Leaked Windows 7 RC Build 7100 May Contain A Trojan

[yogi365]

Microsoft have warned users several times that downloading unofficial releases via torrents isn’t advised, and news that some of the leaked Windows 7 RC copies contain a trojan, may make some users who rushed out and installed the Windows 7 RC build regret it.
The trojan in question can potentially open a security hole in the user’s system once the installation file is run, installing both Windows 7 RC and also the malware.

​

If you do install an official RC build then you should confirm that the MD5 checksum on the ISO is the same as a known safe MD5. Known safe MD5s are:

• Windows 7 RC Build 7100 x86 is 8867C13330F56A93944BCD46DCD73590
• Windows 7 RC Build 7100 x64 is 98341af35655137966e382c4feaa282d

• Just a warning for anyone downloading the new RC builds of windows 7. Quiet a lot of the downloads have a trojan inbedded in the setup EXE. This should not be an issue if you booted from the DVD and installed, but if you upgraded it may have infected you.
  
  How to get rid:

links: Windows 7 RC build 7100 Download: Warning - Neowin Forums

http://windows7news.com/2009/04/28/leaked-windows-7-rc-build-7100-may-contain-a-trojan/

 

[YupYup]

Dejavu http://www.sevenforums.com/system-security/8049-7100-rc-warning.html

 

[yogi365]

Dejavu http://www.sevenforums.com/system-security/8049-7100-rc-warning.html

yahh thanks

 

[Airbot]

yogi,


You have to quote your article and provide the source link. This has already been explained.

 

[swarfega]

Its always a worry no matter what you get off certain websites whether they may contain bad things.

 

[jimbo45]

Hi all

To put your minds at rest.

If you downloaded the x-64 version from the torrent from the 'OID that many of us on this board seeded over the last weekend you'll be fine

(Can't tell about X-86 as I don't use it).

Just to confirm the CRC, MD5 and SHA1. See the attached image.

Cheers
jimbo

 

[Adamd]

Well I am 99% sure I don't have it lol.


These idiots need to stop putting this crap in the builds lol.

 

[justnrt]

mine doesnt have it im 99.9% sure and it came that mi** and a bunch of pirates

 

[Zanarkand]

if you don't run any application that uses the internet like msn or any other programs in the background (like utorrent) or foreground (like internet browsers), you can check if you have any connections to ?somebody?... with cmd.

Just type in: "netstat -n" of course without the " ". If it doesn't show up any connection or shows up local addresses like 127.0.0.1 etc or shows TIME_WAIT/FIN_WAIT at the State column it's ok.

When I installed Windows 7 b7100, and installed msn, utorrent, and even the Kaspersky beta designed for Windows 7, after a day or two, the anti virus popped up a message, that said something like that I was attacked by a trojan, moved to quarantine etc etc.. oh yeah... but when I logged off from msn, and closed any internet based programs on my computer CMD still showed a connection to an address 213.12.xx.xx i don't remember the rest of it, it doesn't matter. I checked the computer with the almighty very famos Kaspersky 8 designed for Windows 7 (well, I thougth I use an antivirus that is specially tested and made for Windows 7), Kaspersky said the wininit.exe is infected with Trojan.generic/w32...whatever. But can't do anything since Windows uses the file.. So I reinstalled it, a several times, reformatted my drive to be absolutely sure that it's gone, and after a few days it was really gone. Finally.. BTW, I never use Kaspersky again.. Now I use Nod32 v4, it is not designed for Windows 7, but works with no problem at least and uses much less resource of the pc.

 

[xan K]

if you don't run any application that uses the internet like msn or any other programs in the background (like utorrent) or foreground (like internet browsers), you can check if you have any connections to ?somebody?... with cmd.

Just type in: "netstat -n" of course without the " ". If it doesn't show up any connection or shows up local addresses like 127.0.0.1 etc or shows TIME_WAIT/FIN_WAIT at the State column it's ok.

When I installed Windows 7 b7100, and installed msn, utorrent, and even the Kaspersky beta designed for Windows 7, after a day or two, the anti virus popped up a message, that said something like that I was attacked by a trojan, moved to quarantine etc etc.. oh yeah... but when I logged off from msn, and closed any internet based programs on my computer CMD still showed a connection to an address 213.12.xx.xx i don't remember the rest of it, it doesn't matter. I checked the computer with the almighty very famos Kaspersky 8 designed for Windows 7 (well, I thougth I use an antivirus that is specially tested and made for Windows 7), Kaspersky said the wininit.exe is infected with Trojan.generic/w32...whatever. But can't do anything since Windows uses the file.. So I reinstalled it, a several times, reformatted my drive to be absolutely sure that it's gone, and after a few days it was really gone. Finally.. BTW, I never use Kaspersky again.. Now I use Nod32 v4, it is not designed for Windows 7, but works with no problem at least and uses much less resource of the pc.

how do you think you got the infection?

 

[7Heaven]

I had it, so no may about it.

Posted details on Monday Here:

Virus in 7100 Download - Windows 7 Center Forums

 

[PhreePhly]

This is why I had asked to have a sticky made that listed the known hashes (MD5 and SHA-1) for each build. It can be a perpetual thread which keeps adding builds and hashes as they are released.

PhreePhly

 

[TechOutsider]

This is why I had asked to have a sticky made that listed the known hashes (MD5 and SHA-1) for each build. It can be a perpetual thread which keeps adding builds and hashes as they are released.

PhreePhly

BitTorrent is all about trial and error; the first people on the bandwagon may get burned with a bad build.

Good idea, however there is no way for an individual user to confirm; no antivirus is at 100% yet with zero-day samples. The thread would probably lead to a lot of people jumping the gun, some speculation, and a lot of confused users.

As you see, the 7100 build has been floating around for quite some time; someone just discovered a trojan.

 

[PhreePhly]

BitTorrent is all about trial and error; the first people on the bandwagon may get burned with a bad build.

Good idea, however there is no way for an individual user to confirm; no antivirus is at 100% yet with zero-day samples. The thread would probably lead to a lot of people jumping the gun, some speculation, and a lot of confused users.

As you see, the 7100 build has been floating around for quite some time; someone just discovered a trojan.

We have a number of folks on the board that have access to the real thing. They can provide the hashes of the isos without uploading the real thing. The admins know who these folks are and can have the hash thread be read-only.

PhreePhly

 

[Night Hawk]

I had it, so no may about it.

Posted details on Monday Here:

Virus in 7100 Download - Windows 7 Center Forums

If you go through the 7100 leaked thread here you will find the images I posted there of two unknowns preventing the deletion of the Windows.old folder and any attempts at taking ownership of it. The two mystery files appeared to be in Russian on a totally otherwise English version? http://www.sevenforums.com/news/7710-windows-7-rc-7100-leaked.html

 

[jimbo45]

We have a number of folks on the board that have access to the real thing. They can provide the hashes of the isos without uploading the real thing. The admins know who these folks are and can have the hash thread be read-only.

PhreePhly

Actually a half way decent suggestion might be as follows since some of us can also get hold of this stuff without ourselves being on "the inside".

How about making "The HASH" thread a "Moderated" thread -- people post the CRC32, MD5 and SHA1 numbers to the "moderated thread" and after being checked for validity they can then be published.

Some people "On the inside" might have reservations about releasing the info themselves but could with much less risk to themselves and their jobs simply confirm the validity of the values or otherwise.

In these times nobody wants to see people losing jobs.

I'm currently on contract in the UK (although going home for "The long weekend" as Monday is a public holiday in the UK) and I've seen not only large numbers of people losing jobs at an alarming rate -- but also in spite of the Banks being given an almost obscene amount of money loads of people STILL losing their homes to these same Banks who flog them at auction for a fraction of the value to "their fellow partners in crime").

Probably the same in a lot of other places too.

OK OT I know but in leaking / supplying information PLEASE do it in such a manner without risk to yourselves (and family if you have one). We all appreciate the "builds" we've had so far but if MS starts "playing hardball" do PLEASE TAKE CARE.

Cheers
jimbo

 

[Digger]

nice publicity for avast

 

[Simcut]

Sorry to be a complete nubcake but how do I check the hash in the .iso to see if its clean?

 

[Airbot]

Install this, and then just right click on the files and go to properties, it will have a hash tab included now.

HashTab... is the coolest thing ever!

 

[Night Hawk]

nice publicity for avast

Gosh? All this time I thought it was for AVG!