netcfgx.dll question

[nut-meg]

Sorry guys - I'm a CISSP wennie that has been trust into the NT world by a problem with a webvpn solution. When users connect it downloads a client but we have some PCs that the client fails because it can't find a drive that does not exist. The only common thread is that the netcfgx.dll is version 5.0.2195.7003. If I replace that with version 5.0.2195.6004 it works just fine. To complicate matters not everyone with 5.0.2195.7003 has the problem.

I'd like to understand:

where does netcfgx.dll come from - what would modify the rev?

Is there someplace I can learn what is different between the two to help identify exactly why this fails?

what, if any danger have I added by back reving to this older version?

Any thoughts on tests I could run to help with this issue. I have read here how to get a trace from netcfgx.dll and plan to do that as soon as I get my hands on one of these problem PCs but anything like that would be a huge help.

Thanks

[cluberti]

Netcfgx.dll is the network configuration dll, responsible for what it sounds like it's responsible for . The version you have that is giving problems (.7003) I believe comes from hotfix MS06-031, or KB917736 (http://support.microsoft.com/kb/917736). The version you have that is working properly I believe was included in SP3 for W2K, and includes quite a few vulnerabilities (including the RPC vulnerability from 917736) - I'd say contact the vendor to find out what is causing the issue, because it's probably not that file specifically (if it was, all of the machines with .7003 would exhibit the problem).

[nut-meg]

Thanks for the info, knowing where it came for is now even more important as I have discovered:

The PCs with .7003 that work have a different .dll the those that do not! A checksum of the two files turns out different.

It is possible using groupwise to see a plain text version of the file and there are differences despite the fact that the text in both indicates they are the same version. I am losing access to groupwise today, is there another app that can do this?

BTW - I can attach the two files here if anyone cares for their own couriosity.

I am trying to find out if this 'broken' version came from a different source & if so where. Why two files would have the same version number if they are different.

I'd love to know why this has never been a problem until we tried to impliment a web based vpn. Sadly the vpn vendor is just happy I solved the problem that they don't care why. Seems short-sighted to me but hey I'm not a multi-billion dollar giant.

[cluberti]

I'm not sure why they'd be different, unless one version is RTM and the other is GDR (perhaps zipping and posting them here will help). However, a solution that is probably best in your case is to install a clean W2K machine and install SP4 and then all hotfixes up to 917736 directly from the Microsoft site, then checksum the file on disk to see what version you have compared to the other two - the one that matches is the correct one, and script that hotfix, or that particular file to machines with the hotfix already installed, to all of the W2K machines on your network pronto . It'd take a bit more time, but you could be sure of what hotfix levels and file versions you have out there (sounds like the environment isn't very standard).