Really weird problem: Different MD5 checksums everytime

Toggle sidebar Toggle sidebar
Status
Not open for further replies.
R

redhawtcar

Distinguished
Nov 27, 2007
77
0
18,630
Hi there,

Im having this problem that wouldn't allow me to decompress rar files (only tried with rar files). It apparently only happens when dealing with really big files that are divided in parts, example: whatever.part01, whatever.part02... etc.

Now, imagine you have a file of lets say, 6 GB, which cointains an iso, divided in 13 parts of 500 MB each file (file 13 being 305 MB). So we have hello.part01, hello.part02, hello.part03... until hello.part13.

The first thing I noticed is that when you I was decompressing with Winrar, it would sometimes say theres a CRC error at, for example, part 4, 7, 8, and 10. Then, I try again, and it would say there is a CRC error at parts 2, 8, 9, 12, 13, for example. As you can see, thats totally random, since part 4 and 7 are not getting a CRC error on the second try. I tought, ok, this must be those known "fake crc errors". So I tried with 7zip. It decompressed me the whole thing, but at the end, it says File is broken, CRC bla bla. You can anyway see the iso, but if you try to install the program, you get a "blabla the file is corrupted and cannot be used bla" error.

What I did next is get a MD5 checksum of someone with the 13 files totally working, which is the next one:

4478280b13d78aeb0272e46510bb46c0 crs.part01.rar
016443f105e86bc605bc2cd177d9f976 crs.part02.rar
709be1f4204dba860e9fa636d34ec04f crs.part03.rar
aca6c96b72f1972c72510121e89ce324 crs.part04.rar
4ada0816285b42c2d204b588da15e14a crs.part05.rar
7a3bd82a55c397c4be07dd6308b3352d crs.part06.rar
cb056c655add5ad732abf571a1c6b2cd crs.part07.rar
a6073b10f8a0c9ac9c1c8575e64055d2 crs.part08.rar
7badf66b91c0dca6b997fd1cbe268963 crs.part09.rar
7901fdf40282df0611f3ff87816d7ec7 crs.part10.rar
fac242937e39ab3e846877448942cbaa crs.part11.rar
70bbafdc92592e568c1ee8a29e3f6a1d crs.part12.rar
2885449543aa3a84e96f3b67e7372c95 crs.part13.rar

Ok, then I did a checksum of my files. The result was:

4478280b13d78aeb0272e46510bb46c0 crs.part01.rar
016443f105e86bc605bc2cd177d9f976 crs.part02.rar
709be1f4204dba860e9fa636d34ec04f crs.part03.rar
aca6c96b72f1972c72510121e89ce324 crs.part04.rar
4ada0816285b42c2d204b588da15e14a crs.part05.rar
7a3bd82a55c397c4be07dd6308b3352d crs.part06.rar
cb056c655add5ad732abf571a1c6b2cd crs.part07.rar
a6073b10f8a0c9ac9c1c8575e64055d2 crs.part08.rar
7badf66b91c0dca6b997fd1cbe268963 crs.part09.rar
7901fdf40282df0611f3ff87816d7ec7 crs.part10.rar
fac242937e39ab3e846877448942cbaa crs.part11.rar
70bbafdc92592e568c1ee8a29e3f6a1d crs.part12.rar
2885449543aa3a84e96f3b67e7372c95 crs.part13.rar

The same!

After that, I can't think of anything else to try out. Just by curiosity, I decided to make another MD5 checksum of my files again. The result was:

4478280b13d78aeb0272e46510bb46c0 crs.part01.rar
016443f105e86bc605bc2cd177d9f976 crs.part02.rar
709be1f4204dba860e9fa636d34ec04f crs.part03.rar
aca6c96b72f1972c72510121e89ce324 crs.part04.rar
4ada0816285b42c2d204b588da15e14a crs.part05.rar
152515b7a070617d1c62ff0c18b853fa crs.part06.rar x 7a3bd82a55c397c4be07dd6308b3352d
cb056c655add5ad732abf571a1c6b2cd crs.part07.rar
a6073b10f8a0c9ac9c1c8575e64055d2 crs.part08.rar
7badf66b91c0dca6b997fd1cbe268963 crs.part09.rar
7901fdf40282df0611f3ff87816d7ec7 crs.part10.rar
fac242937e39ab3e846877448942cbaa crs.part11.rar
70bbafdc92592e568c1ee8a29e3f6a1d crs.part12.rar
2885449543aa3a84e96f3b67e7372c95 crs.part13.rar

What the hell? Part 6 is now corrupted? Lets try again:

4478280b13d78aeb0272e46510bb46c0 crs.part01.rar
3643f0567994dc2b810657cf8c691cfb crs.part02.rar x 016443f105e86bc605bc2cd177d9f976
709be1f4204dba860e9fa636d34ec04f crs.part03.rar
e4822a7868a04ba299da7f4f41dec0ec crs.part04.rar x aca6c96b72f1972c72510121e89ce324
4ada0816285b42c2d204b588da15e14a crs.part05.rar
7a3bd82a55c397c4be07dd6308b3352d crs.part06.rar
cb056c655add5ad732abf571a1c6b2cd crs.part07.rar
a6073b10f8a0c9ac9c1c8575e64055d2 crs.part08.rar
7badf66b91c0dca6b997fd1cbe268963 crs.part09.rar
7901fdf40282df0611f3ff87816d7ec7 crs.part10.rar
fac242937e39ab3e846877448942cbaa crs.part11.rar
70bbafdc92592e568c1ee8a29e3f6a1d crs.part12.rar
2885449543aa3a84e96f3b67e7372c95 crs.part13.rar

2 and 4 are now different? Are you kidding me? Again:

a1f55f104eabea6519e9e651f1bfad10 crs.part01.rar x 4478280b13d78aeb0272e46510bb46c0
3e6d40a6883f41502f3f8b2a9f8873b7 crs.part02.rar x 016443f105e86bc605bc2cd177d9f976
709be1f4204dba860e9fa636d34ec04f crs.part03.rar
aca6c96b72f1972c72510121e89ce324 crs.part04.rar
4ada0816285b42c2d204b588da15e14a crs.part05.rar
7a3bd82a55c397c4be07dd6308b3352d crs.part06.rar
cb056c655add5ad732abf571a1c6b2cd crs.part07.rar
c2c9fb2a52688b415b2dcca79f846732 crs.part08.rar x a6073b10f8a0c9ac9c1c8575e64055d2
7badf66b91c0dca6b997fd1cbe268963 crs.part09.rar
7901fdf40282df0611f3ff87816d7ec7 crs.part10.rar
fac242937e39ab3e846877448942cbaa crs.part11.rar
70bbafdc92592e568c1ee8a29e3f6a1d crs.part12.rar x 70bbafdc92592e568c1ee8a29e3f6a1d
d1b0987b785c62ad6b43ab31eebf2ba1 crs.part13.rar x 2885449543aa3a84e96f3b67e7372c95

1,2,8,12,13, a total mess!

I tried again:

4478280b13d78aeb0272e46510bb46c0 crs.part01.rar
016443f105e86bc605bc2cd177d9f976 crs.part02.rar
709be1f4204dba860e9fa636d34ec04f crs.part03.rar
aca6c96b72f1972c72510121e89ce324 crs.part04.rar
4ada0816285b42c2d204b588da15e14a crs.part05.rar
7a3bd82a55c397c4be07dd6308b3352d crs.part06.rar
cb056c655add5ad732abf571a1c6b2cd crs.part07.rar
a6073b10f8a0c9ac9c1c8575e64055d2 crs.part08.rar
7badf66b91c0dca6b997fd1cbe268963 crs.part09.rar
7901fdf40282df0611f3ff87816d7ec7 crs.part10.rar
fac242937e39ab3e846877448942cbaa crs.part11.rar
70bbafdc92592e568c1ee8a29e3f6a1d crs.part12.rar
2885449543aa3a84e96f3b67e7372c95 crs.part13.rar

WTF, all back to normal?

As you can see, this is highly unstable and theres no way to be 100% sure to know whats going on and what files are really corrupt, and I can't think of anything more precise than comparing MD5 strings. MD5 checksums changing that way is really weird by itself, so I want to know what can be causing such behaviour.

My rig is:

OS: WinXP SP2 with everything updated.

CPU:
Q6600 Revision G0

GPU:
XFX 8800GT XT

MB:
Gigabyte GA-X38-DQ6 Socket 775 DDR2

CPUFAN:
Asus Silent Square PRO

HD1: Samsung Spinpoint-T HD501LJ 500GB
HD2: Seagate Barracuda 250GB

RAM:
GeiL BackDragon DDR 800Mhz 1GBx2

-Programs used where MD5 Checksum Verifier and EF Checksum Manager v4.40, both did the same thing, so its not a software issue.

-I ran memtest (only 1 pass) and it wouldn't detect any error. I don't really know how to configure memtest for an optimal test anyway.

-HD1 is new and HD2 is saved from old computer, I tried to decompress and make MD5 checksums on both ones and the same happened.

-I closed Kapersky just in case is interfering when decompressing/making the MD5 checksum file.

-I remember this used to happen sometime with my old computer also.

Whats going on?
 
After reading your post I'm am not sure I understand anything you have said to this point, but I'll give it a shot. The problem could be as simple as you have been trying to install corrupted program files from a program you have downloaded from the internet. Do a Google search and try to find a different fownload source for the program you are trying t install. Besides that possibility, have you set up your Geil BlackDragon PC6400 in BIOS?

'In BIOS, set the memory voltage to 2.0-2.1v and the timings to CAS 4 or CAS 5 should the system not boot at 4.'

In any case, please post in a way so you are asking a more specific question. Like..."I am trying to install software and I keep getting an error message?"
 


I think its pretty clear. The problem is MD5 checksums are changing randomly, something that has nothing to do with a file being corrupted at all. If a file was corrupted, it would have a different MD5 checksum when comparing it to the first list i've posted (the list with the correct MD5 checksums), but ALWAYS the same string. For example, the second time I did a MD5 checksum of my files, as you can see, part 06 has the next string: 152515b7a070617d1c62ff0c18b853fa, while the correct string of part 06 is 7a3bd82a55c397c4be07dd6308b3352d. If part 06 was REALLY corrupted, it would always have the same string, even if it doesn't match the one on the correct list. Resuming: MD5 checksum strings doesn't change randomly, and has you can see, those are.
 


Cool, buy why the MD5 checksum of the rar's are changing everytime I check them?
 
Try the free jzip program I linked. If that fails to open the file successfully, you have a corrupted file regardless of how the zip program displays the error message. I would go for another download location and get a 'valid' copy downloaded and unzip it and not be concerned with the error message you are getting for the bad corrupted file you are trying to unzip.
 


That jZip app does the same as 7zip, at the end it says there is a CRC error, but hey, there are 13 parts of the rar, what part I have to download again? Thats why I use MD5 and thats why I think you are not getting the point. MD5 checksums DOESN'T CHANGE, never. Please read again my post.
 
Hi

I've no idea what's going on here, I've always assumed with md5, you could check it hundreds of time and it should be the same. On your first post you talk of someone who gave you the checksum of there files (which are ok), you could ask them to create a par2 file for you, then email you the no. of repair files you need to fix yours

http://www.quickpar.org.uk/Download.htm

 


Unfortunately, they deleted the 13 files, so the par2 can't be done. Anyway, it strange enought that the MD5's are changing that way, and it happens to every single rar file I download from the internet (big rar files divided in part files). For example, theres no way in hell I could play the Crysis demo since I downloaded it 10 times from different locations and ALWAYS gets corrupted.
 



I have the same problem reading MD5 checksums on files. That goes for Ubuntu and Windows XP (same PC).

I've noticed if I keep reading (calc MD5 that is) the same file more than once, it matches on the 2. or 3. time, but on the 4. og 5. read, it (may) differ again.

Did the same fault detection as you, no errors.

I use SATA disks.


 
I may add :

If I copy files, does they differ as the MD5 sum indicates ?

Yes and no. Somtimes performing a FC it shows differences, on other occations none ?!?!


 
redhawtcar's thread is from December 2007, nearly 2 1/2 years ago. You are replying directly to the OP which makes no sense at this point. OP has no solution or He would have reported it nearly 3 years ago. Better to start a new thread on the subject.
 
http://www.google.com/search?sclient=psy&hl=en&site=&source=hp&q=virus+encryption&btnG=Search
Try some different tools.
Use a different extractor.
Cut the files into smaller sections and then compare checksums.
Do your windows system .dlls change checksums? Are there dlls being called from the registry you aren't aware of or are hidden in unlikely places? /users/<user name>/ /temp, /windows/temp, /mozilla

Post small bits of files to an online virus scanner.
Boot a BSD, Linux. Mac. OS run the same tests. Use their registry tools and a bindiff tool to compare differing checksums. runs strings, NOP the JMP to that early entry code with a debugger,

I believe you have a memory resident virus that understands the RAR file extension.
 
Status
Not open for further replies.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom