Can someone tell me what is the best way to check if a Windows copy is legitimate? As far as i know, i need the .ISO file of the Windows edition i want to check, and then i have to type the following command in PowerShell:
Get-FileHash C:\NameOfFolder\NameOfISOfile
Then, i will get the HASH ID, and i will have to compare it to the original HASH ID. If they are different, my Windows copy is corrupted. The problem is that i don't know where to find the list of HASH IDs, so i can compare the HASH IDs i get to the original HASH IDs provided by Microsoft.
Another option i know is the following: I type "sfc /scannow" in PowerShell. If it shows there are no corrupted files, this means that my Windows copy is legitimate.
So, can those two options prove my Windows copy is 100% legitimate, and there is no malicious software inserted into the operating systems? Currently, I'm running Windows 7 on a virtual machine. I want to check if the copy is clean. I scanned the .ISO file with Windows Defender, and it said there are no viruses. After that, i scanned the file with the "Get-FileHash" function, and i got the HASH ID. Now, i need to find the HASH ID for Windows 7, so i can compare the HASH ID i got to the HASH ID Windows 7 should have, so i can know whether or not my Windows 7 is legitimate.
Also, i want to know whether or not "sfc /scannow" can guarantee with 100% certainty that the Windows copy is legitimate. If i run the function, and it shows there are no corrupted files, does that mean the copy is 100% original, no one has changed it, and there are no inserted malicious codes?
And lastly, i have a question regarding this:
"Another option i know is the following: I type "sfc /scannow" in PowerShell. If it shows there are no corrupted files, this means that my Windows copy is legitimate."
When i start the ScanNow function, where does it take its information from? How does the function know there are no corrupted files, and how does it know what a file should look like, if it is not corrupted? As far as i know, there is an archived Windows 7 copy inside the Windows 7 copy i installed and use. The ScanNow function compares the files in the archive (it supposes the files in the archive the original) to the files the OS uses.
For example, if the original MpOAV.dll file is in the compressed archive, and is 234KB, while the MpOAV.dll file the OS uses is 300KB, then the ScanNow function will say it's corrupted. However, if the compressed archive doesn't contain only original files, as the ScanNow function is programmed to think, but corrupted and infected files, and the MpOAV.dll is 300KB in both places - the OS and the compressed archive, will the ScanNow function still recognize it as corrupted, or it will say the file is fine, just because the MpOAV.dll file is the same in both places, and ScanNow is unable to find any difference between the file in the OS and the file in the compressed archive, where ScanNow thinks there are only original files, and will say a file is corrupted only if the file is not the same as the file in the compressed archive - but the file in the OS is the same as the file in the compressed archive, ScanNow will say the file is not corrupted, even if it is corrupted?
The fact ScanNow can work offline and doesn't require an internet connection, simply means it compares files to files in the OS, and doesn't compare the OS's files to the original OS's files hosted on Microsoft's servers. This means that if the files ScanNow uses as examples to compare files to and search for corruption, are corrupted, ScanNow will say the corrupted files are original, which will be a false statement.
So, what is the best way to check if the OS is corrupted and has malicious codes inserted in it?