A system for responding to attack on a user computing device, the system comprising: a certificate database configured to store a plurality of certificates; a trusted certificate database configured to store trusted certificate data, and a data transfer device including: computing platform of at least one processor and memory operably coupled to the at least one processor; and instructions that, when executed on the computing platform, cause the computing platform to implement: a check tool configured to: detect an attack on the user computing device against at least one system tool for verifying digital signatures of files by identifying a modification or a replacement of the at least one system tool or a component used by the at least one system tool, obtain at least one file, the at least one file to be analyzed by the at least one system tool for verifying digital signatures of files, the at least one file including a digital signature, the digital signature including a DS certificate, wherein the DS certificate includes issuing center data and DS certificate data, determine the DS certificate is valid by checking that the DS certificate has a required certificate integrity, determine the digital signature is valid by checking that the at least one file has a required file integrity and the DS certificate is valid, and if the DS certificate is valid, determine the DS certificate is trusted by finding the trusted certificate data related to the DS certificate data. a certificate database configured to store a plurality of certificates; a trusted certificate database configured to store trusted certificate data, and a data transfer device including: computing platform of at least one processor and memory operably coupled to the at least one processor; and instructions that, when executed on the computing platform, cause the computing platform to implement: a check tool configured to: detect an attack on the user computing device against at least one system tool for verifying digital signatures of files by identifying a modification or a replacement of the at least one system tool or a component used by the at least one system tool, obtain at least one file, the at least one file to be analyzed by the at least one system tool for verifying digital signatures of files, the at least one file including a digital signature, the digital signature including a DS certificate, wherein the DS certificate includes issuing center data and DS certificate data, determine the DS certificate is valid by checking that the DS certificate has a required certificate integrity, determine the digital signature is valid by checking that the at least one file has a required file integrity and the DS certificate is valid, and if the DS certificate is valid, determine the DS certificate is trusted by finding the trusted certificate data related to the DS certificate data. computing platform of at least one processor and memory operably coupled to the at least one processor; and instructions that, when executed on the computing platform, cause the computing platform to implement: a check tool configured to: detect an attack on the user computing device against at least one system tool for verifying digital signatures of files by identifying a modification or a replacement of the at least one system tool or a component used by the at least one system tool, obtain at least one file, the at least one file to be analyzed by the at least one system tool for verifying digital signatures of files, the at least one file including a digital signature, the digital signature including a DS certificate, wherein the DS certificate includes issuing center data and DS certificate data, determine the DS certificate is valid by checking that the DS certificate has a required certificate integrity, determine the digital signature is valid by checking that the at least one file has a required file integrity and the DS certificate is valid, and if the DS certificate is valid, determine the DS certificate is trusted by finding the trusted certificate data related to the DS certificate data. a check tool configured to: detect an attack on the user computing device against at least one system tool for verifying digital signatures of files by identifying a modification or a replacement of the at least one system tool or a component used by the at least one system tool, obtain at least one file, the at least one file to be analyzed by the at least one system tool for verifying digital signatures of files, the at least one file including a digital signature, the digital signature including a DS certificate, wherein the DS certificate includes issuing center data and DS certificate data, detect an attack on the user computing device against at least one system tool for verifying digital signatures of files by identifying a modification or a replacement of the at least one system tool or a component used by the at least one system tool, obtain at least one file, the at least one file to be analyzed by the at least one system tool for verifying digital signatures of files, the at least one file including a digital signature, the digital signature including a DS certificate, wherein the DS certificate includes issuing center data and DS certificate data, determine the DS certificate is valid by checking that the DS certificate has a required certificate integrity, determine the digital signature is valid by checking that the at least one file has a required file integrity and the DS certificate is valid, and if the DS certificate is valid, determine the DS certificate is trusted by finding the trusted certificate data related to the DS certificate data.