mixit

Thanks for the update, @Bersaglio! I edited my post in the other topic to reflect this. Yeah, and fix the mess at the Catalog while you're at it... Not sure why it's necessary to continually attach my name to this feature

Edited the topic to reflect the switch to KB4011604 (thanks for the heads up, @Bersaglio ). FYI, for some reason the KB4011604 Download Center landing page sometimes gives a "no longer available" message, hopefully the direct EXE links are more stable. If you're a more of a Catalog person, I'm sure you'll appreciate the fact that MS has posted all language versions separately, with no indication which is which, so you basically have to click on each download button until you find the right language...

I keep forgetting to mention that I wasn't able to make this problem appear with the latest ESR update and a clean profile, so it likely only manifests in case of some combination of other settings and maybe extensions. Just setting FF to never remember history didn't cause me any problems with manual installation. In any case, thanks for reporting this and hopefully your workaround will work if anyone else should experience something similar.

(This is a generalized version of something I put together to help out a member here. Of course after having written it I found out that @heinoganda has already mentioned most of this earlier in this thread, but at least this is prettier , so I'm still going to post it.) So, you're looking for an older version of Microsoft Security Essentials in your local language (for example version 4.4.304, the last one officially supported on XP) and find out that the web is full of English versions, but it's very difficult to find an installer for the language you want. Fortunately, you can convert an English installer into any other supported language in just a few steps, using 7-zip and a text editor. Any place you see Italian and IT-IT in this example, just replace them with your language from this list: Download the "English" 4.4.304 installer, for example from https://web.archive.org/web/20140325144125if_/http://download.microsoft.com/download/A/3/8/A38FFBF2-1122-48B4-AF60-E44F6DC28BD8/ENUS/x86/MSEInstall.exe Right-click MSEInstall.exe > 7-zip > Extract to "MSEInstall" (or wherever you like). Open the folder you extracted it to. Open setup.ini in a text editor, change Market=EN-US into Market=IT-IT. Copy the folder EN-US, paste the copy into the same folder (top folder, not EN-US), rename the copy to IT-IT. (Optional) If you also want to change the installation dialogs from English to Italian: Go into the x86 subfolder, open epp.msi in 7-zip. Right-click product.cab > Open Inside. Locate SetupResDllMui_IT_IT, extract it to the IT-IT folder you created before. Delete the existing setupres.dll.mui, rename SetupResDllMui_IT_IT to setupres.dll.mui . (If you absolutely need an Italian EULA as well, download the latest version of the Italian installer and extract EULA.RTF from its IT-IT folder into your IT-IT folder. Judging by the English EULA, the contents differ slightly between versions, but who really cares about the EULA anyway, right? ) To install MSE, execute epplauncher.exe. (If you want to re-pack your results into a single executable installer, search for sfx in 7-zip help.) Of course none of this would even be necessary if only Microsoft could be bothered to make proper unified installers that automatically launch in the OS language (or, even better, allow selecting the language at program startup). I mean, why not just do this if you have all 33 languages packed into the installer anyway?...

@glnz @dencorso The funny thing is that I don't even like to post references with that box thing (which, as I just discovered, is an iframe - ugh...), but since pasting a post link gets automatically converted to it, I just don't bother to change it every time, as the Link tool in the editor has its own idiosyncracies (at least in my case it forgets the clipboard contents, so I always have to go back and copy my text/URL again after having opened it - pretty annoying ). I really wish we could use BBCode here.

If you have the same Compatibility Pack installed, you can and should apply the same updates on both machines. The system may be 64-bit but Office and the Compatibility Pack would still be 32-bit. Also, what @dencorso already told you:

https://web.archive.org/web/20150922145904/download.microsoft.com/download/A/0/5/A05EF63F-F0FF-4D7F-9441-3BAFCCDED0F0/WindowsXP-KB955704-x86-ITA.exe

Thanks for discovering this! I don't use XP x64, so this obvious-in-hindsight difference never occurred to me. I added this point to the guide.

FYI, since probably not everyone here frequents the Office section and this is not something automatically offered to those of us with Office 2000/XP/2003 with Office 2007 Compatibility Pack:

With the latest patches out this Tuesday, Microsoft has completely removed Equation Editor from all still supported Office versions, so it's a very good idea to also remove it from older Office versions ASAP. I'm guessing this drastic measure has to do with the fact that Microsoft doesn't seem to have the source code for this bundled third-party application, and since it's been under ongoing attack even after the previous binary patch was issued for it, they decided that continuing to patch the binary just wasn't feasible. If your version of Office is still supported, simply apply the latest patches from Microsoft Update (see the CVE link below for manual downloads). For older versions like Office 2000/XP/2003, you can either remove this feature with the Office installer and mark it unavailable (as described below in the If you don't use Equation Editor section), or simply replace the existing EQNEDT32.EXE with a 0-size empty file still called EQNEDT32.EXE (this appears to be what the patches for newer Office versions do). See the following links for more details and Microsoft's suggestions for replacements of Equation Editor functionality. https://support.microsoft.com/en-us/help/4057882/error-when-editing-an-equation-in-office https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802 This post used to be titled HOWTO: Install Office 2007 Equation Editor security update (KB4011604. aka KB4011276) on Office 2000/XP/2003 and had the following contents: A remote code execution vulnerability was patched this month in Equation Editor, an Office component (CVE-2017-11882 | Microsoft Office Memory Corruption Vulnerability, Description of the security update for 2007 Microsoft Office Suite: November 28, 2017). Official patches are available only for Office 2007 and higher, but since it's a standalone component that hasn't changed since the year 2000, and Microsoft has simply applied a binary patch to the executable and resigned it, you can also use this patch with Office 2000, XP and 2003. NOTE: KB4011604 was initially released as KB4011276 for English and Chinese only. If you've already installed KB4011276, you don't need to install KB4011604, the Equation Editor payloads are byte-for-byte identical. If you prefer a statement from Microsoft (from the CVE link above): "Customers who have already installed the previously-released updates (4011276 or 2553204) do not need to take any further action." If you don't use Equation Editor, instead of updating it, you might want to remove it from your computer altogether. (Even if you don't have it installed right now, since it defaults to Installed on First Use, it's a good idea to explicitly deselect it in the Office installer.) Go to Control Panel > Add or Remove Programs, locate your Office 2000/XP/2003 installer and choose the Change option, then pick Add or Remove Features when the installer launces. Find Equation Editor in the component tree. The exact location may differ depending on your Office version, in my case (Office XP) it was under Office Tools. To disable its installation, or remove it from your computer if already installed, mark it as Not Available and complete the update. You should no longer have an Equation folder under (typically) C:\Program Files\Common Files\Microsoft Shared. If you do use Equation Editor, you'll have to update it manually. (Trying to run the installer, it'll just tell you that you don't have an applicable product installed.) To do this, you'll be needing 7-zip (or a similarly versatile unpacker). Get the patch either as an EXE installer from the Download Center (English; other languages direct links by @Bersaglio) or a CAB file from WU/Catalog (English) . Right-click on the downloaded file and choose to open it with 7-zip. (EXE only) Select [0], right-click, Open Inside. Select eqnedt32-[your-language].msp (e.g. eqnedt32-en-us.msp), right-click, Open Inside. Select PATCH_CAB, right-click, Open Inside. Extract EQNEDT32.EXE_[numeric language code] (e.g. EQNEDT32.EXE_1033) to a location of your choice and remove the numeric part from the file name, leaving you with EQNEDT32.EXE. Copy this file to your Equation Editor folder, (typically) at C:\Program Files\Common Files\Microsoft Shared\Equation, replacing the old EQNEDT32.EXE in there. (If you like, you can make a copy of the old version, but you can always restore it later by re-running the Office installer.) To make sure everything is kosher now, check EQNEDT32.EXE properties. The version should show 2017.8.14.0. (Note that if you use the Office installer in the future to change installed components or repair your installation, it may put back the old EQNEDT32.EXE and you'll have to manually replace it again.)

Right, because one person wrecking their system with updates is something that never happened with normal XP updates when it was still being supported... I don't want to be sarcastic, but I'll rather take a forum full of success stories spanning several years than something posted in July 2014 that very informatively says: Still, everyone is entitled to do with their system as they see fit, so anyone who doesn't trust these updates or experiences them causing problems can absolutely choose not to install them. It would be useful though to describe such problems in more detail to better forewarn others - and maybe even get help for solving them.

Unfortunately, they have. As was to be expected, the ealier September 2017 deadline was just a "clever" PR tactic, support will end when ESR 52 ends in June 2018. If you can come up with other (feasible) ways to work around this (with FF itself, without switching to New Moon), we'd all be happy to hear them! Some do. I don't have any specific recommendations to give out as I haven't used them, so I'll have leave it to you to investigate the add-ons site.

Thanks for checking this out, @Bersaglio! We (I and my "tester" ) weren't able to make this problem appear even when we turned our usual UA spoofing off, so I couldn't be sure. It's a little surprising that Facebook has started employing such simplistic measures, but I guess even they must sometimes cut back on their client-side scripting bloat . I'm guessing you suggested 57.0 to look more up to date, not because a lower version wouldn't work as well, as long as it's Win7+ ? BTW, I would suggest that those who are going to employ this work-around use a Firefox extension to manage the UA override (I myself use User Agent Switcher, there are many others), That's both because it's more convenient than manually tweaking about:config, and because without a visual indication somewhere in your toolbar you could end up forgetting about the fix and then get pretty confused if (in terms of likelihood, more like when) some other problem later crops up somewhere else because you're using a spoofed UA. EDIT: Since FB is a major site, I went ahead and added a note about this problem and its workaround to the OP.

I'm definitely under the impression that @JodyT sincerely believes in whatever he believes in at any given time (in the past: NT 6.x is an abomination and needs to die; at the moment: NT 5.x is an abomination and needs to die ). But in any case, I don't see why it's such a big deal that he gets to express his opinions in a sequestered thread. It's not like there aren't any arguments that could be made in favor of getting off XP, so if someone feels the need to keep making them even to a perfectly well informed audience, why nor just shrug it off without getting too aggravated about it?

@Dave-H, @heinoganda I'm not on Facebook myself, so I'm only able to check public videos, but all seem to be working fine for me. A family member using XP with Primetime on and Flash off is also able watch all FB videos in their feed. So it must be a change that's not rolled out to everyone/everything yet. In any case, I'm not sure what you guys mean by FB "dropping Primetime support", because AFAIK sites don't need any specific "Primetime support" to play normal HTML5 video in the browser, the plugin simply makes it so that the browser will advertise its capability to play MP4/H.264 and the various players don't care what exactly is providing it. Since you don't appear to be talking about videos with the actual Primetime DRM, the fact that Primetime is used to play them should be mostly transparent. (I say "mostly", because I'm sure there are ways to detect that the plugin is present if someone starts looking for it specifically, it's just that it shouldn't matter to anyone for ordinary videos.) Two things I can suggest are trying FB with a fresh clean profile + Primetime; and spoofing the user agent. I know there are extensions that have been screwed up by various degrees after being forced to move to the WebExtensions API, so if one of them is messing with page content incl. videos, you might have to downgrade it. And FB may have simplified its server-side logic to assume that ESR 52 on XP requires Flash for H.264, and is therefore serving different kinds of pages to it without bothering with detection.

Both commands work fine for me (with cmd), so right now I don't really have a clue why it should give you NTE_BAD_ALGID again (assuming you're running all three commands in the same environment).

I think you can just put [Solved] in front of the title to mark it as such (right, @dencorso?). I'm far from "insisting" on changing the title , I just thought what eventually got covered here was a bit more general than what the initial title would suggest and something like "makecert.exe tool quirks on Windows XP" might get more future readers to check it out. It was just a thought; and I'm definitely not suggesting that you were wrong to initially give the title maximum specificity when asking the question.

I used a regular Command Prompt.

You need to quote the attribute content and escape the quotes to get them passed to the command, no need to escape the comma itself. And you don't even need to quote for the shell when there are no spaces or special characters. All of these work for me: -n "CN=Litware,OU=\"Docs,Adatum\",DC=Fabrikam,DC=COM" -n CN=Litware,"OU=\"Docs,Adatum\"",DC=Fabrikam,DC=COM -n CN=Litware,OU=\"Docs,Adatum\",DC=Fabrikam,DC=COM (I actually didn't know about the comma thing, but fortunately this was the top result for googling "makecert comma". )

Thanks for the tip! Yet another naming suggestion: Lunar XPale (or just plain XPale), ex-Pale Moon for XP

@glnz Unless you have software with specific need for this upgraded TLS functionality (which currently doesn't work with IE, for example), you don't need to install it right now. it's not a security patch (not in the usual sense, anyway) and it has no direct bearing on the WiFi vulnerability (presumably addressed by KB4042723). It wouldn't be a problem to wait until becomes available on WU early next year; but it wouldn't be a problem if you installed it now, either. Totally up to you.

@roytam1 I've been meaning to get to building this on my own, so let me ask you this, to avoid reinventing the wheel: was it easy enough to get the builds working with the instructions on Pale Moon's site or did you have to jump through any hoops before everything clicked? It's been a while since I've built something as complex as a Mozilla-based browser, and I seem to recall people talking about having no small amount of trouble with such beasts (especially with Windows builds).

@DrWho3000 & @procrastistamper Adobe re-enabled access to the install package some time after it had disappeared, so currently the GUI method still works. It may disappear again at any time though (and not come back again), so I'm going to keep the manual method as the main one in the OP. As for your problems: as long as you have all the prefs set right (cOrReCt cAsE, no typos like %51.0%), both the GUI method and the manual method should currently work. I ran tests with 52.4.0 ESR and saw no issues with either process. Based on @roytam1's contribution, I thought maybe they'd changed things so that %CHANNEL% being esr would no longer work, but changing only %VERSION% was still sufficient. I believe you should still be able to install the plugin even if it later turns out it won't work properly (no SSE2, non-Intel, etc.) If something doesn't work with your everyday profile, create a new profile (with firefox -P) and try with that one. Disable automatic update checks - while I haven't been able to reproduce this, FF could run its auto-update while you're in the middle of things and mess things up for you. (Checking for updates without all the prefs set can leave you in an inconsistent state and you'd have to start from the beginning.) Since pre-existing plugins are initially enabled in a new profile, disable them all. Enter the preferences all in one go (copy&paste can avoid typos ) and don't fiddle with the Plugins page until you've added everything; best to close it beforehand, actually, to avoid an update check at the wrong time. If using the manual method, add all the preferences first, then close FF, then add the plugin files, then restart FF and verify. If it didn't take, make sure you've added the files in the right profile folder (open it from about:support). If still failing, recheck that all your prefs are still set the way you entered them and FF hasn't messed with them. Assuming you can get Primetime working with a clean profile, make sure you start the installation as fresh as possible on your existing profile. Go to about:config, search for gmp-eme-adobe and use the Reset menu item to remove all those prefs, then close FF, then delete the gmp-eme-adobe folder under your profile, then open FF and do everything just as you did with the new profile. If it still doesn't take, try to eliminate possible external interference (such AV blocking the plugin files, firewall blocking download attempts). This seems unlikely to affect Primetime installation, but you can try and see if disabling all your browser extensions changes anything. (They can definitely interfere with playback, for example I've seen Video DownloadHelper mess up chunked streaming (as opposed to playing a single MP4 file) with its hooks.) Can't really think of anything else that might help right now - it's a "works for me" situation after all. If all else fails, you could always try the custom Pale Moon XP builds with added MP4 playback capabilities @roytam1 and some others have been contributing.

@olspookishmagus No reward is necessary , but it might be useful to change the topic title into something more generally descriptive, since most of what we've discussed here isn't really about Powershell scripts.

Aha, so I wasn't that far off with my speculation prior to September Patch Tuesday - looking at file dates, the TLS fix had already been completed at that time, but for some reason it was held back for two regular release days. Thanks for keeping tabs on this, @heinoganda! According to Microsoft, It'll be on WU/WSUS as Optional starting January 16 and will turn Recommended on February 13. (Perhaps they'll fix IE and WinHTTP by the time to make it more useful.) Just so there's no confusion: Chrome was capable of TLS 1.2 on XP even before this fix. (relevant forum topic)