Hi, telealex, and welcome to the DonationCoder site.  I'm on holiday this week but I'll try to take a closer look at your post when I get back.

many thanks

I started newest SigCheck GUI for all running processes and found some with a blue question mark.
Among them some important prcoesses like lsass.exe, csrss.exe and spoolsv.exe

What does a blue question mark mean?

They are not checked in Virustotal. Why not?

I cannot open the file location: Why not?

How can I verify otherwise that they are the correct/correctly signed original binaries from Microsoft?

Peter

I am using 64 bit Win 7 pro.

I am using GUI version 1.0.9 and SigCheck v2.2. Are there an newer versions?
VirusChecks are performed for all but the blue items.

There is no comment absolutely noting in the line except the process name.

Have a look at the following snapshot:

[attach=#]

So again: Why do I get no further information?

Ok, with your new version v1.1 it works BUT

On page http://skwire.dcmembers.com/fp/?page=sigcheckgui
still only v1.0.9 is available and
on page

https://technet.microsoft.com/en-us/sysinternals/bb897441.aspx

Sigcheck (cmdline version from sysinternals) v2.2 is already available!

Your package contains only v2.1

Maybe there are problemes with a changed API.

Can you check your GUI with the newest v2.2

?
Peter

However, you're free to download the new 2.2 version yourself and copy it into your SigcheckGUI folder. 

Thats exactly what I did: But GUI v1.1 works only with SigCheck v2.1 and not v2.2

So something important must be changed. You should be able to find out what

.....except the blue icon lines which appear with v2.2 but not with v2.1

Thus, we have another category of files which are signed : "Revoked". This should be displayed under "View" tab. What do you think, @skwire ?

Well, I don't know.  I mean, I'm no expert regarding any of this but, without knowing the reason a signature was revoked, I'm not sure I'd put 'Revoked' on the same level as 'Signed'.  Maybe I'm wrong?

Another ignored case is related to altered (signed) files (files that are digitally signed but altered by malicious applications, hex editors etc). These are files where digital signature does not verify.
These are listed under "Unsigned" -- not correct.  Perhaps this is another category of signed files : "Invalid".

Please check my screenshots.

Kind regards,
Marius

SigCheck GUI does not work with new sigcheck.exe v2.3!

After having downloaded the newest sigcheck.exe v2.3 from MS I copied it to the SigCheck GUI installation folder and started the GUI.

Then I scanned all currently running processes and found lots of processes with a blue question mark icon at the beginning of the line and empty columns.

It seems to me that SigCheck GUI v1.1.0 is incompatible with the sigcheck.exe v2.3 syntax

Could you fix this in a new version?

Thank you
Peter

Hello skwire:
Yes, it seems to be the same issue as for v2.2. BUT:

Enabling "Run as Administrator" is NOT a solution!
Yes, of cause, I enabled it for both programs but it didn't help.
I even disabled UAC completely - it didn't help.
Moreover: Assume missing the Administrator rights would be the culprit: Then it should not work with v2.1 either!
But everything works fine for v2.1. On the same machine for the same SigCheck GUI installation (but different sigcheck.exe)

At least I would expect some warning in SigCheck GUI like "Please run as Adminstrator" or "Warning: Run without Administrator rights".
But silently suppress some information is not smart.

To give you an impression on how it looks like here I uploaded a snapshot:

http://www.picfront.org/d/9lXK

I would appreciate if you could fix the error.
Thank you

Enabling "Run as Administrator" is NOT a solution!

Enough with the exclamation points.  They certainly don't inspire me to fix anything.

Yes, of cause, I enabled it for both programs but it didn't help.
I even disabled UAC completely - it didn't help.
Moreover: Assume missing the Administrator rights would be the culprit: Then it should not work with v2.1 either!
But everything works fine for v2.1. On the same machine for the same SigCheck GUI installation (but different sigcheck.exe)

It might appear to be that simple.  However, because you run an anti-virus program which, usually, interferes with all running processes, this might not be the case.

At least I would expect some warning in SigCheck GUI like "Please run as Adminstrator" or "Warning: Run without Administrator rights".
But silently suppress some information is not smart.

I do not suppress anything.  My application works as designed on my machine and on my XP virtual machine.  This makes it difficult to fix your reported issue.

I would appreciate if you could fix the error.
Thank you

What you need to realise is that this is a front-end for sigcheck.exe.  All I'm doing is "running" sigcheck.exe, just as you would in a DOS prompt on your system, and interpreting its output.  There is no programming voodoo I'm using here.  Past that, you are going to have to research and test why your system is getting this error.  You need start up a DOS prompt and run the different sigcheck.exe versions on the processes you get the blue icon for and see if you can figure out why 2.1 works and 2.2/2.3 do not.

For the record, I can confirm that the input and output syntax between all three versions is the same.  I can also tell you that SigcheckGUI uses the following command-line switches:

• -q -a (used always)
• -h (used if the compute hash option is enabled)
• -v (used if the query VirusTotal option is enabled)

So, a typical commandline for this might look like this:

"c:\path\to\sigcheck.exe" -q -a "c:\path\to\SomeExecutable.exe"

If you enable the other options, it would be like this:

"c:\path\to\sigcheck.exe" -q -a -h -v "c:\path\to\SomeExecutable.exe"

Of course, change the "c:\path\to" portions to match the paths on your system.

"Copy files" action does not seem to work. 

Thanks, Marius. 

Website | Download
v1.1.1 - 2016-02-11
    ! Copy files functionality was broken.  (Thanks, neverlight)