KB891861 showing up in windows update

[bgray]

Hi all,

I created a win2k sp4 install cd using HFSLIP and the list at http://users.telenet.be/tc76/winup/_win2k.html

(selecting all components in groups "SP4" and "Browsing", and also "GDI+", "User profile hive cleanup service" and "root certificate update").

I didn't want to mess about with installing genuine advantage or any of the windows/office update components, so that was installed on my first visit to windows update from within the new install.

Anyways, Windows Update tells me I need to install KB891861 (also, detail view in Windows Update shows that this one is 7.7MB not 31.2MB like the Windows2000-KB891861-v2-x86-ENU.EXE I put in my /HF folder).

MBSA 2.0.1 and qfecheck seem to agree with Windows Update (in that I don't have KB891861 installed properly).

Help please? :/

HFSLIP log:

				 This file is automatically generated by HFSLIP
						HFSLIP is for personal use only
						 Copyright(C) TommyP 2005-2007

============================HOW TO REPORT A PROBLEM============================

	   If running into problems, refer to http://hfslip.org/support.html

	  HFSLIP support forum: http://msfn.org/board/index.php?showforum=129

===============================================================================

HFSLIP Version - 1.6.1 build 70712b

HFSLIP Path - C:\Data\win2k_sp5_project\hfslip\

OS in SOURCESS - 2000 SP4 English

MSIE Version - 2KIE6

Service Pack Slipstreamed

Drivers - DRIVER.CAB Updated

CD Install Path - Default

CDTAG - CDROM_NT.5

===============================================================================
Files in your FIX folder:

Files in your HF folder:
aolsupp.exe
gdiplus_dnld.exe
IE6.0sp1-KB905495-Windows2000-x86-ENU.exe
IE6.0sp1-KB918439-Windows-2000-XP-x86-ENU.exe
IE6.0sp1-KB929969-Windows2000-x86-ENU.exe
IE6.0sp1-KB933566-Windows2000-x86-ENU.exe
KB832414_MSXML2.5_x86.exe
MDAC_TYP.EXE
MDAC281-KB927779-x86-ENU.exe
msxml2sp6-kb887606-x86-enu.exe
msxml4-KB927978-enu.exe
OE6.0sp1-KB923694-Windows2000-x86-ENU.exe
rootsupd_fe44934fd80dd11fec2f0f9b24431658a4f6d589.exe
W2KSP4_EN.EXE
Windows2000-KB842773-x86-ENU.EXE
Windows2000-KB891861-v2-x86-ENU.EXE
Windows2000-KB893756-x86-ENU.EXE
Windows2000-KB896358-x86-ENU.EXE
Windows2000-KB896423-x86-ENU.EXE
Windows2000-KB899587-x86-ENU.EXE
Windows2000-KB899589-x86-ENU.EXE
Windows2000-KB900725-x86-ENU.EXE
Windows2000-KB901017-x86-ENU.EXE
Windows2000-KB901214-x86-ENU.EXE
Windows2000-KB904706-v2-x86-ENU.exe
Windows2000-KB905414-x86-ENU.EXE
Windows2000-KB905749-x86-ENU.EXE
Windows2000-KB908506-x86-ENU.EXE
Windows2000-KB908519-x86-ENU.EXE
Windows2000-KB908531-v2-x86-ENU.EXE
Windows2000-KB911280-v2-x86-ENU.EXE
Windows2000-KB913580-x86-ENU.EXE
Windows2000-KB914388-x86-ENU.EXE
Windows2000-KB914389-x86-ENU.EXE
Windows2000-KB917008-x86-ENU.EXE
Windows2000-KB917344-56-x86-ENU.EXE
Windows2000-KB917537-x86-ENU.EXE
Windows2000-KB917736-x86-ENU.EXE
Windows2000-KB917953-x86-ENU.EXE
Windows2000-KB918118-x86-ENU.EXE
Windows2000-KB920213-x86-ENU.EXE
Windows2000-KB920670-x86-ENU.EXE
Windows2000-KB920683-x86-ENU.EXE
Windows2000-KB920685-x86-ENU.EXE
Windows2000-KB921398-x86-ENU.EXE
Windows2000-KB922582-x86-ENU.EXE
Windows2000-KB923191-x86-ENU.EXE
Windows2000-KB923414-x86-ENU.EXE
Windows2000-KB923980-x86-ENU.EXE
Windows2000-KB924191-v2-x86-ENU.EXE
Windows2000-KB924270-x86-ENU.EXE
Windows2000-KB924667-x86-ENU.EXE
Windows2000-KB925902-x86-ENU.EXE
Windows2000-KB926121-x86-ENU.EXE
Windows2000-KB926122-x86-ENU.EXE
Windows2000-KB926247-x86-ENU.EXE
Windows2000-KB926436-x86-ENU.EXE
Windows2000-KB927891-x86-ENU.EXE
Windows2000-KB928843-x86-ENU.EXE
Windows2000-KB930178-x86-ENU.EXE
Windows2000-KB931784-x86-ENU.EXE
Windows2000-KB932168-x86-ENU.EXE
Windows2000-KB935839-x86-ENU.EXE
Windows2000-KB935840-x86-ENU.EXE
Windows2000-KB935843-x86-ENU.EXE
WindowsInstaller-KB893803-v2-x86.exe
Windows-KB909520-v1.000-x86-ENU.exe
WindowsMedia6-KB925398-v2-x86-ENU.exe
WindowsMedia-KB911564-x86-ENU.exe
WindowsRightsManagementServicesSP2-KB917275-Client-ENU-x86.exe
WindowsServer2003-KB931836-x86-ENU.exe
WindowsXP-Windows2000-Script56-KB917344-x86-enu.exe
msxml2.msi
msxml6_x86.msi

Files in your HFCABS folder:
_IE6_HFSLIP.CAB
_IE6b_HFSLIP.CAB
_OE6_HFSLIP.CAB
BRANDING.CAB
IEW2K_1.CAB
IEW2K_2.CAB
IEW2K_3.CAB
IEW2K_4.CAB
MAILNEWS.CAB
OEEXCEP.CAB
SCRIPTEN.CAB
swflash.cab
WAB.CAB

Files in your HFSVCPACK folder:

Files in your HFSVCPACK_SW1 folder:

Files in your HFSVCPACK_SW2 folder:

Files in your HFGUIRUNONCE folder:
UPHClean-Setup.msi

Files in your HFTOOLS folder:
7za.exe
bbie.exe
CDIMAGE.EXE

===============================================================================
HFSLIP run time: 16m01s

WU1.txt:

Scan performed Tue Jul 24 13:45:03 2007
Shavlik Technologies Network Security Hotfix Checker, 3.86
Using XML data version = 2007.7.10.0  Last modified on 2007/07/10.


----------------------------
TESTORG-CEC420D (192.168.0.171)
----------------------------

	* WINDOWS 2000 SP4

	Information
	All necessary hotfixes have been applied.

	* INTERNET EXPLORER 6 SP1

	Information
	All necessary hotfixes have been applied.

[bgray]

So i've been trying to troubleshoot this; It seems to me that the mssecure.xml in hfnetchk doesn't have an entry for KB891861.. So obviously it can't detect that it's missing.

MBSA in commandline mode does however detect it as missing.

On the other hand, the registry entries in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Update Rollup 1\ seem to be ok.

Edited July 24, 2007 by bgray

[Tomcat76]

Your list looks OK to me, except for Windows2000-KB917344-56-x86-ENU.EXE but that's due to an error in my hotfix list. I just fixed that. But that's certainly not the source of the problem.

Can you tell me the exact size in bytes for the rollup update you have (right-click and select Properties)? It should be 32 724 472 bytes.

If you have WinRAR or 7-zip installed, also right-click the rollup update and select "Extract to Windows2000-KB891861-v2-x86-ENU\". See if an error message is displayed while doing so.

[bgray]

Hi TomCat76,

My Windows2000-KB891861-v2-x86-ENU.EXE file is 32,724,472 bytes. It extracts ok.. The MD5sum is 2e4abce7410618af9e307d6fa4d3e2b2

After investigating a bit more (using a MS VPC2007 VM before and after running windows update on a fresh system made from the new win2ksp4+ install cd), I can draw the following conclusions:

Running Windows Update on a VM with a fresh install of the hfslip-created win2ksp4 image, I am asked to install a 7.7 MB update which calls itself kb891861-v2 (is it possible that windows update can create partial updates? otherwise I don't see where this file is coming from).

After installation, the following files are added:

C:\WINNT\inf\hfsecper.inf
(502 bytes)

C:\WINNT\inf\hfsecupd.inf
(502 bytes)

C:\WINNT\Driver Cache\i386\ntkrnlmp.exe and C:\WINNT\system32\dllcache\NTKRNLMP.EXE
(1,714,240 bytes, version 5.0.2195.7045-ENU)

C:\WINNT\Driver Cache\i386\ntkrpamp.exe and C:\WINNT\system32\dllcache\NTKRPAMP.EXE
(1,735,488 bytes, version 5.0.2195.7045-ENU)

C:\WINNT\system32\dllcache\osloader.exe
(196,880 bytes, not a PE file)

C:\WINNT\system32\spupdsvc.exe
(22,752 bytes, version 6.1.22.4-ENU)

the following files are updated:

C:\WINNT\system32\sfcfiles.dll and C:\WINNT\system32\dllcache\sfcfiles.dll
(old file: 971,024 bytes, version 5.0.2195.6717-ENU)
(new file: 973,072 bytes, version 5.0.2195.7038-ENU)

There are a lot of other files in the update, but they are either older versions or the same version (I made sure to check that the old versions in the update do not replace the newer versions in the install).

The loader/kernel file additions seem to be because I am running this VM on a dualcore pc.. Although win2k only shows one cpu in the task manager, windows update may be able to detect that it needs to install the multiprocessor kernel? Dunno.

I'm not sure what spupdsvc.exe does, probably some kind of windows update thing? (In the file version display I get "SRV03_QFE.031113-0918" for this file).

It would be nice if MBSA/hfnetfix had a verboser/debug mode where one could see which file version errors cause an update to be flagged as missing... :/

EDIT: copying the updated sfcfiles.dll from the install which went through windows update (and got that kb891861v2-like patch) into the fresh VM, makes the fresh VM pass windows update.

So it seems that is the culprit.

Now to determine which hotfix replaces the kb891861v2 version which an old version of sfcfiles.dll.

Edited July 24, 2007 by bgray

[Tomcat76]

That's strange. Version 5.0.2195.6717 is the original 2K SP4 file.

Can you check in SOURCESS\I386 immediately after running HFSLIP that SFCFILES.DL_ was updated? It should have the current date/time.

[bgray]

It seems that there is both an SFCFILES.DLL (version 5.0.2195.7038) and a SFCFILES.DL_ (version 5.0.2195.6717) in the /HFSLIP/SOURCESS/i386 folder.

They have the same filetime..

Btw do you think there is something that needs to be done regarding hfsecper.inf and hfsecupd.inf? I can see that hfslip integrates them into i386 (contains hfsecper.in_ and hfsecudp.in_), but they aren't installed during normal installation -> but a normal installation of kb891861-v2 seems to install these files in any case..

Edited July 24, 2007 by bgray

[Tomcat76]

That's interesting. Do you have both files in your original source too? If so, I suggest you remove the uncompressed one.

Those two hfsec* files you mentioned are a bit of a mystery. They are supposed to be run at different stages but there are no multiple installation stages in a slipstreaming context. I deliberately ignored the installation commands so nothing wrong can be done. There are no errors during Windows setup, WU is clean and (most importantly) Windows is running fine, so I left things like that.

HFSLIP also ignores ris.vbs. As far as I can see, that file is useless because the "NullSessionPipes" registry entry already has the intended value and the OE 5.5 string doesn't need to be updated for Q823353 (cumulative Outlook Express update from July 2004 which is embedded in the rollup update) because the string updates are no longer required (they were when IE and OE updates were released in Type 2 format).

[bgray]

Yes, my source CD did have both sfcfiles.dll and sfcfiles.dl_ in /i386. (both version 5.0.2195.1).

Removing sfcfiles.dll and re-running hfslip resulted in a perfect install cd, which passes windows update on first boot.

Thanks for the assistance!

It's weird though.. The source CD is an official SP1 integrated CD ("select" volume license -- serial SP1SEL_EN), so it would seem that the inclusion of both sfcfiles.dll and sfcfiles.dl_ was a mistake on microsoft's part..

[AgiHammerklau]

Hi !

I don´t know if this still applies or just, if you use the FIXFOLDER (found on vorck.com):

EDIT

Removed, obsolete !

Agi

EDIT

I know, that´s a dumb question, but did you thoroughly check, that all folders and files in the source were not writeprotected, by en- and disabling the writeprotection for the folder, subfolders and files ?

Agi

Edited July 26, 2007 by AgiHammerklau

[bgray]

Agi:

I'm running it in a VM, which despite my earlier theory regarding ntkrnlmp.exe etc. does not see any second CPU, so I am only using the original kb891861v2 single-processor HAL etc.

As far as I can see, my \sourcess\i386\halmacpi.dl_ is the one from kb891861v2, not the one from SP4. It seems that hfslip does not keep the halmacpi.dl_ from SP4..

All source files are write-enabled as far as I can tell.

Anyways, hfslip is able to replace the files from the source, it just doesn't replace an intermediate version with the final version from the kb891861v2 hotfix.. The specific reason is to me unknown and probably not important since i've got it working now

I would like to know though, does anyone else's win2k sp0/1/2/3/4 cd's have a \i386\sfcfiles.dll?

Edited July 25, 2007 by bgray

[Tomcat76]

I don't have the uncompressed sfcfiles.dll in my source.

That info on FDV's site is way obsolete. HFSLIP hasn't deleted halmacpi.dll and scsiport.sys anymore in well over a year. Removal of scsiport.sys was abandoned shortly after v2 of the rollup was released and halmacpi.dll is kept since ~December 2005 combined with the inclusion of the omitted reg hack for HT/dual core CPUs.

[AgiHammerklau]

@Tomcat76

I have edited the post.

Hoped somehow, FDV had a little time to spare, to update his page.

Checked the running system, backup and testpartion.

There is no uncompressed sfcfiles except, in the running system.

And HFSLIP is running, even though, it´s not recomended, to run anything besides...

@bgray

So it comes finally down to configuration of the the VM.

All of them (VM) have to be told, what they should emulate and what system they´re running on.

And even QEMU does not completely take the drivers, all others just take the ones, of the running system.

The source CD is an official SP1 integrated CD ("select" volume license -- serial SP1SEL_EN)

???

Agi

Edited July 26, 2007 by AgiHammerklau