OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Alex S. Sachetti Araujo (woyzeckterra.com.br)
Date: Wed Aug 15 2001 - 20:49:12 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

        Hi,

        I'm totally confused after running HfNetChk. Recently, Microsoft launch
    a new package (Q299444) that delivers all necessary hotfixes pos SP6.0a for
    Windows NT 4.0 Server. For a complete hotfix list reference see:
    http://support.microsoft.com/support/kb/articles/q299/4/44.asp. Imediatelly
    after installing this package (I use qchain.exe, reboot machine, etc)
    HfNetChk reports missing hotfixes (wich must be delivered in Q299444),
    unknown hotfixes and inconsistent dll/exe versions.

        The following is the report generated by HfNetChk wich expose missing
    hotfixes:

                    Patch NOT Found MS99-047 Q243649
                    The registry key **SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\Hotfix\Q243649** does not exist. It is required for this
    patch to be considered installed.

                    Patch NOT Found MS99-055 Q246045
                    The registry key **SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\Hotfix\Q246045** does not exist. It is required for this
    patch to be considered installed.

                    Patch NOT Found MS99-056 Q248183
                    The registry key **SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\Hotfix\Q248183** does not exist. It is required for this
    patch to be considered installed.

                    Patch NOT Found MS99-057 Q248183
                    The registry key **SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\Hotfix\Q248183** does not exist. It is required for this
    patch to be considered installed.

                    Patch NOT Found MS00-003 Q247869
                    The registry key **SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\Hotfix\Q247869** does not exist. It is required for this
    patch to be considered installed.

                    Patch NOT Found MS00-004 Q249108
                    The registry key **SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\Hotfix\Q249108** does not exist. It is required for this
    patch to be considered installed.

                    Patch NOT Found MS00-027 Q259622
                    The registry key **SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\Hotfix\Q259622** does not exist. It is required for this
    patch to be considered installed.

                    Patch NOT Found MS00-029 Q259728
                    The registry key **SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\Hotfix\Q259728** does not exist. It is required for this
    patch to be considered installed.

                    Patch NOT Found MS00-095 Q265714
                    The registry key **SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\Hotfix\Q265714** does not exist. It is required for this
    patch to be considered installed.

        Also, HfNetChk report the folowing hotfix wich is not mentioned in
    Q299444 (maybe it was substituted by other hotfix?):

                    Patch NOT Found MS99-046 Q243825
                    The registry key **SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\Hotfix\Q243835** does not exist. It is required for this
    patch to be considered installed.

        Other problems (maybe my machine is running trojaned +_+ ?):

                    Patch NOT Found MS01-003 Q279336
                    File C:\WINNT\system32\ws2_32.dll has an invalid checksum
    and its file version is equal to or less than what is expected.

                    WARNING MS00-040 Q264684
                    File C:\WINNT\system32\winlogon.exe has a file version that
    is greater than what is expected.

                    WARNING MS00-070 Q266433
                    File C:\WINNT\system32\ntoskrnl.exe has a file version that
    is greater than what is expected.

                    Patch NOT Found MS01-003 Q279336
                    File C:\WINNT\system32\ws2_32.dll has an invalid checksum
    and its file version is equal to or less than what is expected.

                    WARNING MS01-008 Q280119
                    File C:\WINNT\system32\ntlmssps.dll has a file version that
    is greater than what is expected.

                    WARNING MS01-041 Q299444
                    File C:\WINNT\system32\riched20.dll has a file version that
    is greater than what is expected. File C:\WINNT\system32\riched32.dll has a
    file version that is greater than what is expected

        Any apointments?

        Alex

    ---
    Alex Sander Sachetti
    alexsekure.org