PsTools : Sigcheck reports wrong file version

Author: MagicAndre1981
Subject: Sigcheck reports wrong file version
Posted: 15 March 2013 at 4:57am

smaug9 wrote: Hi, C:\bin>sigcheck -a -q c:\Windows\system32\drivers\ntfs.sys c:\windows\system32\drivers\ntfs.sys:         Verified:       Signed         Signing date:   02:32 2013-02-08         Publisher:      Microsoft Windows         Description:    NT File System Driver         Product:        Microsoft« Windows« Operating System         Version:        6.1.7600.16385         File version:   6.1.7600.16385 (win7_rtm.090713-1255)         Strong Name:    Unsigned         Original Name:  ntfs.sys.mui         Internal Name:  ntfs.sys         Copyright:      ⌐ Microsoft Corporation. All rights reserved.         Comments:       n/a Can anyone suggest a reason for this discrepancy?

sigcheck opens the wrong file. It reads the MUI file, not the real sys. Looks like a bug.