Windows 7: Leaked Windows 7 RC Build 7100 May Contain A Trojan

yogi365 · 29 Apr 2009

Quote:

Microsoft have warned users several times that downloading unofficial releases via torrents isn’t advised, and news that some of the leaked Windows 7 RC copies contain a trojan, may make some users who rushed out and installed the Windows 7 RC build regret it.
The trojan in question can potentially open a security hole in the user’s system once the installation file is run, installing both Windows 7 RC and also the malware.

If you do install an official RC build then you should confirm that the MD5 checksum on the ISO is the same as a known safe MD5. Known safe MD5s are:

Windows 7 RC Build 7100 x86 is 8867C13330F56A93944BCD46DCD73590
Windows 7 RC Build 7100 x64 is 98341af35655137966e382c4feaa282d

Just a warning for anyone downloading the new RC builds of windows 7. Quiet a lot of the downloads have a trojan inbedded in the setup EXE. This should not be an issue if you booted from the DVD and installed, but if you upgraded it may have infected you.

How to get rid:

links: Windows 7 RC build 7100 Download: Warning - Neowin Forums

http://windows7news.com/2009/04/28/l...tain-a-trojan/

YupYup · 29 Apr 2009

Dejavu 7100 RC Warning

yogi365 · 29 Apr 2009

Quote: Originally Posted by YupYup

Dejavu 7100 RC Warning

yahh thanks

Airbot · 29 Apr 2009

yogi,

You have to quote your article and provide the source link. This has already been explained.

swarfega · 29 Apr 2009

Its always a worry no matter what you get off certain websites whether they may contain bad things.

jimbo45 · 29 Apr 2009

Hi all

To put your minds at rest.

If you downloaded the x-64 version from the torrent from the 'OID that many of us on this board seeded over the last weekend you'll be fine

(Can't tell about X-86 as I don't use it).

Just to confirm the CRC, MD5 and SHA1. See the attached image.

Cheers
jimbo

Adamd · 29 Apr 2009

Well I am 99% sure I don't have it lol.

These idiots need to stop putting this crap in the builds lol.

justnrt · 29 Apr 2009

mine doesnt have it im 99.9% sure and it came that mi** and a bunch of pirates

Zanarkand · 29 Apr 2009

if you don't run any application that uses the internet like msn or any other programs in the background (like utorrent) or foreground (like internet browsers), you can check if you have any connections to ?somebody?... with cmd.

Just type in: "netstat -n" of course without the " ". If it doesn't show up any connection or shows up local addresses like 127.0.0.1 etc or shows TIME_WAIT/FIN_WAIT at the State column it's ok.

When I installed Windows 7 b7100, and installed msn, utorrent, and even the Kaspersky beta designed for Windows 7, after a day or two, the anti virus popped up a message, that said something like that I was attacked by a trojan, moved to quarantine etc etc.. oh yeah... but when I logged off from msn, and closed any internet based programs on my computer CMD still showed a connection to an address 213.12.xx.xx i don't remember the rest of it, it doesn't matter. I checked the computer with the almighty very famos Kaspersky 8 designed for Windows 7 (well, I thougth I use an antivirus that is specially tested and made for Windows 7), Kaspersky said the wininit.exe is infected with Trojan.generic/w32...whatever. But can't do anything since Windows uses the file.. So I reinstalled it, a several times, reformatted my drive to be absolutely sure that it's gone, and after a few days it was really gone. Finally.. BTW, I never use Kaspersky again

.. Now I use Nod32 v4, it is not designed for Windows 7, but works with no problem at least and uses much less resource of the pc.

xan K · 29 Apr 2009

Quote: Originally Posted by Zanarkand

if you don't run any application that uses the internet like msn or any other programs in the background (like utorrent) or foreground (like internet browsers), you can check if you have any connections to ?somebody?... with cmd.

Just type in: "netstat -n" of course without the " ". If it doesn't show up any connection or shows up local addresses like 127.0.0.1 etc or shows TIME_WAIT/FIN_WAIT at the State column it's ok.

When I installed Windows 7 b7100, and installed msn, utorrent, and even the Kaspersky beta designed for Windows 7, after a day or two, the anti virus popped up a message, that said something like that I was attacked by a trojan, moved to quarantine etc etc.. oh yeah... but when I logged off from msn, and closed any internet based programs on my computer CMD still showed a connection to an address 213.12.xx.xx i don't remember the rest of it, it doesn't matter. I checked the computer with the almighty very famos Kaspersky 8 designed for Windows 7 (well, I thougth I use an antivirus that is specially tested and made for Windows 7), Kaspersky said the wininit.exe is infected with Trojan.generic/w32...whatever. But can't do anything since Windows uses the file.. So I reinstalled it, a several times, reformatted my drive to be absolutely sure that it's gone, and after a few days it was really gone. Finally.. BTW, I never use Kaspersky again

.. Now I use Nod32 v4, it is not designed for Windows 7, but works with no problem at least and uses much less resource of the pc.

how do you think you got the infection?

Windows 7: Leaked Windows 7 RC Build 7100 May Contain A Trojan

Leaked Windows 7 RC Build 7100 May Contain A Trojan problems?