Author: rmetzger
Subject: Sigcheck reports wrong file version
Posted: 15 March 2013 at 8:16pm
Interesting behavior:
Run SigCheck on ntfs.sys in %SystemRoot%\System32\Drivers and it gets the .mui file.
Copy the ntfs.sys file to some other location, and SigCheck runs against the .sys file.
Possible problems:
OS locked file;
OS SysNative like redirection.
Ron Metzger
Edited by rmetzger - 2 minutes ago at 8:18pm
Subject: Sigcheck reports wrong file version
Posted: 15 March 2013 at 8:16pm
Interesting behavior:
Run SigCheck on ntfs.sys in %SystemRoot%\System32\Drivers and it gets the .mui file.
Copy the ntfs.sys file to some other location, and SigCheck runs against the .sys file.
Possible problems:
OS locked file;
OS SysNative like redirection.
Ron Metzger
Edited by rmetzger - 2 minutes ago at 8:18pm