What does 'verified file' in Windows mean? And does it guarantee related files?

Question

Often when I run a .exe file in Windows, a small box pops up that shows that file is from a verified publisher (e.g. Microsoft) or in other case, unknown publisher.

I know public key encryption can guarantee the integrity of a file. The questions here are:

1. Does Windows calculate the whole content of the file? Because I doubt it does that, since some files are very large, e.g. several GB and Windows shows verified publisher after just a few seconds. If I copy that same file, it takes around ten minutes, so I assume the time to read the whole content of the file is much longer than just several seconds.

2. If Windows does not read the whole content of the file, how can it guarantee the files integrity? E.g if some parts of the file are injected with malfunction code, I think the only way is to read the whole file's content and then calculate checksum. I can't see anyway to verify integrity without reading the whole file's content.

3. In some cases where I downloaded a large file, e.g Visual Express iso file, and then mount it. When I run setup file, it shows that file is from a verified publisher, e.g. Microsoft. The problem is that, the setup file's size is only several MBs, and it installs the content of several GBs. So does the verification of the small file (setup file) guarantee the content of related files (often much bigger). If this is the case, how can it be done and done very fast)?

Answer 1

1. When Windows verifies a file, it must compute a hash of the file, and match it against the digital signature. In order to compute the hash, Windows does need to read the entire file (see this MSDN blog post). Copying a file will naturally take longer than just reading it, as it require write operations, in addition to reads.

2. If Windows did not read the entire file, it indeed could not verify it properly.

3. When you run a small setup file that copies other data to your computer, the only signature being checked before the UAC appears is the signature of the setup itself. You are not guarantied that the other files have not been tampered with. You can only hope that the installer does it's own checks before copying the files. There has been malware discovered in the not so distant past (PlugX for example) that used legitimately signed executables to load malicious DLLs.