Hi TomCat76, My Windows2000-KB891861-v2-x86-ENU.EXE file is 32,724,472 bytes. It extracts ok.. The MD5sum is 2e4abce7410618af9e307d6fa4d3e2b2 After investigating a bit more (using a MS VPC2007 VM before and after running windows update on a fresh system made from the new win2ksp4+ install cd), I can draw the following conclusions: Running Windows Update on a VM with a fresh install of the hfslip-created win2ksp4 image, I am asked to install a 7.7 MB update which calls itself kb891861-v2 (is it possible that windows update can create partial updates? otherwise I don't see where this file is coming from). After installation, the following files are added: C:\WINNT\inf\hfsecper.inf (502 bytes) C:\WINNT\inf\hfsecupd.inf (502 bytes) C:\WINNT\Driver Cache\i386\ntkrnlmp.exe and C:\WINNT\system32\dllcache\NTKRNLMP.EXE (1,714,240 bytes, version 5.0.2195.7045-ENU) C:\WINNT\Driver Cache\i386\ntkrpamp.exe and C:\WINNT\system32\dllcache\NTKRPAMP.EXE (1,735,488 bytes, version 5.0.2195.7045-ENU) C:\WINNT\system32\dllcache\osloader.exe (196,880 bytes, not a PE file) C:\WINNT\system32\spupdsvc.exe (22,752 bytes, version 6.1.22.4-ENU) the following files are updated: C:\WINNT\system32\sfcfiles.dll and C:\WINNT\system32\dllcache\sfcfiles.dll (old file: 971,024 bytes, version 5.0.2195.6717-ENU) (new file: 973,072 bytes, version 5.0.2195.7038-ENU) There are a lot of other files in the update, but they are either older versions or the same version (I made sure to check that the old versions in the update do not replace the newer versions in the install). The loader/kernel file additions seem to be because I am running this VM on a dualcore pc.. Although win2k only shows one cpu in the task manager, windows update may be able to detect that it needs to install the multiprocessor kernel? Dunno. I'm not sure what spupdsvc.exe does, probably some kind of windows update thing? (In the file version display I get "SRV03_QFE.031113-0918" for this file). It would be nice if MBSA/hfnetfix had a verboser/debug mode where one could see which file version errors cause an update to be flagged as missing... :/ EDIT: copying the updated sfcfiles.dll from the install which went through windows update (and got that kb891861v2-like patch) into the fresh VM, makes the fresh VM pass windows update. So it seems that is the culprit. Now to determine which hotfix replaces the kb891861v2 version which an old version of sfcfiles.dll.