The File-Checker (HFSLIPFC) for HFSLIP

[Explorer09]

I think it's time for Mimo to sign up an account in GitHub, and host the file-checker there. How would that be?

At least for me, I can commit the code as soon as MS (and Adobe) release a new update, saving time for jvidal and other people.

[jvidal]

Excuse my ignorance, but what is github?

Yet another filesharing service? OR is it sumthin' else?

[Explorer09]

Excuse my ignorance, but what is github?

Yet another filesharing service? OR is it sumthin' else?

It's not just for file sharing, it's for code sharing.

Some of the open-source software host their source code there. And people can make code commits or file bugs easily in GitHub.

[jvidal]

Alright, thx for the info...

[dziubek]

Found on the Web:

Blackwingcat has found a new version for Root Certificates [November 2012] (KB931125) It's v37.0.2195.5

Link to his post:

http://www.msfn.org/...ost__p__1019445

Link to file:

http://www.download....en/rootsupd.exe

upd:

It's v37.0.2195.5

Edited November 22, 2012 by dziubek

[Mim0]

new file-checker for XP:

2012-11-22
- Added: KB2727528 (MS12-072: Windows Shell)
- Added: KB2761226 (MS12-075: Windows Kernel-Mode Drivers)
- Added: Adobe Flash Player 11.5.502.110
- Added: Malicious Software Removal Tool 4.14.6800.0
- Removed: KB2731847 (MS12-055: Windows Kernel-Mode Drivers, v2, replaced by KB2761226)
- Removed: Adobe Flash Player 11.4.402.287
- Removed: Malicious Software Removal Tool 4.13.6701.0

Download: HFSLIPFC v.2012/05/04 with WindowsXP-update-list v.2012/11/22

Regarding roots upd V37: could we trust this very-silent update? Should I add it to the list?

[dziubek]

Regarding roots upd V37: could we trust this very-silent update? Should I add it to the list?

info form this topic:http://www.ryanvm.net/forum/viewtopic.php?p=128896#128896

[Explorer09]

Regarding roots upd V37: could we trust this very-silent update? Should I add it to the list?

I think I should wait for a few days. MS didn't make an announcement about this update (yet). But, I can try installing it on a virtual machine and compare the difference.

EDIT: Here is my brief compare result.

(rootsupd.exe November 2012)

In "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates", 5 keys have been added by this update:

06143151E02B45DDBADD5D8E56530DAAE328CF90
0C628F5C5570B1C957FAFD383FB03D7B7DD7B9C6
585F7875BEE7433EB079EAAB7D05BB0F7AF2BCCC
EABDA240440ABBD694930A01D09764C6C2D77966
F138A330A4EA986BEB520BB11035876EFB9D7F1C

There are also 349 registry keys modified by this update in total:

342 keys in "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates",

1 key in "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates",

6 keys in "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates".

EDIT2:

I found another strange thing. Perhaps this is a bug in Microsoft, but the file modified date inside rootsupd.exe seems to be misleading or incorrect.

For example, between the April and the November update, only these files are changed: rootsupd.inf, updroots.exe, updroots.sst.

But two of the modified dates stay the same.

Files inside the new rootsupd.exe (November 2012):

05/31/2012  04:54 PM            91,136 ADVPACK.DLL
11/02/2012  02:24 PM            75,116 authroots.sst
08/29/2011  05:08 PM            16,562 delroots.sst
07/24/2012  03:44 PM             7,273 roots.sst
05/16/2011  03:16 PM             1,610 rootsupd.inf
06/01/2012  11:48 AM             6,656 updroots.exe
08/29/2011  05:08 PM           375,712 updroots.sst
05/31/2012  04:55 PM             2,272 W95INF16.DLL
05/31/2012  04:55 PM             4,608 W95INF32.DLL
               9 File(s)        580,945 bytes

Files inside the old rootsupd.exe (April 2012):

05/16/2011  02:52 PM            91,136 ADVPACK.DLL
04/06/2012  12:07 PM            75,116 authroots.sst
08/29/2011  05:08 PM            16,562 delroots.sst
03/14/2012  12:29 PM             7,273 roots.sst
05/16/2011  03:16 PM             1,610 rootsupd.inf
05/18/2011  02:01 PM             5,632 updroots.exe
08/29/2011  05:08 PM           368,180 updroots.sst
05/16/2011  02:53 PM             2,272 W95INF16.DLL
05/16/2011  02:53 PM             4,608 W95INF32.DLL
               9 File(s)        572,389 bytes

Edited November 23, 2012 by Explorer09

[ZEUS__]

@Explorer0. also two updroots.exe in packages have some diferences. bolded.

old one (April 2012):

:

5.632 bytes

5.1.2484.0

5.1.2484.0

Windows NT, Windows 32 bit

Application

İngilizce (A.B.D.), Unicode

5.1.2484.0 (main.010529-2005)

UPDROOTS

Microsoft® Windows® Operating System

5.1.2484.0

Microsoft Corporation

© Microsoft Corporation. All rights reserved.

UPDROOTS

UPDROOTS

new one (November 2012):

6.656 bytes

5.2.3790.4456

5.2.3790.4456

Debug, Private build

Windows NT, Windows 32 bit

Application

İngilizce (A.B.D.), Unicode

5.2.3790.4456 built by: dnsrv(ansaboor)

UPDROOTS

Microsoft® Windows® Operating System

5.2.3790.4456

Microsoft Corporation

© Microsoft Corporation. All rights reserved.

UPDROOTS

UPDROOTS

new one has a flag that Debug, Private build

Edited November 23, 2012 by ZEUS__

[Explorer09]

@Explorer0. also two updroots.exe in packages have some diferences. (sic) bolded.

....

new one has a flag that Debug, Private build

I knew the difference already, but you didn't notice that the new updroots.exe is bit-for-bit identical to the one inside the rvkroots.exe.

[ZEUS__]

@Explorer0. also two updroots.exe in packages have some diferences. (sic) bolded.

....

new one has a flag that Debug, Private build

I knew the difference already, but you didn't notice that the new updroots.exe is bit-for-bit identical to the one inside the rvkroots.exe.

you totally right, I just realized it sorry.

[dziubek]

I found an error on the page:

Bad location of the destination directory for the file WindowsXP-KB2761226-x86.reg.

It should be HFSVCPACK instead of HF

-----------------------------------------------------------

Running HFSLIPFC v.2012/05/04 at 2012-11-24 14:47:52,56

-----------------------------------------------------------

unknown: HF\WindowsXP-KB2761226-x86.reg

missing (S): HFSVCPACK\WindowsXP-KB2761226-x86.reg (Registry-File for MS12-075 (Windows Kernel-Mode Drivers))

[jvidal]

It's correct. The reg file goes in HFSVCPACK, not in HF.

[Explorer09]

It's correct. The reg file goes in HFSVCPACK, not in HF.

Only the latter (the file checker) is correct.

The web page really misses the line about the reg file going to HFSVCPACK.

[jvidal]

just a minor glitch. The important thing is the FC is correct.