Broadband Tech > Security > Security > Microsoft Security Bulletin Revisions

reply to Goldengamego

Re: Microsoft Security Bulletin Revisions

As you've already observed, both patches supposedly are uninstallable via Add/Remove. FWIW, buried down within the Vulnerability Details FAQ of each patch is a brief explanation of what each general "fix" was that was patched into Win98:

MS05-002/891711 »www.microsoft.com/technet/securi···002.mspx
"Cursor & Icon Handling Vulnerability
What does the update do?
The update removes the vulnerability by modifying the way that cursors, animated cursor, and icon formats are validated prior to rendering."

MS05-015/888113 »www.microsoft.com/technet/securi···015.mspx
Hyperlink Object Library Vulnerability
"What does the update do?
The update removes the vulnerability by modifying the way that the Hyperlink Object Library validates the length of a message before it passes the message to the allocated buffer."

Note: The 888113 update installs file 888113.qfe in \Windows\System; no other new files appear to have been installed by either patch, at least on my Win98 system.
--
If God wanted us to work with electrons, He'd make them big enough to see...

- - quote - -
Note: The 888113 update installs file 888113.qfe in \Windows\System; no other new files appear to have been installed by either patch, at least on my Win98 system.
- - end quote - -

Hi,

I installed those MS updates yesterday on my W98SE (Dutch).
I do have new files (report from NIS File Check):

Application: c:\windows\system\kb891711\kb891711.exe
Status: New added
Version old: 4.10.2222
Size old: 9056
Date old: 2005-02-22 18:07:56
RMD160 Hash old: A79998C78A8C2DA1B7C7504F593B56CD29A4E1C5

Application: c:\windows\options\cabs\hlink.dll
Status: New added
Version old: 5.2.3790.227 (srv03_qfe.040918
Size old: 68608
Date old: 2004-11-16 13:35:36
RMD160 Hash old: B29114D0F93512562AAB885D3B800BB075408CFD

Application: c:\windows\system\kb891711\q891711.dll
Status: New added
Version old: 4.10.2222
Size old: 4288
Date old: 2005-02-18 09:53:06
RMD160 Hash old: F6A69FFF80047E05801523445506CFC501AD6B30

And some files were changed.

As for this one:
c:\windows\system\kb891711\kb891711.exe
That one is now running all the time.
I wonder whether others (either on W98SE or XP) see that same one.

Note:
My file integrity checker NIS File Check checks several thousands of files.
I still have to run my other file integrity checker ADinf32 pro, that checks ALL files.

Thanks !
Cheers, Jan.

I agree. On my box:

The following files are installed/updated -

[C:\WINDOWS\SYSTEM]
hlink.dll 5.2.3790.22

[C:\WINDOWS\OPTIONS\CABS]
HLINK.DLL 5.2.3790.22

[c:\windows\INF\QFE\W98]
888113UN.INF
891711UN.INF

[C:\WINDOWS\SYSTEM\KB891711]
KB891711.EXE
Q891711.DLL

KB891711.EXE is then run as a service at each boot. Several other registry changes are made.

reply to SUMware
Hi SUMware,

installed the 2 fixes yesterday on a Win98SE PC with IE6sp1,
and everything is smooth.

FWIW, you could try to change your mouse.
I had one time such a trouble, and it came from the mouse.

Charles.

reply to Jrb2
Oooops... my bad! I have a small utility that monitors the root, \Windows, and \Windows\System folders for any added files, but it ignores added folders and any contained files - so it missed the ones you noted. I erred in relying alone on its output during my quick check of installation changes, and forgot about checking for possible added folders. Indeed, they too were added/altered just as with your listing. Sorry for the confusion...
--
If God wanted us to work with electrons, He'd make them big enough to see...

reply to SUMware

Exactly, that's why I manually deleted newly installed files, restored old files & registry, etc.

This is very irritating.