Hotfix Hunting

[ricktendo64]

I wanted to start this topic where people can contribute links/info on ANY of the latest updates (KB article or none, official ms update, it does not matter) for any addon/updatepack being developed in this and other forums, in the hope that they will not be missed by the creators of those

Let me be the first to take advantage of this update to get the conversation going

KB2171141-v2 - Internet Explorer 8 restores the search provider settings when the "Prevent Internet Explorer Search box from displaying" Group Policy setting is enabled

ieframe.dll/8.0.6001.23039

Feel free to post em guys

[5eraph]

Thanks, rick. I'll keep an eye out.

That update has a different file version for x64, probably because it appears to have been fixed in 2003 before XP. It's still v2 like the XP fix, but with the following version which for me is the same as KB982663-v2-x64. And the registry entries added are the same.

ieframe.dll/8.0.6001.23037

[ricktendo64]

Some IE7/8 updates

KB982164-IE7 - mshtml.dll/7.00.6000.21268
KB982164-v2-IE8 - mshtml.dll/8.00.6001.23048
KB2257386-IE8 - ieframe.dll/8.00.6001.23049
KB2275828-IE8 - wininet.dll/8.00.6001.23048

All credit is to SoLoR

[5eraph]

Thanks for the notification, rick. Those updates should make today's releases more interesting.

I'm assuming your link on WinCert to SoLoR's share is the source, correct?

[user_hidden]

if you guys don't already have this link:

Description of Software Update Services and Windows Server Update Services changes in content for 2010

[ricktendo64]

I'm assuming your link on WinCert to SoLoR's share is the source, correct?

I use the KB numbers in his changelog to search if any of his Windows 7 hotfixes apply to XP, I find mostly IE8 and .NET updates

He has a script that scans the "View and request hotfix" url, I asked him if he found any XP links to please let me know but he said his script only looks for Windows 7 hotfixes

[yumeyao]

Oh my god, these IE8 hotfixes even contain newer files than latest ie update.
I'll wait to see whether there are even newer hotfixes..

[newsposter]

Has anyone checked to see if the current listings in the Microsoft Update Catalog are accurate and complete for today?

[yumeyao]

Microsoft Update is always belated compared to Microsoft Download, but I have just checked it, it's complete now.

From my experience, Microsoft Download always comes first, but sometimes the search by catalog won't work so you have to manually search by typing windows xp. Only that the latter may miss other updates such as .NET.

Then after about 1 hour, Windows Update is ready for new updates.

Than again after 1 hour, KB Articles become available.

[ricktendo64]

I am also not releasing my pack until SoLoR publishes his changelog and I check it for any XP updates

BTW dont forget Flash guys, it was updated today

[5eraph]

Thanks for the Flash reminder, rick.

KB982664 was also released today despite the fact that the Microsoft Download site states release was six days ago. I couldn't find it yesterday. It doesn't show up on the Microsoft Update site for me either, which is strange.

[5eraph]

KB982316 just popped up on KBUpdate.info. It's a security update that does not appear on the Microsoft Update site, for me at least. It could be worth including for those that haven't released their packs yet.

[ricktendo64]

Yea I saw this but briefly looked in the .inf but could not find the security descriptors so I did not add it to this months pack, onepiece PM the security code to me and I took a second look inside the hotfix INF and there it was, at the very end...I will apply it the same manner I aply it for KB909520

Code: Select all

[KB982316.AddReg]
HKLM,"%SP4UPDATES%\KB982316","Description",,"%SECURITY% (KB982316)"
HKLM,"%SP4UPDATES%\KB982316","InstalledDate",,"%VERSION%"
HKLM,"%SP4UPDATES%\KB982316","InstalledBy",,"%NAME%"
HKLM,"%SP4UPDATES%\KB982316","Type",,"Update"
HKLM,"%SP4UPDATES%\KB982316\Filelist",,0x10
HKLM,"%HFREGPATH%\KB982316","Installed",0x10001,1
HKLM,"%HFREGPATH%\KB982316","Comments",,"%SECURITY% (KB982316)"
HKLM,"%HFREGPATH%\KB982316","Backup Dir",,""
HKLM,"%HFREGPATH%\KB982316","Fix Description",,"%SECURITY% (KB982316)"
HKLM,"%HFREGPATH%\KB982316","Installed By",,"%NAME%"
HKLM,"%HFREGPATH%\KB982316","Installed On",,"%VERSION%"
HKLM,"%HFREGPATH%\KB982316","Service Pack",0x10001,4
HKLM,"%HFREGPATH%\KB982316","Valid",0x10001,1
HKLM,"%HFREGPATH%\KB982316\File 1","Flags",,""
HKLM,"%HFREGPATH%\KB982316\File 1","New File",,""
HKLM,"%HFREGPATH%\KB982316\File 1","New Link Date",,""
HKLM,"%HFREGPATH%\KB982316\File 1","Old Link Date",,""

[KB982316.Permissions.AddReg]
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony",,0x10

[KB982316.Permissions.AddReg.Security]
"D:P(A;CIOI;GR;;;BU)(A;CIOI;GRGWSD;;;PU)(A;CIOI;GR;;;NS)(A;CIOI;GR;;;LS)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"

[5eraph]

Thanks for the code. I'm still looking into it.

[ricktendo64]

It works, the network service and local service full control checkmarks are removed

Normal



With INF code or after hotfix

[5eraph]

Thanks for the pictures. I wouldn't have known where to check otherwise.

There is no such code in the XPx64 package, only updated files (TAPISrv.dll and wTAPISrv.dll).

However, by default neither LOCAL SERVICE nor NETWORK SERVICE have Full Control of the Telephony key on XPx64 and 2003x64, so the security descriptors are not necessary for me to use.

[yumeyao]

Oh, thanks, I missed KB982316. My search on Microsoft Download didn't show it up yet.
And thanks for the remind of security descriptors, and the reply in my IE8 thread.

[ricktendo64]

KB981835-v2 - Wisptis.exe/1.7.2600.5958 (Tablet PC dl is finally available)
KB982551-v2 - Csrsrv.dll/5.1.2600.5981 (Its official)
KB2270406 - tcpip.sys/5.1.2600.6009 (New)

[ricktendo64]

KB2095711 - cryptsvc.dll/5.1.2600.5988

But I cant get it to install, think it was only meant for Embedded

Code: Select all

[CheckforEmbedded.Condition]
    PresentOp = CheckReg, HKLM, "SYSTEM\CurrentControlSet\Control\ProductOptions", "ProductSuite", 0x00010000
    EqualOp = CheckReg, HKLM, "SYSTEM\CurrentControlSet\Control\ProductOptions", "ProductSuite", 0x00010000, "==", "EmbeddedNT"
    Display_String = %A6Blocked%

[5eraph]

It wouldn't be the first time similar code's been used. Have you tried changing the registry key that the installer checks?

But the code suggests that Embedded is blocked, not the other way around.

[ricktendo64]

Thanks for the clarification, I too decided that I would add it to my pack

Edit: KB2282612 - quartz.dll/6.5.2600.6010

[5eraph]

If SoLoR's changelog seems as overwhelming to you as it does to me, then you may want to give this simple script a try. Instructions are included in the header of the CMD file, and a copy of the following screenshot is included—it takes up almost all of the package.

Be certain that your default web browser is open when running this script to ensure that it works properly. If the browser is not open then one or more pages may fail to open.

Example List.txt files are included.

Download:

• Link: Update_Checking_Script.7z
  Size: 171.4 KB
  MD5: 0bf64bc7c866afe11907ba2b31fc0f86

Screenshot:

[ricktendo64]

5eraph, any way you can make it check a range of fixes?

Like kb1111111 > kb3333333

It would check 1111111, 1111112, etc, etc

Edit: BTW try this, it opens your default browser

Code: Select all

RUNDLL32 url.dll,FileProtocolHandler "http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=%1"

[5eraph]

The following script will do that, Rick. I haven't seen KBs use numbers that high, so I've set the largest allowable number range from 100000 to 2999999. Feel free to tinker with the code to change it if you'd like.

And thanks for the RunDLL32 commands. They've been implemented in this script.

Download:

• Link: Check_Update_Range.7z
  Size: 1.77 KB
  MD5: 6341324cc46efb8d874c9211aa48368a

EDIT: Script has been silently updated to correct an issue when reentering range.

[ricktendo64]

KB983234 - msvbvm60.dll/6.0.98.21

Straight up copy and replace, no installer (or .cat)

And ty 5eraph for the scripts

Edit: the hotfix also applies to Windows 7 32/64 bit

Edit2: Missing .cat will not cause setuperr.log error

[user_hidden]

KB983234 - msvbvm60.dll/6.0.98.21

attach the file?

edit: never mind got it.....


RequestKBarticle.exe

useage: RequestKBarticle <KBnumber>

example: RequestKBarticle 983234
the above example will get you KB983234, and yes you do not use the letters KB in the cmdline.

Link: RequestKBarticle.exe
CRC-32: e7bb7ff5
MD4: 878f4789eaba379e069deaff45aa4b02
MD5: ed6dee48a5a671436a421c2c3460aec4
SHA-1: 6044e25442801a9d99c1bcf2f6898e8c1589c8fd
Date: 20100823
OS: WindowsXP SP3 (x86)
Size: 452 KB

[5eraph]

If the EXE is a compiled batch file then it may be better not to compile it, user_hidden. The batch file size would be drastically smaller, and several AV vendors currently flag the EXE as malware.

Thanks for mentioning KB983234, Rick. Unfortunately, it breaks 32-bit IE6 under XPx64 when opening some Microsoft sites, such as the one user_hidden's utility accesses. Further testing has shown inconclusive results. Still playing with this update.

[ricktendo64]

Wonder if it affects IE7/8 5eraph...if it doesn't you should add it to your IE addon and not your updatepack

[user_hidden]

If the EXE is a compiled batch file then it may be better not to compile it, user_hidden. The batch file size would be drastically smaller, and several AV vendors currently flag the EXE as malware.

Code: Select all

@echo off
title Microsoft KB Article Request Linker
RUNDLL32 url.dll,FileProtocolHandler "http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=%1&kbln=en-us"
exit

[yumeyao]

AutoIt Script for downloading requested hotfixes:
EXE Download: http://www.mediafire.com/?uk81c8cyskh6fkj
Source:

Code: Select all

Global $i = 0
Global $hFile = FileOpen(@ScriptDir & "\a.txt", 0)
Global $hOutFile = FileOpen(@ScriptDir & "\7zcmd.cmd", 2 + 8)
If $hFile = -1 Then Exit
Global $bHotfixStart = False
Global $szDIR = "\Global"
Global $sz7zCmdLine = ''
Const $szLangNames[24] = ["ARA","CHS","CHT","CSY","DAN","NLD","ENU","FIN","FRA","DEU","ELL","HEB","HUN","ITA","JPN","KOR","NOR","PLK","PTB","PTG","RUS","ESN","SVE","TRK"]

Do
	$i = $i + 1
	Local $szLine = FileReadLine($hFile, $i)
	If @error = -1 Then ExitLoop
	$szLine = StringStripWS($szLine, 3)
	If StringCompare(StringLeft($szLine, StringLen("KB Article Number")), "KB Article Number") = 0 Then
		$bHotfixStart = True
	ElseIf $bHotfixStart = True Then
		If StringInStr($szLine, "http://") > 0 Then
			$iLeftBracket = StringInStr($szLine, "(")
			$iRightBracket = StringInStr($szLine, ")")
			$szURL = StringMid($szLine, $iLeftBracket + 1, $iRightBracket - $iLeftBracket - 1)
			$aszURL = StringSplit($szURL, "/")
			$szFileName = $aszURL[$aszURL[0]]
			$szDIR = "\Global"
			For $szLangName In $szLangNames
				If StringInStr($szFileName,  $szLangName) > 0 Then $szDIR = "\" & $szLangName
			Next
			DirCreate(@ScriptDir & $szDIR)
			InetGet($szURL, @ScriptDir & $szDIR & "\" & $szFileName)
		ElseIf StringInStr($szLine, "Password:") > 0 And StringInStr($szLine, "Next Password:") <= 0 Then
			$aszLine = StringSplit($szLine, " ")
			$szPassword = $aszLine[$aszLine[0]]
			$szPassword = String7ZPasswordToBatchScript($szPassword)
			$sz7zCmdLine = '7z e "' & @ScriptDir & $szDIR & '\' & $szFileName & '" -o"' & @ScriptDir & $szDIR & '" -p' & $szPassword & ' -y' & @CRLF
			$sz7zCmdLine = $sz7zCmdLine & 'if %errorlevel% EQU 0 del /F "' & @ScriptDir & $szDIR & '\' & $szFileName & '"' & @CRLF
			FileWrite($hOutFile, $sz7zCmdLine)
			$bHotfixStart = False
		EndIf
	EndIf
Until False
FileClose($hFile)
FileClose($hOutFile)

Func String7ZPasswordToBatchScript($szOriginal)
	$szNew = StringReplace($szOriginal, "^", "^^")
	$szNew = StringReplace($szNew, "%", "%%")
	$szNew = StringReplace($szNew, "&", "^&")
	$szNew = StringReplace($szNew, "|", "^|")
	$szNew = StringReplace($szNew, "(", "^(")
	$szNew = StringReplace($szNew, ")", "^)")
	Return $szNew
EndFunc

Usage:
1. You just request a lot of hotfixes from the web. In this case, I created a custom "search engine" for my browser, which directly opens the hotfix page for queried KB number.
2. go to your mail in box, I recommend you use gmail, because all mails in a same topic can be open at the same time. Then you simply copy all mails' texts(in gmail, this can be done in one step), paste them and save as a.txt in the same location where this script/exe is.
3. execute this script/exe, then just wait until the autoit icon in taskbar notification zone(tray bar) disappears.
4. run generated 7zcmd.cmd, it will automatically extract downloaded hotfixes for you. You should make sure that 7z.exe exist in the same folder or can be accessed via PATH variable.

Validated entreis in a.txt:
Start with: KB Article Number(s): xxxxxx
End with: Password: yyyyyy

Limits:
1. You must use the english hotfix request page:
http://support.microsoft.com/hotfix/KBH ... num=123456&kbln=en-us
2. Some times there may be corruption during download. You should manually deal with it:

If a download is broken, then the extraction fails, the 7zcmd.cmd handles this correctly so that it won't delete broken files. Therefore you just need to browse to CHS/ENU to find which are not extracted and not deleted, just modify a.txt and keep entries of broken ones and run the script again.

Hoping it helps.

------------------ EDITED ------------------
Updated the code and the exe.
Now hotfixes in any language can be sorted in corresponding directory. (Only CHS and ENU could be sorted previously)

[yumeyao]

@u_h & 5eraph,
the batch file can be written as

Code: Select all

start http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=%1&kbln=en-us

[5eraph]

I tried that first, yumeyao. It didn't seem to work for me, which is why I had to add IExplore.exe to the START command.

Your script looks interesting. I'll have a look at it later.

I'm still playing with KB983234, Rick. Something else may have caused the problems I was seeing.

[yumeyao]

It works for me, however.
I have just updated the script, just FYI, hoping you don't miss the updated script.

[ricktendo64]

There is this (new?) file pscrptfe.ntf from KB950305-v2 that is signed by NT5.CAT and I want to find its equal (I think it may have a different name) in my XP CD

Code: Select all

pscript.ntf              30/11/2007     2:5.1               Firmado             NT5.CAT             Microsoft Windows Component Publisher

[yumeyao]

It's in SP3.cab.

[user_hidden]

wow i get some sleep and the world is still awake.

great job

[ricktendo64]

It's in SP3.cab.

I guess its lang specific because I dont see it in spanish or english xp sp3.cab

[yumeyao]

But I found it in english xp sp3.cab, too.

[ricktendo64]

CRAP! I posted the wrong sigverif file in the code box, its this one

Code: Select all

pscrptfe.ntf             30/11/2007     2:5.1               Firmado             NT5.CAT             Microsoft Windows Component Publisher

Code: Select all

  File: pscrptfe.ntf
CRC-32: 40dd2aa1
   MD4: d95a00cc440ab835582a260c98c591c4
   MD5: 69b9d3ea3204c4c1ea0f30f5772a0170
 SHA-1: ade95061e03bddd156588ab57cdc6fec132e62e5

[yumeyao]

OK.... Now I can confirm pscrptfe.ntf exists in chinese sp3.cab, but doesn't in english sp3.cab.
The checksums match.

[user_hidden]

Update for Root Certificates [August 2010] (KB931125)

[5eraph]

Thanks, user_hidden. Whenever I look for the version of KB931125 you have in your pack, it's nowhere to be found—so I pull it out of your pack and put it in mine.

[yumeyao]

In case you are interested, I have repacked a rootsupd.exe, which contains also fontreg.exe and resetwmi.exe and have ADVPACK.DLL and W95INFxx.DLLs removed.

-EDIT-
Fixed.

[5eraph]

How do you run FontReg and ResetWMI? I don't see anything about those files in RootsUpd.inf.

[yumeyao]

Oh, you are right... I forgot to modify rootsupd.inf.
new link here:
http://www.mediafire.com/?103wm4nd63bqdl6

[5eraph]

Thanks, yumeyao.

[5eraph]

KB2264107 was just released in response to the recently announced "DLL preloading" attack vector.

[ricktendo64]

Anybody have documentation on Modes = 0,1,2,3 directive in INF files?

I want to NOT install a certain component by default, I know I can use Modes = 0 (or not add it at all) but was just curious if anybody had the full story on the use of Modes

tia

[5eraph]

According to TechNet, InstallDefault performs this task.

InstallDefault=0 | 1 ; Whether to install this component by default. 1=Yes, 0=No.

I thought I knew about Modes at one time, but I can't remember now. Strangely enough, the article linked above gives no mention of Modes.

[vmanda]

Maybe this help:(txtsetup.sif layout.inf).See upgradecode, newinstallcode1
filename = status,subdir,size,3,4,5,diskid,subdir,upgradecode,newinstallcode1,newfilename,newinstallcode2,6
.........................
bootvid.dll = 1, , , , , , 3_, 2, 0, 0, , 1,2
fastfat.sys = 100, , , , , , 5_, 4, 0, 0, , 1,4
tunga.ttf = 1, , , , , , , 22, 0, 0, , 1,22
diskdump.sys = 100, , , , , , , 4, 0, 0, , 1,4
admtoolW.chm = 1, , , , , , , 21, 0, 0,admtools.chm
adpu160m.sys = 1, , , , , , 4_, 4, 1, , , 1,4
hidserv.dll = 100, , , , , , , 2, 1, 3
........................
filename specifies the source file you want to copy. if the file is compressed using
makecab you still specify its uncompressed filename (eg. .dll instead of .dl_)
status specifies the source itself. normally its 1 (RTM) or 100 (SP). see [SourceDisksNames]
and [SourceDisksNames.*] in TXTSETUP.SIF
subdir specifies the source subdirectory you want to copy the file from.
size specifies the size of the uncompressed source file in bytes. see [SourceDisksFiles] in LAYOUT.INF
3, 4, 5 are unknown.
diskid is used when running an installation from (multiple) floppy or multiple cds.
see [SourceDisksNames] and [SourceDisksNames.*] in TXTSETUP.SIF
subdir specifies the target subdirectory you want to copy the file to.
see [WinntDirectories] in TXTSETUP.SIF
upgradecode is a single digit that is used if this is an upgrade from an earlier version.
It specifies whether the file is copied during the text-mode portion.
0 - Always copies the file
1 - Copies the file only if it exists in the installation directory
2 - Does not copy the file if it exists in the installation directory
3 - Does not copy the file
newinstallcode1 is a single digit that is used if this is a fresh installation.
It specifies whether the file is copied during the text-mode portion.
The newinstallcode1 is optional; if it is not included, the file is not copied (code = 3).
0 - Always copies the file
1 - Copies the file only if it exists in the installation directory
2 - Does not copy the file if it exists in the installation directory
3 - Does not copy the file
newfilename specifies the target filename. see [SourceDisksFiles] in TXTSETUP.SIF
newinstallcode2 is unknown
6 is unknown

Reference