I can get you a checksum for an imagename and version, I think. (c1700-i-m 12.0(3)T)
I'm not aware of any maliciously modified IOS images floating around (but then I'm not aware of pirated normal images floating around either.)
Your mistake was that you should have typed:copy running-config startup-config
"startup-config" is a magic filename that gets stored off in nvram rather than flash. "start-config" is just a random filename that was stored on the default device (flash.)