosted in popular torrent sites posing as a copy of the Windows 7 RC was found to be a Trojan by security researchers. The file which arrives with the file name setup.exe is detected as TROJ_DROPPER.SPX. TROJ_DROPPER.SPX drops TROJ_AGENT.NICE. Both files are detected by the Smart Protection Network."

Just thought I'd tell everyone here, looking about how to find out how you can tell if the download was corrupt. Please note this is only torrent downloads! Microsoft downloads are ok.

strider_mt2k · 12:52 PM

Oh well.
Looks like that's the chance you take when you don't go through the regular channels for stuff like this.

Crazy me, I just signed up for the Beta program and the company sends me download links and keys and everything!

WolfKeeper · 05-20-2009, 01:15 PM

Quote:

Originally Posted by Dreizehn

Just thought I'd tell everyone here, looking about how to find out how you can tell if the download was corrupt. Please note this is only torrent downloads! Microsoft downloads are ok.

Get the hash or MD5 for the ISO you downloaded. You'll need a utility or shell extension to compute the figures. HashTab... is the coolest thing ever! is a shell extension that adds a tab to file properties for computing hashes. Match the hash with the version you downloaded with the one listed below:

32-bit:
Filename:7100.0.090421-1700_x86fre_client_en-us_Retail_Ultimate-GRC1CULFRER_EN_DVD.iso
Size: 2.35GB
MD5: 8867C13330F56A93944BCD46DCD73590
SHA-1: 7D1F486CA569EFFFFB719CFB48355BB7BF499712
CRC32: E8A1C394
7100 RC

64-bit:
Filename:7100.0.090421-1700_x64fre_client_en-us_Retail_Ultimate-GRC1CULXFRER_EN_DVD.iso
Size: 3.04GB
MD5: 98341af35655137966e382c4feaa282d
SHA-1: fc867fe1ab2e0a9796f9e4d155b44ea6998f4874
CRC32: 58fb2be0

MoInSTL · 05-20-2009, 01:41 PM

Another vote for Hash Tab

RyanTheTragic13 · 05-20-2009, 03:40 PM

What about for Build 7127? Anyone have a way to make sure the torrent downloaded is clean? Is it a different hash number?

WolfKeeper · 05-20-2009, 03:43 PM

The hashes are different for each build, since it's a mathematical computation based on the contents of the ISO.

64-bit:
7127.0.090507-1820_x64fre_client_en-us_Retail_Ultimate-GRMCULXFRER_EN_DVD.iso
CRC32: 460FAD4E
MD5: F805A6595DDC6D12956588BB0F1B9B83
SHA1: 9BEB69BE3C2D113ECEB944145951A2123FBBBBF8

32-bit:
7127.0.090507-1820_x86fre_client_en-us_Retail_Ultimate-GRMCULFRER_EN_DVD.iso
CRC32: F691687F
MD5: 4045CB2A8E50B65ED9E1C2B8D6026B2F
SHA-1: F2D615E674B64053D299CFA5E80B777269F0DFF2

dchao · 08:34 PM

If the version 7127 contains malware and was release by hackers. The they would have the right tool to generated the "correct" CRC/SHA values to fool you.

Quote:

32-bit:
7127.0.090507-1820_x86fre_client_en-us_Retail_Ultimate-GRMCULFRER_EN_DVD.iso
CRC32: F691687F
MD5: 4045CB2A8E50B65ED9E1C2B8D6026B2F
SHA-1: F2D615E674B64053D299CFA5E80B777269F0DFF2

Just out of interest, did you get the CRC/SHA values from the official MS web site?

WolfKeeper · 05-20-2009, 09:13 PM

I've seen enough info from reliable sources that 7127 is a genuine build.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

MoInSTL Super Moderator Posts: 600 Join Date: Jan 2009 Location: St. Louis, Missouri	05-20-2009, 01:41 PM Another vote for Hash Tab Studio 15 1558\| Black Chainlink\| i5-520M, \|4GB RAM \|500 GB HD@7200 \|ATI HD 4570, 512K\|Backlit\|9 Cell\|Web Cam\|Windows 7 Home Premium x64

RyanTheTragic13 Junior Member Posts: 29 Join Date: May 2009 Location: Fargo, ND	05-20-2009, 03:40 PM What about for Build 7127? Anyone have a way to make sure the torrent downloaded is clean? Is it a different hash number?

WolfKeeper Retired Mini user Posts: 1,577 Join Date: Oct 2008	05-20-2009, 09:13 PM I've seen enough info from reliable sources that 7127 is a genuine build. Getting an iPad