Re: MS05-051 on W2K3

Is 'Security Update for Windows 2003 (KB9024400)' found in Add/Remove
Programs? Have you rebooted since installing KB05-051? Do you find any
errors relating to the install in Windowsupdate.log?

Best to follow-up on this in the Windows Update newsgroup where you've also
posted about this behavior, Chris, and to which I'm crossposting this reply.
--
~PA Bear

Chris Wood wrote:
> Would you know any reason why this dll is not getting updated by MS05-051?
> All the other appears to be updated, except this one.
>
> "PA Bear" <> wrote in message
> news:...
> > Rpcrt4.dll should be 5.2.3790.141 with MS05-051 installed in Windows
> > Server 2003 (all versions).
> >
> > Source: http://www.microsoft.com/technet/sec.../MS05-051.mspx
> > [General Info > Security Update Info > Windows Server 2003 (all
> > versions] --
> > ~Robear Dyer (PA Bear)
> > MS MVP-Windows (IE/OE, Shell/User, Security), AH-VSOP
> >
> > Chris Wood wrote:
> > > Can anyone tell me the correct version for the RPCRT4.DLL on a W2K3
> > > server
> > > (no SP1) after MS05-051 has been installed? We have 5.2.3790.137 and
> > > HFNETCHK reckons it should be 5.2.3790.141.

Bear,

I can see it under Add/remove and in Windows Update Installed. I am
currently looking at the KB902400 log and see it here 6.391: Copied file:
c:\windows\$hf_mig$\KB902400\RTMQFE\rpcrt4.dll but no where else.
I have never looked in a Windows Update Log before so this is hard to
understand at this time.

Chris

"PA Bear" <> wrote in message
news:...
> Is 'Security Update for Windows 2003 (KB9024400)' found in Add/Remove
> Programs? Have you rebooted since installing KB05-051? Do you find any
> errors relating to the install in Windowsupdate.log?
>
> Best to follow-up on this in the Windows Update newsgroup where you've
> also posted about this behavior, Chris, and to which I'm crossposting this
> reply.
> --
> ~PA Bear
>
> Chris Wood wrote:
>> Would you know any reason why this dll is not getting updated by
>> MS05-051?
>> All the other appears to be updated, except this one.
>>
>> "PA Bear" <> wrote in message
>> news:...
>> > Rpcrt4.dll should be 5.2.3790.141 with MS05-051 installed in Windows
>> > Server 2003 (all versions).
>> >
>> > Source:
>> > http://www.microsoft.com/technet/sec.../MS05-051.mspx
>> > [General Info > Security Update Info > Windows Server 2003 (all
>> > versions] --
>> > ~Robear Dyer (PA Bear)
>> > MS MVP-Windows (IE/OE, Shell/User, Security), AH-VSOP
>> >
>> > Chris Wood wrote:
>> > > Can anyone tell me the correct version for the RPCRT4.DLL on a W2K3
>> > > server
>> > > (no SP1) after MS05-051 has been installed? We have 5.2.3790.137 and
>> > > HFNETCHK reckons it should be 5.2.3790.141.
>

With your anti-virus application disabled throughout:

1. Uninstall it via Add/Remove Programs & reboot.

2. Download MS05-051 for Win2K03 from the following link, install it
manually & reboot:

http://www.microsoft.com/downloads/d...F-A20D1F8607F7

Is Rpcrt4.dll now v5.2.3790.141?
--
~PA Bear


Chris Wood wrote:
> I can see it under Add/remove and in Windows Update Installed. I am
> currently looking at the KB902400 log and see it here 6.391: Copied file:
> c:\windows\$hf_mig$\KB902400\RTMQFE\rpcrt4.dll but no where else.
> I have never looked in a Windows Update Log before so this is hard to
> understand at this time.
>
> Chris
>
> "PA Bear" <> wrote in message
> news:...
> > Is 'Security Update for Windows 2003 (KB9024400)' found in Add/Remove
> > Programs? Have you rebooted since installing KB05-051? Do you find any
> > errors relating to the install in Windowsupdate.log?
> >
> > Best to follow-up on this in the Windows Update newsgroup where you've
> > also posted about this behavior, Chris, and to which I'm crossposting
> > this reply.
> > --
> > ~PA Bear
> >
> > Chris Wood wrote:
> > > Would you know any reason why this dll is not getting updated by
> > > MS05-051?
> > > All the other appears to be updated, except this one.
> > >
> > > "PA Bear" <> wrote in message
> > > news:...
> > > > Rpcrt4.dll should be 5.2.3790.141 with MS05-051 installed in Windows
> > > > Server 2003 (all versions).
> > > >
> > > > Source:
> > > > http://www.microsoft.com/technet/sec.../MS05-051.mspx
> > > > [General Info > Security Update Info > Windows Server 2003 (all
> > > > versions] --
> > > > ~Robear Dyer (PA Bear)
> > > > MS MVP-Windows (IE/OE, Shell/User, Security), AH-VSOP
> > > >
> > > > Chris Wood wrote:
> > > > > Can anyone tell me the correct version for the RPCRT4.DLL on a
> > > > > W2K3 server
> > > > > (no SP1) after MS05-051 has been installed? We have 5.2.3790.137
> > > > > and HFNETCHK reckons it should be 5.2.3790.141.

Chris Wood wrote:

> Bear,
>
> I can see it under Add/remove and in Windows Update Installed. I am
> currently looking at the KB902400 log and see it here 6.391: Copied file:
> c:\windows\$hf_mig$\KB902400\RTMQFE\rpcrt4.dll but no where else.
> I have never looked in a Windows Update Log before so this is hard to
> understand at this time.
>
> Chris
Hi,

That is not good for a Win2k3 with no SP1.

You should have seen 3 lines that copies rpcrt4.dll:

31.687: Copied file: C:\WINDOWS\system32\rpcrt4.dll
37.047: Copied file: C:\WINDOWS\system32\DllCache\rpcrt4.dll
43.297: Copied file: c:\windows\$hf_mig$\KB902400\RTMQFE\rpcrt4.dll



--
torgeir, Microsoft MVP Scripting, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

Torgeir Bakken (MVP) wrote:

> Chris Wood wrote:
>
>> Bear,
>>
>> I can see it under Add/remove and in Windows Update Installed. I am
>> currently looking at the KB902400 log and see it here 6.391: Copied
>> file: c:\windows\$hf_mig$\KB902400\RTMQFE\rpcrt4.dll but no where else.
>> I have never looked in a Windows Update Log before so this is hard to
>> understand at this time.
>
> That is not good for a Win2k3 with no SP1.
>
> You should have seen 3 lines that copies rpcrt4.dll:
>
> 31.687: Copied file: C:\WINDOWS\system32\rpcrt4.dll
> 37.047: Copied file: C:\WINDOWS\system32\DllCache\rpcrt4.dll
> 43.297: Copied file: c:\windows\$hf_mig$\KB902400\RTMQFE\rpcrt4.dll
>
Hi,

Scratch that, I now see that if you have MS05-012 / KB873333
(Vulnerability in OLE and COM Could Allow Remote Code Execution)
installed from before, rpcrt4.dll will only be copied to the $hf_mig$
folder, because KB873333 contains the same file (v5.2.3790.137).



--
torgeir, Microsoft MVP Scripting, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

PA Bear wrote:

> With your anti-virus application disabled throughout:
>
> 1. Uninstall it via Add/Remove Programs & reboot.
>
> 2. Download MS05-051 for Win2K03 from the following link, install it
> manually & reboot:
>
> http://www.microsoft.com/downloads/d...F-A20D1F8607F7
>
>
> Is Rpcrt4.dll now v5.2.3790.141?
Hi,

Actually, it should be v5.2.3790.137 on Win2k3 RTM.

And the Rpcrt4.dll will not be updated if KB873333 (MS05-012) is
installed from before, because it contains the same exact file
(v5.2.3790.137)



--
torgeir, Microsoft MVP Scripting, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

Torgeir,

That is good to know. Its just HFNETCHK that is wrong.

Thanks

Chris

"Torgeir Bakken (MVP)" <Torgeir.Bakken-> wrote in message
news:...
> Torgeir Bakken (MVP) wrote:
>
>> Chris Wood wrote:
>>
>>> Bear,
>>>
>>> I can see it under Add/remove and in Windows Update Installed. I am
>>> currently looking at the KB902400 log and see it here 6.391: Copied
>>> file: c:\windows\$hf_mig$\KB902400\RTMQFE\rpcrt4.dll but no where else.
>>> I have never looked in a Windows Update Log before so this is hard to
>>> understand at this time.
>>
>> That is not good for a Win2k3 with no SP1.
>>
>> You should have seen 3 lines that copies rpcrt4.dll:
>>
>> 31.687: Copied file: C:\WINDOWS\system32\rpcrt4.dll
>> 37.047: Copied file: C:\WINDOWS\system32\DllCache\rpcrt4.dll
>> 43.297: Copied file: c:\windows\$hf_mig$\KB902400\RTMQFE\rpcrt4.dll
>>
> Hi,
>
> Scratch that, I now see that if you have MS05-012 / KB873333
> (Vulnerability in OLE and COM Could Allow Remote Code Execution)
> installed from before, rpcrt4.dll will only be copied to the $hf_mig$
> folder, because KB873333 contains the same file (v5.2.3790.137).
>
>
>
> --
> torgeir, Microsoft MVP Scripting, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/scr...r/default.mspx

As I am using an old version of HFNETCHK it cannot handle some of the more
complex situations. I am happy with this explanation and not able to upgrade
HFNETCHK so I will live with it.

Thanks

Chris

"Chris Wood" <> wrote in message
news:...
> Torgeir,
>
> That is good to know. Its just HFNETCHK that is wrong.
>
> Thanks
>
> Chris
>
> "Torgeir Bakken (MVP)" <Torgeir.Bakken-> wrote in message
> news:...
>> Torgeir Bakken (MVP) wrote:
>>
>>> Chris Wood wrote:
>>>
>>>> Bear,
>>>>
>>>> I can see it under Add/remove and in Windows Update Installed. I am
>>>> currently looking at the KB902400 log and see it here 6.391: Copied
>>>> file: c:\windows\$hf_mig$\KB902400\RTMQFE\rpcrt4.dll but no where else.
>>>> I have never looked in a Windows Update Log before so this is hard to
>>>> understand at this time.
>>>
>>> That is not good for a Win2k3 with no SP1.
>>>
>>> You should have seen 3 lines that copies rpcrt4.dll:
>>>
>>> 31.687: Copied file: C:\WINDOWS\system32\rpcrt4.dll
>>> 37.047: Copied file: C:\WINDOWS\system32\DllCache\rpcrt4.dll
>>> 43.297: Copied file: c:\windows\$hf_mig$\KB902400\RTMQFE\rpcrt4.dll
>>>
>> Hi,
>>
>> Scratch that, I now see that if you have MS05-012 / KB873333
>> (Vulnerability in OLE and COM Could Allow Remote Code Execution)
>> installed from before, rpcrt4.dll will only be copied to the $hf_mig$
>> folder, because KB873333 contains the same file (v5.2.3790.137).
>>
>>
>>
>> --
>> torgeir, Microsoft MVP Scripting, Porsgrunn Norway
>> Administration scripting examples and an ONLINE version of
>> the 1328 page Scripting Guide:
>> http://www.microsoft.com/technet/scr...r/default.mspx
>
>