 BlackbirdBuilt for SpeedPremium
join:2005-01-14
Fort Wayne, IN
kudos:2
 ·Frontier Communi..
| reply to SUMware
Re: Microsoft Security Bulletin Revisions As you've already observed, both patches supposedly are uninstallable via Add/Remove. FWIW, buried down within the Vulnerability Details FAQ of each patch is a brief explanation of what each general "fix" was that was patched into Win98:
MS05-002/891711 »www.microsoft.com/technet/securi···002.mspx
"Cursor & Icon Handling Vulnerability
What does the update do?
The update removes the vulnerability by modifying the way that cursors, animated cursor, and icon formats are validated prior to rendering."
MS05-015/888113 »www.microsoft.com/technet/securi···015.mspx
Hyperlink Object Library Vulnerability
"What does the update do?
The update removes the vulnerability by modifying the way that the Hyperlink Object Library validates the length of a message before it passes the message to the allocated buffer."
Note: The 888113 update installs file 888113.qfe in \Windows\System; no other new files appear to have been installed by either patch, at least on my Win98 system.
--
If God wanted us to work with electrons, He'd make them big enough to see... |
|
|
|
Jrb2Premium
join:2001-08-31
kudos:3 | - - quote - -
Note: The 888113 update installs file 888113.qfe in \Windows\System; no other new files appear to have been installed by either patch, at least on my Win98 system.
- - end quote - -
Hi,
I installed those MS updates yesterday on my W98SE (Dutch).
I do have new files (report from NIS File Check):
Application: c:\windows\system\kb891711\kb891711.exe
Status: New added
Version old: 4.10.2222
Size old: 9056
Date old: 2005-02-22 18:07:56
RMD160 Hash old: A79998C78A8C2DA1B7C7504F593B56CD29A4E1C5
Application: c:\windows\options\cabs\hlink.dll
Status: New added
Version old: 5.2.3790.227 (srv03_qfe.040918
Size old: 68608
Date old: 2004-11-16 13:35:36
RMD160 Hash old: B29114D0F93512562AAB885D3B800BB075408CFD
Application: c:\windows\system\kb891711\q891711.dll
Status: New added
Version old: 4.10.2222
Size old: 4288
Date old: 2005-02-18 09:53:06
RMD160 Hash old: F6A69FFF80047E05801523445506CFC501AD6B30
And some files were changed.
As for this one:
c:\windows\system\kb891711\kb891711.exe
That one is now running all the time.
I wonder whether others (either on W98SE or XP) see that same one.
Note:
My file integrity checker NIS File Check checks several thousands of files.
I still have to run my other file integrity checker ADinf32 pro, that checks ALL files.
Thanks !
Cheers, Jan. |
|
SUMwarePremium
join:2002-05-21
kudos:2 | I agree. On my box:
The following files are installed/updated -
[C:\WINDOWS\SYSTEM]
hlink.dll 5.2.3790.22
[C:\WINDOWS\OPTIONS\CABS]
HLINK.DLL 5.2.3790.22
[c:\windows\INF\QFE\W98]
888113UN.INF
891711UN.INF
[C:\WINDOWS\SYSTEM\KB891711]
KB891711.EXE
Q891711.DLL
KB891711.EXE is then run as a service at each boot. Several other registry changes are made. |
|
BlackbirdBuilt for SpeedPremium
join:2005-01-14
Fort Wayne, IN
kudos:2 Reviews:
·Frontier Communi..
| reply to Jrb2
Oooops... my bad!  I have a small utility that monitors the root, \Windows, and \Windows\System folders for any added files, but it ignores added folders and any contained files - so it missed the ones you noted. I erred in relying alone on its output during my quick check of installation changes, and forgot about checking for possible added folders. Indeed, they too were added/altered just as with your listing. Sorry for the confusion... 
--
If God wanted us to work with electrons, He'd make them big enough to see... |
|
BlackbirdBuilt for SpeedPremium
join:2005-01-14
Fort Wayne, IN
kudos:2 Reviews:
·Frontier Communi..
| reply to SUMware
said by SUMware: KB891711.EXE is then run as a service at each boot. Several other registry changes are made. I'm guessing that the KB891711.exe being run as a service is how MS is validating cursors, animated cursors, and icons "on the fly" as their patch methodology, at least for Win98. It's still unclear to me why you had problems on your system, but it's possible that the patch uninstall isn't "clean", so that any problems that were created are not removed via Add/Remove.
--
If God wanted us to work with electrons, He'd make them big enough to see... |
|
SUMwarePremium
join:2002-05-21
kudos:2 | Exactly, that's why I manually deleted newly installed files, restored old files & registry, etc.
This is very irritating. |
|
