Manually verify Windows patch MD5 checksum?

Hi folks,
I'd like to be able to confirm that a downloaded patch from Microsoft has
not been altered.

If I manually download a patch from Microsoft and compute an MD5 (or SHA)
checksum value, does Microsoft have a (online?) resource to compare my
computed value to theirs and verify patch authenticity?

Suggestions?

Thanks,
Ed

You want the known good checksums on updates.

I recollect that patches used to give checksums in the technet manifests,
but I can't find any of that now. On the MUcat site, clicking " help " will
turn up a couple of communication options. Try asking MUcat beta?:
http://test.catalog.update.microsoft...site/Home.aspx

You already have the tool to compute checksums?:
http://support.microsoft.com/kb/841290

"Ed Flecko" <> wrote in message news:44CD45E9-2DB4-43AB-B621-...
> Hi folks,
> I'd like to be able to confirm that a downloaded patch from Microsoft has
> not been altered.
>
> If I manually download a patch from Microsoft and compute an MD5 (or SHA)
> checksum value, does Microsoft have a (online?) resource to compare my
> computed value to theirs and verify patch authenticity?
>
> Suggestions?
>
> Thanks,
> Ed

Ed Flecko <> wrote:

> I'd like to be able to confirm that a downloaded patch from Microsoft
> has not been altered.

All Microsoft downloads are Digitally Signed, complete with an in-built
checksum hash, and verified by a security certificate.

Right click on the downloaded file, select "Properties".
Click tab "Digital Signatures".
Select the first or only signature listed, and click "Details".
The checksum hash (sha1) will be verified, and the certificate checked.
If you see the message "This digital signature is OK", then you can be
confident that the file is exactly as sent by Microsoft.

There is no need for any secondary external list of MD5 hashes, etc., of the
sort you were asking for.

--
Robin Walker [MVP Networking]