Dave-H

Thanks!

Thanks, yes I have those versions of both files. Good to know where they came from!

Please be clear, there is no Service Pack 4 for Windows XP! There's nothing to find. All that happened, as far as I know, is that some later XP updates were installed as "SP4" updates on systems, but only in that their registry entries are listed under "SP4", and the xpsp4res.dll "Service Pack 4 Messages" file was installed. That almost certainly means that there was going to be a Service Pack 4 for XP at one time, but for whatever reason, Microsoft decided not to press ahead with it and issue it as an installable component.

KB2868626 contains version 5.131.2600.6459 of crypt32.dll, which is the one I've got. It also contains version 5.1.2600.6459 of xpsp4res.dll. My version of xpsp4res.dll is 5.1.2600.7651 however, so where would that have come from? Presumably a later "SP4" update, as it's only the "Service Pack 4 Messages" dll.

My rsaenh.dll is version 5.1.2600.7345.

Not here apparently.

I have quite a few updates which claim in the registry to be from "SP4" too, and have had for years. I suspect it refers to a notional Service Pack 4 for Windows XP which was mooted by Microsoft at one time but never actually issued.

I suspect that's because the free version of Malwarebytes does not offer realtime scanning, whereas the premium paid version does. The Windows XP Security Center probably only recognises realtime scanner programs as being AV programs.

Yes, sadly so. I was asking XPerceniol if the catalogue was actually working for them, as they had said that it was "empty". I don't think they realised that the home page of the catalogue does look pretty empty until you actually search for something!

Yes it does.

There's no point in doing it as it will apparently install but not actually do anything as the crypt32.dll file in the hotfix is older than the one already on the system, at least that was my experience. If you have 5.131.2600.6459 as I have, that is the latest (and presumably last) version for XP.

Thanks @i430VX, understood!

Well i430VX's installer appears to install it, but doesn't seem to produce any uninstall mechanism.

Well that's very interesting! So that tool does fetch updates and works on XP, presumably with the wsusscn2.cab that it downloaded, which shouldn't work on XP?!

I just tried out roytam's build of Serpent, and was puzzled to find that there appears to be no uninstallation option for it. It didn't appear in Add/Remove Programs. Is that normal? I just deleted its folders, is that the only way of uninstalling it or have I missed something? I used i430VX's installer to install it.

Thanks, good to know you're aware of this!

Keeping my fingers crossed for you!

Firefox 52.9 ESR tells me your installer file "contains a virus or malware", and I have to override this to download it. Malwarebytes says it's clean. A false positive obviously, but just thought I'd mention it!

Yes I could, but I'm not sure which one I would try! My instinct is to just let well alone!

Just for interest, I thought I would try out the "Portable Update" tool referenced in this post. It does seem to work fine still, and downloaded a new wsusscn2.cab file, containing updates from this month. The tool lists all my installed updates, and says I don't need any, which is almost certainly correct, but surely if it did decide I needed any, it wouldn't work anyway as that cab isn't SHA-1 signed? I would be interested to see what it would do if I tried to use it!

@XPerceniol Is the Microsoft Catalogue actually working for you? Just as an aside, you don't have to use Internet Explorer for the catalogue, just in case you weren't aware, it should work in any browser. Windows/Microsoft Update needs IE as it uses ActiveX controls, which don't work anywhere else, but the catalogue is a standard site.

Wow, thank you so much for all that information! Sounds like Serpent is the one to try then when I inevitably have to finally abandon Firefox 52 ESR. Good to know that there are alternatives to the Mozilla Sync system, as I would really miss that facility if I had to lose it. Keeping bookmarks and saved passwords in sync is my main concern.

I didn't appear to have KB968730 installed on my machine, so I downloaded it and installed it. It appeared to install OK, and its registry entries are now there, but a system file check didn't reveal any changed files. It should change CRYPT32.DLL. The version in the hotfix is 5.131.2600.5779. When I checked I found that I already have version 5.131.2600.6459, which is presumably why the hotfix didn't do anything! Where would that later version have come from though, would it have been a POSReady update?

I suspect it's time to read the last rites over the Microsoft Update and Windows Update web sites. As I said earlier, I'm surprised that they haven't been completely taken offline by now! AFAIK there's nothing left now served by them which is still in support. What do you mean by "the catalogue is empty"? Do you mean that if you put a known existing KB number in the search field and search for it, you get no results? The screen grab you posted is quite normal until you do a search for something.

I ran "sigcheck -i wsusscn2.cab" on the November 2019 version of wsusscn2.cab, using sigcheck 2.30 on Windows 10, and got exactly the same result as I did when I ran the same command with the same files on XP, still no SHA-2 information, so it looks as if it isn't OS dependant. Comparing the results from the November 2019 cab and the July 2020 cab, there seems to be very little difference, apart from the serial number and thumbprint, as you would expect, and the dates on the first certificate displayed, which are later of course on the latter file. Both have certificates apparently past their expiry dates. Everything else seems to be identical, which raises more questions as to why one of them works for me and the other doesn't!