XPSP3_QFE_UpdatePack for Windows XP Post-SP3 20180109

adric · Post by **adric** » Tue Sep 13, 2011 9:41 pm

No Root Certificates Update?

Al

Post by **user_hidden** » Tue Sep 13, 2011 9:48 pm

adric wrote:No Root Certificates Update?

Al

no because v30 triggers WU to redownload june 2011.
so untill WU is updated I won't update.

the important update was pushed today for certificates KB2616676

adric · Post by **adric** » Tue Sep 13, 2011 9:58 pm

Hmmm. No alerts from AU on my side after installing manually. I wish AU would be more consistent on what it reports. You are right though to wait for the official update.

Al

ricktendo64 · Post by **ricktendo64** » Tue Sep 13, 2011 11:21 pm

Why did you remove KB2524375?

yumeyao · Post by **yumeyao** » Wed Sep 14, 2011 12:35 am

KB2616676, KB2607712, KB2524375 don't cover each other. Why don't you add KB2524375 and KB2607712?

OnePiece Alb · Post by **OnePiece Alb** » Wed Sep 14, 2011 12:40 am

Yes, you need to install all (NOT KB968730)

Ciao.

ricktendo64 · Post by **ricktendo64** » Wed Sep 14, 2011 12:54 am

I was also thinking of keeping KB2607712 because I noticed the certs were the same but issued by different companies

I think I will add it back

yumeyao · Post by **yumeyao** » Wed Sep 14, 2011 1:35 am

http://technet.microsoft.com/en-us/secu ... ry/2607712

KB2616676 really replaces KB2607712.
Unfold the sections in that page and search for KB2616676.

adric · Post by **adric** » Wed Sep 14, 2011 5:22 am

KB968730 has a Crypt32.dll. I don't see a replacement for it in KB2616676.

Oops, I was looking at the Win7 version. There is a crypt32.dll for XP
W32i DLL ENU 5.131.2600.5779 sh 599,552 03-19-2009 Crypt32.dll (KB968730)
W32i DLL ENU 5.131.2600.6147 sh 599,552 09-03-2011 crypt32.dll (KB2607712)
W32i DLL ENU 5.131.2600.6149 sh 599,552 09-09-2011 crypt32.dll (KB2616676)

Al

Post by **5eraph** » Wed Sep 14, 2011 6:22 am

yumeyao wrote:http://technet.microsoft.com/en-us/secu ... ry/2607712

KB2616676 really replaces KB2607712.
Unfold the sections in that page and search for KB2616676.

The security advisory may state that one replaces the other, but the INF files in the XPx64 update packages disagree. And the Certificates MMC snap-in lists six untrusted DigiNotar certificates (not eleven) when only KB2616676 is installed.

Microsoft wrote:[KB2616676] adds six additional DigiNotar root certificates [...] The KB2616676 update [...] also contains the previous five [...] certificates added [...] by the KB2607712 update.

diff-u8pr_KB2607712_to_KB2616676.patch

Code: Select all

[color=orange]--- KB2607712\update\update_SP2QFE.inf	Sat Sep 03 15:53:10 2011
+++ KB2616676\update\update_SP2QFE.inf	Thu Sep 08 17:00:18 2011[/color]
[color=#aaaaff]@@ -58,125 +58,147 @@[/color]
 
 [ProductInstall.GlobalRegistryChanges.Append.ID]
     AddReg=Product.Append.Reg.ID
 
 [Product.Append.Reg.ID]
     HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System\Clussvc","EventMessageFile",0x00020008,";%systemroot%\system32\ws03res.dll;%systemroot%\system32\w03a2409.dll"
 
 [Save.Reg.For.Uninstall]
[color=#ffaaaa]-    HKLM,"SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8167478C","Blob"
-    HKLM,"SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\43D9BCB568E039D073A74A71D8511F7476089CC3","Blob"
-    HKLM,"SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\40AA38731BD189F9CDB5B9DC35E2136F38777AF4","Blob"
-    HKLM,"SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B533345D06F64516403C00DA03187D3BFEF59156","Blob"
-    HKLM,"SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\5DE83EE82AC5090AEA9D6AC4E7A6E213F946E179","Blob"[/color]
[color=#aaffaa]+    HKLM,"SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2B84BFBB34EE2EF949FE1CBE30AA026416EB2216","Blob"
+    HKLM,"SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\367D4B3B4FCBBC0B767B2EC0CDB2A36EAB71A4EB","Blob"
+    HKLM,"SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\86E817C81A5CA672FE000F36F878C19518D6F844","Blob"
+    HKLM,"SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\9845A431D51959CAF225322B4A4FE9F223CE6D15","Blob"
+    HKLM,"SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B86E791620F759F17B8D25E38CA8BE32E7D5EAC2","Blob"
+    HKLM,"SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\F8A54E03AADC5692B850496A4C4630FFEAA29D83","Blob"[/color]
     HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Setup", "LogLevel"
     HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\%SP_SHORT_TITLE%
     HKLM,"SOFTWARE\Microsoft\Updates\Windows Server 2003\SP%SERVICE_PACK_NUMBER%\%SP_SHORT_TITLE%"
     HKLM,SOFTWARE\Microsoft\Updates\Windows XP Version 2003\SP%SERVICE_PACK_NUMBER%\%SP_SHORT_TITLE%
     HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System\Clussvc","EventMessageFile"
 
 [Product.Add.Reg]

yumeyao · Post by **yumeyao** » Wed Sep 14, 2011 7:34 am

Yes, I've noticed that diff. That's why at first I stated those 3 updates don't cover each other.

Since none of us know what the registry info stands for, that's really a confusing situation.

Microsoft wrote:The update adds six additional DigiNotar root certificates that are cross signed by Entrust or GTE to the Microsoft Untrusted Certificate Store. The KB2616676 update replaces the KB2607712 update and also contains the previous five DigiNotar root certificates added to the Microsoft Untrusted Certificate Store by the KB2607712 update.

Although the KB2616676 update replaces the KB2607712 update, the KB2607712 update is not a prerequisite for the KB2616676 update. Regardless of whether or not the KB2607712 update has been applied, customers should apply the KB2616676 update to address the issue described in this advisory. Customers who apply the KB2616676 update do not need to apply the KB2607712 update.

So I guess a reasonable assumption is that KB2616676's registry entries are 'big classes' and KB2607712's are 'small classes'.

Post by **5eraph** » Wed Sep 14, 2011 7:48 am

That's not the case for me.

Microsoft wrote:After applying the update, how can I verify the certificates in the Microsoft Untrusted Certificates Store?
[...]

In the Certificates MMC snap-in, verify that the following certificates have been added to the Untrusted Certificates folder:

5eraph wrote:And the Certificates MMC snap-in lists six untrusted DigiNotar certificates (not eleven) when only KB2616676 is installed.

Post by **user_hidden** » Wed Sep 14, 2011 7:51 am

what kind of snafu is MS doing ...... i'll silent update shortly.

many thanks to the incredible minds here that help each other.

Post by **user_hidden** » Wed Sep 14, 2011 7:53 am

adric wrote:Hmmm. No alerts from AU on my side after installing manually. I wish AU would be more consistent on what it reports. You are right though to wait for the official update.

Al

it won't be pushed as KB931125 is not high priority.
if you manually goto WU and scan then check the OPTIONAL updates it will be listed.

acus · Post by **acus** » Wed Sep 14, 2011 4:10 pm

I've noticed that in file qfeUpPck.inf there are few lines referring to hotfix KB2485376, no more included in the Update Pack.
I know this is not a problem for the XP installation.

Regards.

Outbreaker · Post by **Outbreaker** » Wed Sep 14, 2011 4:11 pm

Should i use the UpdatePack v20110913 or is there a new version on the way? And will there be a Root Certificate update this month?

Post by **user_hidden** » Wed Sep 14, 2011 6:43 pm

Outbreaker wrote:Should i use the UpdatePack v20110913 or is there a new version on the way? And will there be a Root Certificate update this month?

the current update pack in the first post is the LATEST with the certificate hotfixes.

Link: XPSP3_QFE_UpdatePack_20110913.7z
CRC-32: d09b7003
MD4: e21a74a60cd63fa46ffdea84b9dea27f
MD5: c8c99e4551a7fd6c08adc91cca30a891
SHA-1: ed7fbd47ec8548616edccf174612782ed68bd390
OS: Windows XP SP3 (x86)
Date: 20110913
Size: 45.8 MB

as for a rootsupd unless microsoft releases a new build i will
not add any to the pack as 4 different microsoft web pages for KB931125
all lead to different versions however WU only accepts the June 2011 version 27.

Post by **user_hidden** » Wed Sep 14, 2011 6:47 pm

acus wrote:I've noticed that in file qfeUpPck.inf there are few lines referring to hotfix KB2485376, no more included in the Update Pack.
I know this is not a problem for the XP installation.

Regards.

yup leftovers from some time ago.
they do not get added to the installation.
i'll remove them next pack release just for cleanliness.

looks like Adric has some competition with Acus

mf3imp · Post by **mf3imp** » Thu Sep 15, 2011 2:55 am

The whole "certificate stuff" is more confusing than ever!
Now they wrote a note to this blog post:
http://blogs.technet.com/b/msrc/archive ... etins.aspx

UPDATE: We have updated the Known Issues section of KB 2616676 to notify customers using Windows XP and Windows Server 2003 who downloaded update 2616676, that the update only contains the latest six digital certificates that are cross-signed by GTE and Entrust. These update versions do not also contain the digital certificates that were included in update 2607712. Customers who install update 2607712, and then install update 2616676, will be protected against the fraudulent certificates described in Security Advisory 2607712.

So I guess that they used the "supersedes" word too early

yumeyao · Post by **yumeyao** » Thu Sep 15, 2011 2:59 am

We will issue an update to update 2616676 when testing is complete.

so KB2616676v2=KB2616676+KB2607712 is coming?

adric · Post by **adric** » Mon Sep 19, 2011 3:56 pm

yumeyao wrote:
We will issue an update to update 2616676 when testing is complete.
so KB2616676v2=KB2616676+KB2607712 is coming?

KB2616676-v2 has been released. Out of the Advisory:

On September 19, 2011, we re-released update 2616676 to address this issue. If you are running Windows XP or Windows Server 2003 and you have not applied updates 2524375, 2607712, and 2616676, you should install cumulative update 2616676.

Al

Post by **user_hidden** » Mon Sep 19, 2011 5:09 pm

thanks Al....already posted by Ricktendo64 in the Hotfix Hunt thread

vodacuza · Post by **vodacuza** » Sun Sep 25, 2011 5:59 am

I have 2 different versions of cdrom.sys, one having this location:
C:\WINDOWS\system32\drivers
cdrom.sys - 5.1.2600.5593

the other here:
C:\WINDOWS\system32\dllcache
cdrom.sys - 5.1.2600.3126 - apparently installed through update IMAPIv2

Is it ok ?

jiji · Post by **jiji** » Wed Sep 28, 2011 12:38 pm

sittingduck77 wrote:I just made a fresh install with 1.08 on an old pc. During installation the Found New Hardware Wizard popped up and wanted to seardh for drivers for

terminal server device redirector
terminal server mouse driver
terminal server keyboard driver

I should mention that I did integrate five different drivers onto the disk before installation using nLite, but other than that I didn't do anything I don't normally do.

Hello,

Does anyone know something about this?
I've integrated the latest version of the pack and got the same Found New Hardware Wizard.

Botus · Post by **Botus** » Wed Sep 28, 2011 1:49 pm

jiji wrote:
sittingduck77 wrote:I just made a fresh install with 1.08 on an old pc. During installation the Found New Hardware Wizard popped up and wanted to seardh for drivers for

terminal server device redirector
terminal server mouse driver
terminal server keyboard driver

I should mention that I did integrate five different drivers onto the disk before installation using nLite, but other than that I didn't do anything I don't normally do.
Hello,

Does anyone know something about this?
I've integrated the latest version of the pack and got the same Found New Hardware Wizard.

I've seen this lots of times.... just OK each one separately, it wastes a few minutes then finds the drivers it had all along. I once asked the same question you have but didn't get a response. Sometimes I see it others not.

Post by **user_hidden** » Wed Sep 28, 2011 4:35 pm

@ sittingduck77 , jiji & Botus

nothing to do with the update pack

Post by **user_hidden** » Wed Sep 28, 2011 4:41 pm

20110928:
updated Microsoft Malicious Software Removal Tool Key to v4.0.5400
updated Adobe Flash Player 10.3.183.10 ActiveX Control
updated KB2616676-v2 replaced KB2616676 & KB2607712 & KB2524375

vodacuza · Post by **vodacuza** » Wed Sep 28, 2011 5:46 pm

thanks, I'll let you know the satisfaction of having the final build soon, I have to make one, also today ATI released it's driver

ChiefZeke · Post by **ChiefZeke** » Thu Sep 29, 2011 12:35 am

AMD/ATI 11-9 released.

vodacuza · Post by **vodacuza** » Thu Sep 29, 2011 7:51 am

works fine, thnx

=[FEAR]=JIGSAW · Post by **=[FEAR]=JIGSAW** » Sat Oct 01, 2011 4:12 am

Post by **user_hidden** » Tue Oct 11, 2011 9:25 pm

20111011
updated Microsoft Malicious Software Removal Tool v4.1.5503
updated Adobe Flash Player 11.0.1.152 ActiveX Control
updated KB943232 to v2
added KB2564958 replaced KB971513
added KB2567053 replaced KB2555917
added KB2586448 replaced KB2559049
added KB2592799 replaced KB2503665

Outbreaker · Post by **Outbreaker** » Tue Oct 11, 2011 9:52 pm

Thanks again you fast

dekdeck · Post by **dekdeck** » Tue Oct 11, 2011 10:13 pm

thank you for keeping this updated

Asim_Omer · Post by **Asim_Omer** » Wed Oct 12, 2011 1:01 am

Thanks for this great update pack.

Asim_Omer · Post by **Asim_Omer** » Wed Oct 12, 2011 11:31 am

Thanks for the update

vmanda · Post by **vmanda** » Sun Oct 16, 2011 1:09 pm

qfeUpPck.inf wrote:[KB973869]
..........
HKLM,"%SP4UPDATES%\KB973869\Filelist\0","Location",0x0,"%16427%\Common Files\microsoft shared\triedit"
..........

This will produce a wrong reg key: "Location"="C:\\Program Files\\Common Files\\Common Files\\microsoft shared\\triedit"

%16427% allready means "C:\Program Files\Common Files"

mr_smartepants · Post by **mr_smartepants** » Sun Oct 16, 2011 4:21 pm

vmanda wrote:%16427% allready means "C:\Program Files\Common Files"

Confirmed: http://gosh.msfn.org/Files/DirIds.txt

Post by **user_hidden** » Sun Oct 16, 2011 4:42 pm

wow Vmanda great eyes......

actually to keep with the way others are listed the mistake
was probably that 16427 (program files/common files) really should have been
16422 (program files\) like KB973904.

a harmless typo that DOES NOT effect the system so please no one worry.
it is just cosmetic. i will update it for next release.

vmanda · Post by **vmanda** » Mon Oct 17, 2011 2:03 am

wow Vmanda great eyes......

Registry Mechanic removed some keys, so i have checked for errors source ...
I do not know the means of that key, but Nirsoft WinUpdatesList wul.exe use it to show Full Path.

pdl808 · Post by **pdl808** » Fri Oct 21, 2011 10:02 pm

KB948046-v2 is available.

Post by **user_hidden** » Sat Oct 22, 2011 8:16 am

pdl808 wrote:KB948046-v2 is available.

it's already in the update pack since 2008 !

mr_smartepants · Post by **mr_smartepants** » Sat Oct 22, 2011 10:03 am

pdl808 wrote:KB948046-v2 is available.

Where?
http://support.microsoft.com/kb/948046
Shows the file modification dates between 2007 and 2008, hardly new.

pdl808 · Post by **pdl808** » Sat Oct 22, 2011 11:26 am

My Windows XP installation is from the 19 May 2011 update pack. Belarc Advisor reported that KB948046 needed to be reinstalled and did not show it to be v2. I did the hotfix request from your link, received KB948046-v2 and installed it. Now Belarc Advisor shows the hotfix to be v2 and it is happy. This led me to believe that KB948046 in the pack is not v2.

mr_smartepants · Post by **mr_smartepants** » Sat Oct 22, 2011 12:07 pm

I would go so far to say that Belarc Advisor can display inaccurate info. To verify the condition of your installation, run "qfecheck" (without quotes) from the command line. You can also run "sfc /scannow". Info

adric · Post by **adric** » Sat Oct 22, 2011 12:13 pm

QFECHECK does not show KB as v2 using last update pack

KB948046: Current on system.

Al

Edit: Taking a quick look, the files are still dated 2007/2008 so there may not have been any files changed. there is a KB948046-v2.CAT though.

Post by **user_hidden** » Sat Oct 22, 2011 2:30 pm

adric wrote:QFECHECK does not show KB as v2 using last update pack

KB948046: Current on system.

Al

Edit: Taking a quick look, the files are still dated 2007/2008 so there may not have been any files changed. there is a KB948046-v2.CAT though.

Al,

it was one of those hotfixes that was in the original pack when
RyanVM was supporting it and the CAT and reg entries were left as
KB948046 instead of KB948046-v2. I will update the cosmetic issue
but rest assured the hotfix in the updatepack is V2. you can even
verify the file and CAT hashes.

Post by **user_hidden** » Tue Nov 08, 2011 2:21 pm

20111108
updated Microsoft Malicious Software Removal Tool v4.2.5600
updated KB931125 Root Certificates Update (October 2011)
updated KB2544893 v2

Outbreaker · Post by **Outbreaker** » Tue Nov 08, 2011 3:10 pm

Nice fast update man.

armix7 · Post by **armix7** » Wed Nov 09, 2011 7:25 am

20111108 is flawless for me - many thanks excellent pack user_hidden !!

It's my next GOLD build so far. Switched from OnePiece's after AIO 4.9.0 due to subtle issues.

I also used yumeyao's Microsoft Runtime Libraries Collection(x86) 2.0.7 and
OnePiece's .Net, IE8 and WMP add-ons in my build. Everything fits perfect !

Many thanks to all of you again - user_hidden, OnePiece, Nonno , yumeyao