Blaster Worm Patch (823980) Wont Install

[Kyonn Gowans]

Every time I go to the Windows update site for Winxp it list the Blaster
worm patch under "critical updates and service packs" I download and install
the patch, after it says that the installation is complete I restart the
computer but when I go back to the update site it still list the patch as
being needed. I have done this 6 or 7 times over the past few days any help
would be greatly appreciated.

[Michelle]

Prevent Prompting for Hotfix KB823980
Download the script from Kelly's site:
http://www.kellys-korner-xp.com/regs_edits/xp_kb823980_fix.vbs


"Kyonn Gowans" > skrev i en meddelelse =
...
> Every time I go to the Windows update site for Winxp it list the =
Blaster
> worm patch under "critical updates and service packs" I download and =
install
> the patch, after it says that the installation is complete I restart =
the
> computer but when I go back to the update site it still list the patch =
as
> being needed. I have done this 6 or 7 times over the past few days any =
help
> would be greatly appreciated.
>=20
>

[Doug Knox MS-MVP]

If you have manually, or used a utility to, remove the Hotfix backup files
and associated Registry issues for Add/Remove Programs, then see:
http://www.kellys-korner-xp.com/xp_tweaks.htm Line 266, Left Column.
Prevent Prompting for Hotfix KB823980. Note: This fix will only work if
KB823980 is actually installed.

--
Doug Knox, MS-MVP Windows XP/ Windows Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"Kyonn Gowans" > wrote in message
...
> Every time I go to the Windows update site for Winxp it list the Blaster
> worm patch under "critical updates and service packs" I download and
install
> the patch, after it says that the installation is complete I restart the
> computer but when I go back to the update site it still list the patch as
> being needed. I have done this 6 or 7 times over the past few days any
help
> would be greatly appreciated.
>
>

[T.C.]

Go to Control Panel, Add or Remove Programs, if

Windows XP Hotfix KB823980

is listed, then it's already installed.
--
T.C.
Pay it forward...

Delete [REMOVE] from email address to respond by email

"Kyonn Gowans" > wrote in message
...
> Every time I go to the Windows update site for Winxp it list the Blaster
> worm patch under "critical updates and service packs" I download and
install
> the patch, after it says that the installation is complete I restart the
> computer but when I go back to the update site it still list the patch as
> being needed. I have done this 6 or 7 times over the past few days any
help
> would be greatly appreciated.
>
>


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.512 / Virus Database: 309 - Release Date: 8/19/2003

[Kyonn Gowans]

> Go to Control Panel, Add or Remove Programs, if
> Windows XP Hotfix KB823980
>
> is listed, then it's already installed.
> --
> T.C.
> Pay it forward...

It's not listed there, but it says it was installed successfully each time I
download it. Any idea about what's going on?

[Larc]

On Tue, 26 Aug 2003 13:37:39 -0800, Kyonn Gowans pondered exceedingly, then took
quill in hand and carefully composed...

| > Go to Control Panel, Add or Remove Programs, if
| > Windows XP Hotfix KB823980
| >
| > is listed, then it's already installed.
| > --
| > T.C.
| > Pay it forward...
|
| It's not listed there, but it says it was installed successfully each time I
| download it. Any idea about what's going on?

I don't recall that 823980 showed up in my uninstall list. Go to your Windows
folder and check to see if KB823980.log is there. If it is, 823980 has been
installed. Just make sure there's not a file called KB823980Uninst.log as well.
If it is, that means 823980 has been uninstalled.

If you regularly delete your log files, this info probably won't help.

Larc



§§§ - Please raise temperature of mail to reply by e-mail - §§§

[Kyonn Gowans]

> I don't recall that 823980 showed up in my uninstall list. Go to your
Windows
> folder and check to see if KB823980.log is there. If it is, 823980 has
been
> installed. Just make sure there's not a file called KB823980Uninst.log as
well.
> If it is, that means 823980 has been uninstalled.


Yep it's there, so I can safely assume that the patch has been installed?

[Torgeir Bakken (MVP)]

Kyonn Gowans wrote:

> > I don't recall that 823980 showed up in my uninstall list. Go to your
> > Windows folder and check to see if KB823980.log is there. If it is,
> > been 823980 has installed. Just make sure there's not a file called
> > KB823980Uninst.log as well. If it is, that means 823980 has been
> > uninstalled.
>
> Yep it's there, so I can safely assume that the patch has been installed?

Not really. The only sure way is to check that the correct files are in place.

Verify that the files Ole32.dll, Rpcrt4.dll and Rpcss.exe in your
System32 folder is corresponding with the values here check that
the fix is really installed:

(be sure to look up the correct OS section)
http://support.microsoft.com/default.aspx?kbid=823980

If they do, the patch is installed and there is no point in installing it
again.


--
torgeir
Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of the 1328 page
Scripting Guide: http://www.microsoft.com/technet/scriptcenter

[T.C.]

It sure is listed in my Add or Remove Programs as:

Windows XP Hotfix - KB823980

There's a REMOVE button as well...
--
T.C.
Pay it forward...

Delete [REMOVE] from email address to respond by email

"Larc" > wrote in message
...
>
> I don't recall that 823980 showed up in my uninstall list. Go to your
Windows
> folder and check to see if KB823980.log is there. If it is, 823980 has
been
> installed. Just make sure there's not a file called KB823980Uninst.log as
well.
> If it is, that means 823980 has been uninstalled.
>
> If you regularly delete your log files, this info probably won't help.
>
> Larc



---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.512 / Virus Database: 309 - Release Date: 8/19/2003

[Larc]

On Tue, 26 Aug 2003 14:02:32 -0800, Kyonn Gowans pondered exceedingly, then took
quill in hand and carefully composed...

|
| > I don't recall that 823980 showed up in my uninstall list. Go to your
| Windows
| > folder and check to see if KB823980.log is there. If it is, 823980 has
| been
| > installed. Just make sure there's not a file called KB823980Uninst.log as
| well.
| > If it is, that means 823980 has been uninstalled.
|
|
| Yep it's there, so I can safely assume that the patch has been installed?

I've heard it's supposed to be a good sign, but each subsequent effort to
install a hotfix may overwrite the original log. One program that claims to be
able to report whether hotfixes have been installed is Belarc Advisor. It's a
free program and is available here:

http://www.belarc.com/free_download.html

When you open the program after installation, look under "Installed Microsoft
Hotfixes."

Larc



§§§ - Please raise temperature of mail to reply by e-mail - §§§

[Kelly]

Close Windows Explorer, run the edit on line 257 which includes the prompt
for the patch once your system has been cleaned. This script removes all
variants of the W32.Blaster.Worm (original, b and c) and will inform you
whether or not the patch is already installed.
http://www.kellys-korner-xp.com/xp_tweaks.htm. Direct download:
http://www.kellys-korner-xp.com/regs_edits/msblast.vbs

Prevent Prompting for Hotfix KB823980 (Line 266)
http://www.kellys-korner-xp.com/xp_tweaks.htm

List of installed Hotfixes (Line 193)
http://www.kellys-korner-xp.com/xp_tweaks.htm

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com
http://www.kellys-korner-xp.com/xp_abc.htm
http://www.kellys-korner-xp.com/xp_tweaks.htm

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


> > > I don't recall that 823980 showed up in my uninstall list. Go to your
> > > Windows folder and check to see if KB823980.log is there. If it is,
> > > been 823980 has installed. Just make sure there's not a file called
> > > KB823980Uninst.log as well. If it is, that means 823980 has been
> > > uninstalled.
> >
> > Yep it's there, so I can safely assume that the patch has been
installed?

[PCyr]

Off topic question... how the heck do you and Doug Knox know all these
fixes?!?
Like seriously, I know more about computers than anyone I personally know,
and I can kinda make sense of some basic registry things, but how do you two
know *that* much about the OS? (Maybe since I haven't had any
post-secondary training on computers I'm just making a big deal of it.)


--
Check out http://www.kellys-korner-xp.com for amazing tweaks and fixes

Member of "Newsgroups are for everyone"

Email address is fake to prevent SPAM.
Real email address is pcyr2000 AT hotmail DOT com
Change the obvious to the obvious.
------------------
"Kelly" > wrote in message
...
> Close Windows Explorer, run the edit on line 257 which includes the prompt
> for the patch once your system has been cleaned. This script removes all
> variants of the W32.Blaster.Worm (original, b and c) and will inform you
> whether or not the patch is already installed.
> http://www.kellys-korner-xp.com/xp_tweaks.htm. Direct download:
> http://www.kellys-korner-xp.com/regs_edits/msblast.vbs
>
> Prevent Prompting for Hotfix KB823980 (Line 266)
> http://www.kellys-korner-xp.com/xp_tweaks.htm
>
> List of installed Hotfixes (Line 193)
> http://www.kellys-korner-xp.com/xp_tweaks.htm
>
> --
> All the Best,
> Kelly
>
> MS-MVP Win98/XP
> [AE-Windows® XP]
>
> Troubleshooting Windows XP
> http://www.kellys-korner-xp.com
> http://www.kellys-korner-xp.com/xp_abc.htm
> http://www.kellys-korner-xp.com/xp_tweaks.htm
>
> Top 10 Frequently Asked Questions and Answers
> http://www.kellys-korner-xp.com/top10faqs.htm
>
>
> > > > I don't recall that 823980 showed up in my uninstall list. Go to
your
> > > > Windows folder and check to see if KB823980.log is there. If it is,
> > > > been 823980 has installed. Just make sure there's not a file called
> > > > KB823980Uninst.log as well. If it is, that means 823980 has been
> > > > uninstalled.
> > >
> > > Yep it's there, so I can safely assume that the patch has been
> installed?
>

[SuperGumby]

I guess 'special interest' in most cases.

then, when a small business server 4.0 to 4.5 upgrade failed and I contacted
PSS and eventually got an SBS engineer on the job, I was AMAZED that it
seemed he knew the NT registry, with all the extras added, like the back of
his hand.

"PCyr" > wrote in message
...
> Off topic question... how the heck do you and Doug Knox know all these
> fixes?!?
> Like seriously, I know more about computers than anyone I personally know,
> and I can kinda make sense of some basic registry things, but how do you
two
> know *that* much about the OS? (Maybe since I haven't had any
> post-secondary training on computers I'm just making a big deal of it.)
>
>
> --
> Check out http://www.kellys-korner-xp.com for amazing tweaks and fixes
>
> Member of "Newsgroups are for everyone"
>
> Email address is fake to prevent SPAM.
> Real email address is pcyr2000 AT hotmail DOT com
> Change the obvious to the obvious.
> ------------------
> "Kelly" > wrote in message
> ...
> > Close Windows Explorer, run the edit on line 257 which includes the
prompt
> > for the patch once your system has been cleaned. This script removes all
> > variants of the W32.Blaster.Worm (original, b and c) and will inform you
> > whether or not the patch is already installed.
> > http://www.kellys-korner-xp.com/xp_tweaks.htm. Direct download:
> > http://www.kellys-korner-xp.com/regs_edits/msblast.vbs
> >
> > Prevent Prompting for Hotfix KB823980 (Line 266)
> > http://www.kellys-korner-xp.com/xp_tweaks.htm
> >
> > List of installed Hotfixes (Line 193)
> > http://www.kellys-korner-xp.com/xp_tweaks.htm
> >
> > --
> > All the Best,
> > Kelly
> >
> > MS-MVP Win98/XP
> > [AE-Windows® XP]
> >
> > Troubleshooting Windows XP
> > http://www.kellys-korner-xp.com
> > http://www.kellys-korner-xp.com/xp_abc.htm
> > http://www.kellys-korner-xp.com/xp_tweaks.htm
> >
> > Top 10 Frequently Asked Questions and Answers
> > http://www.kellys-korner-xp.com/top10faqs.htm
> >
> >
> > > > > I don't recall that 823980 showed up in my uninstall list. Go to
> your
> > > > > Windows folder and check to see if KB823980.log is there. If it
is,
> > > > > been 823980 has installed. Just make sure there's not a file
called
> > > > > KB823980Uninst.log as well. If it is, that means 823980 has been
> > > > > uninstalled.
> > > >
> > > > Yep it's there, so I can safely assume that the patch has been
> > installed?
> >
>
>

[PCyr]

humm, I knew someone like that. He was fixing our computer (in DOS), one
screen would come up, and before I could read the first line, he would have
already had sent a command. His hands just flew like crazy.

--
Check out http://www.kellys-korner-xp.com for amazing tweaks and fixes

Member of "Newsgroups are for everyone"

Email address is fake to prevent SPAM.
Real email address is pcyr2000 AT hotmail DOT com
Change the obvious to the obvious.
------------------
"SuperGumby" > wrote in message
...
> I guess 'special interest' in most cases.
>
> then, when a small business server 4.0 to 4.5 upgrade failed and I
contacted
> PSS and eventually got an SBS engineer on the job, I was AMAZED that it
> seemed he knew the NT registry, with all the extras added, like the back
of
> his hand.
>
> "PCyr" > wrote in message
> ...
> > Off topic question... how the heck do you and Doug Knox know all these
> > fixes?!?
> > Like seriously, I know more about computers than anyone I personally
know,
> > and I can kinda make sense of some basic registry things, but how do you
> two
> > know *that* much about the OS? (Maybe since I haven't had any
> > post-secondary training on computers I'm just making a big deal of it.)
> >
> >
> > --
> > Check out http://www.kellys-korner-xp.com for amazing tweaks and fixes
> >
> > Member of "Newsgroups are for everyone"
> >
> > Email address is fake to prevent SPAM.
> > Real email address is pcyr2000 AT hotmail DOT com
> > Change the obvious to the obvious.
> > ------------------
> > "Kelly" > wrote in message
> > ...
> > > Close Windows Explorer, run the edit on line 257 which includes the
> prompt
> > > for the patch once your system has been cleaned. This script removes
all
> > > variants of the W32.Blaster.Worm (original, b and c) and will inform
you
> > > whether or not the patch is already installed.
> > > http://www.kellys-korner-xp.com/xp_tweaks.htm. Direct download:
> > > http://www.kellys-korner-xp.com/regs_edits/msblast.vbs
> > >
> > > Prevent Prompting for Hotfix KB823980 (Line 266)
> > > http://www.kellys-korner-xp.com/xp_tweaks.htm
> > >
> > > List of installed Hotfixes (Line 193)
> > > http://www.kellys-korner-xp.com/xp_tweaks.htm
> > >
> > > --
> > > All the Best,
> > > Kelly
> > >
> > > MS-MVP Win98/XP
> > > [AE-Windows® XP]
> > >
> > > Troubleshooting Windows XP
> > > http://www.kellys-korner-xp.com
> > > http://www.kellys-korner-xp.com/xp_abc.htm
> > > http://www.kellys-korner-xp.com/xp_tweaks.htm
> > >
> > > Top 10 Frequently Asked Questions and Answers
> > > http://www.kellys-korner-xp.com/top10faqs.htm
> > >
> > >
> > > > > > I don't recall that 823980 showed up in my uninstall list. Go
to
> > your
> > > > > > Windows folder and check to see if KB823980.log is there. If it
> is,
> > > > > > been 823980 has installed. Just make sure there's not a file
> called
> > > > > > KB823980Uninst.log as well. If it is, that means 823980 has been
> > > > > > uninstalled.
> > > > >
> > > > > Yep it's there, so I can safely assume that the patch has been
> > > installed?
> > >
> >
> >
>
>

[Kelly]

Hi there,

We don't "know" them, we create them. :o) Neither Doug nor I have had any
secondary training on computers. And as SG mentioned in part, in all of
"my" cases this has to do with special interest. You give me an issue and I
will try to re-create it and find the cause and fix.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com
http://www.kellys-korner-xp.com/xp_abc.htm
http://www.kellys-korner-xp.com/xp_tweaks.htm

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"PCyr" > wrote in message
...
> Off topic question... how the heck do you and Doug Knox know all these
> fixes?!?
> Like seriously, I know more about computers than anyone I personally know,
> and I can kinda make sense of some basic registry things, but how do you
two
> know *that* much about the OS? (Maybe since I haven't had any
> post-secondary training on computers I'm just making a big deal of it.)
>
>
> --
> Check out http://www.kellys-korner-xp.com for amazing tweaks and fixes
>
> Member of "Newsgroups are for everyone"
>
> Email address is fake to prevent SPAM.
> Real email address is pcyr2000 AT hotmail DOT com
> Change the obvious to the obvious.
> ------------------
> "Kelly" > wrote in message
> ...
> > Close Windows Explorer, run the edit on line 257 which includes the
prompt
> > for the patch once your system has been cleaned. This script removes all
> > variants of the W32.Blaster.Worm (original, b and c) and will inform you
> > whether or not the patch is already installed.
> > http://www.kellys-korner-xp.com/xp_tweaks.htm. Direct download:
> > http://www.kellys-korner-xp.com/regs_edits/msblast.vbs
> >
> > Prevent Prompting for Hotfix KB823980 (Line 266)
> > http://www.kellys-korner-xp.com/xp_tweaks.htm
> >
> > List of installed Hotfixes (Line 193)
> > http://www.kellys-korner-xp.com/xp_tweaks.htm
> >
> > --
> > All the Best,
> > Kelly
> >
> > MS-MVP Win98/XP
> > [AE-Windows® XP]
> >
> > Troubleshooting Windows XP
> > http://www.kellys-korner-xp.com
> > http://www.kellys-korner-xp.com/xp_abc.htm
> > http://www.kellys-korner-xp.com/xp_tweaks.htm
> >
> > Top 10 Frequently Asked Questions and Answers
> > http://www.kellys-korner-xp.com/top10faqs.htm
> >
> >
> > > > > I don't recall that 823980 showed up in my uninstall list. Go to
> your
> > > > > Windows folder and check to see if KB823980.log is there. If it
is,
> > > > > been 823980 has installed. Just make sure there's not a file
called
> > > > > KB823980Uninst.log as well. If it is, that means 823980 has been
> > > > > uninstalled.
> > > >
> > > > Yep it's there, so I can safely assume that the patch has been
> > installed?
> >
>
>

[Torgeir Bakken (MVP)]

Kelly wrote:

> Close Windows Explorer, run the edit on line 257 which includes the prompt
> for the patch once your system has been cleaned. This script removes all
> variants of the W32.Blaster.Worm (original, b and c) and will inform you
> whether or not the patch is already installed.
> http://www.kellys-korner-xp.com/xp_tweaks.htm. Direct download:
> http://www.kellys-korner-xp.com/regs_edits/msblast.vbs

Hi

Msblst.vbs is doing testing on the registry value
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\KB823980\DisplayName",
and I don't define that as a sure test.

If the dll's are downgraded later on by some rough installation, or the hotfix
installation fails some way that the registry value is updated, but not the
files , this test will give a false positive (but I agree it will not happen
often). Also, when WinXP SP2 / Win2k SP5 is released, this test will be
incorrect.


Here is a script that checks on the version level on the rpcrt4.dll file on
WinXP and Win2k (it will e.g. handle future service packs ok as well):


Set oShell = CreateObject("WScript.Shell")
Set oFSO = CreateObject("Scripting.FileSystemObject")

sOSVer = GetOsVersionNumber()
sSPVer = GetSPNumberSW()


If sOSVer < 4 Then
MsgBox "Win9X/ME does not need the RPC patch!",, "RPC flaw check"

ElseIf sOSVer = 5 Then
' Win2k
If sSPVer < 2 Then
MsgBox "Win2k SP or better needed to install the RPC patch!", _
vbCritical, "RPC flaw check"
WScript.Quit
Else
sNeededRpcVer = "5.0.2195.6753"
End If

ElseIf sOSVer = 5.1 Then
' WinXP
If sSPVer > 0 Then
sNeededRpcVer = "5.1.2600.1230"
Else
sNeededRpcVer = "5.1.2600.109"
End If

Else
MsgBox "This script only will only check Win2k and WinXP computers",, _
"RPC flaw check"
End If

Set sWinSysDir = oFSO.GetSpecialFolder(1)

sResult = CompareFileVersions(sNeededRpcVer, sWinSysDir & "\rpcrt4.dll")


If sResult = "FirstFileNewest" Then
MsgBox "You do *NOT* have the RPC update installed. Please install it", _
vbOkOnly, "Important"
Else
MsgBox "You already have the RPC update installed.", vbOkOnly, "Finished"
End If


Function GetOsVersionNumber()
'''''''''''''''''''''''''''''''''''''''''''''''''' ''''''''''''''''
' Determines OS by reading reg val & comparing to known values
' OS version number returned as number of type double:
' Windows 2k: 5
' Windows XP: 5.1
' Windows Server 2003: 5.2
' Windows x: >5.2

' Note: Decimal point returned is based on the Locale setting
' of the computer, so it might be returned as 5,1 as well.
'
'''''''''''''''''''''''''''''''''''''''''''''''''' ''''''''''''''''
Dim sOStype, sOSversion

On Error Resume Next
sOStype = oShell.RegRead(_
"HKLM\SYSTEM\CurrentControlSet\Control\ProductOptio ns\ProductType")
If Err.Number<>0 Then
' Hex(Err.Number)="80070002"
' - Could not find this key, OS must be Win9x
Err.Clear

sOStype = oShell.RegRead(_
"HKLM\SOFTWARE\Microsoft\Windows" & _
"\CurrentVersion\VersionNumber")

Select Case sOStype
Case "4.00.950"
sOSversion = 1 ' Windows 95A
Case "4.00.1111"
Dim sSubVersion
sSubVersion = oShell.RegRead(_
"HKLM\SOFTWARE\Microsoft\Windows" & _
"\CurrentVersion\SubVersionNumber")
Select Case sSubVersion
Case " B"
sOSversion = 1 ' Windows 95B
Case " C"
sOSversion = 1 ' Windows 95C
Case Else
sOSversion = 1 ' Unknown Windows 95
End Select
Case "4.03.1214"
sOSversion = 1 ' Windows 95B
Case "4.10.1998"
sOSversion = 2 ' Windows 98
Case "4.10.2222"
sOSversion = 2 ' Windows 98SE
Case "4.90.3000"
sOSversion = 3 ' Windows Me
Case Else
sOSversion = 1 ' Unknown W9x/Me
End Select
Else ' OS is NT based
sOSversion = oShell.RegRead(_
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentVersion")
If Err.Number<>0 Then
GetOsVersion = "Unknown NTx"
' Could not determine NT version
Exit Function ' >>>
End If
End If

' Setting Locale to "en-us" to be indifferent to country settings.
' CDbl might err else
SetLocale "en-us"
GetOsVersionNumber = CDbl(sOSversion)
End Function


Function GetSPNumberSW()
'''''''''''''''''''''''''''''''''''''''''''''''''' ''''''''''''''''
' Determines Service Pack number by reading reg val CSDVersion in
' HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDVersion
'
' CSDVersion in System\CCS is updated AFTER a reboot when
' installing a SP
'
'''''''''''''''''''''''''''''''''''''''''''''''''' ''''''''''''''''
Dim sOStype, sOSversion, iSPNumber, aSPNumber

On Error Resume Next
sOStype = oShell.RegRead(_
"HKLM\SYSTEM\CurrentControlSet\Control\ProductOptio ns\ProductType")
If Err.Number<>0 Then
' Hex(Err.Number)="80070002"
' - Could not find this key, OS must be Win9x
Err.Clear
GetSPNumberSW = "W9x"
Exit Function ' >>>
End If

iSPNumber = oShell.RegRead(_
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDVersion")
If Err.Number<>0 Then
GetSPNumberSW = 0
' Could not determine Service Pack
Exit Function ' >>>
End If

' CSDVersion is e.g. "Service Pack 2"
aSPNumber = Split(iSPNumber)
GetSPNumberSW = Cint(aSPNumber(2))
End Function


Function CompareFileVersions(sFileInfo1, sFileInfo2)
Dim sFileVer1, sFileVer2, aFileVer1, aFileVer2, iCount, iDateDiff

If sFileInfo1 = "" Or sFileInfo2 = "" Then
MsgBox _
"CompareFileVersions error: Invalid argument, empty argument given!", _
vbExclamation, "Machine Logon script"
Err.Raise 5 'Invalid procedure call or argument
End If


If oFSO.FileExists(sFileInfo1) Then
sFileVer1 = oFSO.GetFileVersion(sFileInfo1)
Elseif UBound(Split(sFileInfo1, ".")) = 3 Then
sFileVer1 = sFileInfo1
Else
MsgBox "CompareFileVersions error: 1. argument is not an existing file " _
& "or correct file version format: " & sFileInfo1, _
vbExclamation, "Machine Logon script"
Err.Raise 5 'Invalid procedure call or argument
End If

If oFSO.FileExists(sFileInfo2) Then
sFileVer2 = oFSO.GetFileVersion(sFileInfo2)
Elseif UBound(Split(sFileInfo2, ".")) = 3 Then
sFileVer2 = sFileInfo2
Else
MsgBox "CompareFileVersions error: 2. argument is not an existing file " & _

"or correct file version format: " & sFileInfo2, _
vbExclamation, "Machine Logon script"
Err.Raise 5 'Invalid procedure call or argument
End If

If sFileVer1 <> "" And sFileVer2 <> "" Then
If sFileVer1 = sFileVer2 Then
CompareFileVersions = "SameVersion"
Else
aFileVer1 = Split(sFileVer1, ".")
aFileVer2 = Split(sFileVer2, ".")
For iCount = 0 To 3
If CInt(aFileVer1(iCount)) > CInt(aFileVer2(iCount)) Then
CompareFileVersions = "FirstFileNewest"
Exit For
ElseIf CInt(aFileVer1(iCount)) < CInt(aFileVer2(iCount)) Then
CompareFileVersions = "SecondFileNewest"
Exit For
Else
CompareFileVersions = "UnknownStatus"
End If
Next
End If

Elseif sFileVer1 <> "" And sFileVer2 = "" Then
CompareFileVersions = "FirstFileNewest"
Elseif sFileVer1 = "" And sFileVer2 <> "" Then
CompareFileVersions = "SecondFileNewest"
Else
iDateDiff = DateDiff("s", oFSO.GetFile(sFileInfo1).DateLastModified, _
oFSO.GetFile(sFileInfo2).DateLastModified)
If iDateDiff < 0 Then
CompareFileVersions = "FirstFileNewest"
ElseIf iDateDiff > 0 Then
CompareFileVersions = "SecondFileNewest"
Else
CompareFileVersions = "SameVersion"
End If
End If
End Function


--
torgeir
Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of the 1328 page
Scripting Guide: http://www.microsoft.com/technet/scriptcenter

[T.C.]

I can't agree more. A client had the Blaster worm before there was any info
about it. It took me a half hour to find and fix the problem manually. As
time goes by, and I gain more and more knowledge about the OS, fixes become
easier using the processes of elimination and deduction. But, it helps to
have a "special interest" as Kelly wrote. I like problem solving. It's
like "Dr. Watson, the game is afoot."
--
T.C.
Pay it forward...

Delete [REMOVE] from email address to respond by email

"Kelly" > wrote in message
...
> Hi there,
>
> We don't "know" them, we create them. :o) Neither Doug nor I have had
any
> secondary training on computers. And as SG mentioned in part, in all of
> "my" cases this has to do with special interest. You give me an issue and
I
> will try to re-create it and find the cause and fix.
>
> --
> All the Best,
> Kelly
>
> MS-MVP Win98/XP
> [AE-Windows® XP]
>
> Troubleshooting Windows XP
> http://www.kellys-korner-xp.com
> http://www.kellys-korner-xp.com/xp_abc.htm
> http://www.kellys-korner-xp.com/xp_tweaks.htm
>
> Top 10 Frequently Asked Questions and Answers
> http://www.kellys-korner-xp.com/top10faqs.htm
>
>
> "PCyr" > wrote in message
> ...
> > Off topic question... how the heck do you and Doug Knox know all these
> > fixes?!?
> > Like seriously, I know more about computers than anyone I personally
know,
> > and I can kinda make sense of some basic registry things, but how do you
> two
> > know *that* much about the OS? (Maybe since I haven't had any
> > post-secondary training on computers I'm just making a big deal of it.)
> >
> >
> > --
> > Check out http://www.kellys-korner-xp.com for amazing tweaks and fixes
> >
> > Member of "Newsgroups are for everyone"
> >
> > Email address is fake to prevent SPAM.
> > Real email address is pcyr2000 AT hotmail DOT com
> > Change the obvious to the obvious.
> > ------------------
> > "Kelly" > wrote in message
> > ...
> > > Close Windows Explorer, run the edit on line 257 which includes the
> prompt
> > > for the patch once your system has been cleaned. This script removes
all
> > > variants of the W32.Blaster.Worm (original, b and c) and will inform
you
> > > whether or not the patch is already installed.
> > > http://www.kellys-korner-xp.com/xp_tweaks.htm. Direct download:
> > > http://www.kellys-korner-xp.com/regs_edits/msblast.vbs
> > >
> > > Prevent Prompting for Hotfix KB823980 (Line 266)
> > > http://www.kellys-korner-xp.com/xp_tweaks.htm
> > >
> > > List of installed Hotfixes (Line 193)
> > > http://www.kellys-korner-xp.com/xp_tweaks.htm
> > >
> > > --
> > > All the Best,
> > > Kelly
> > >
> > > MS-MVP Win98/XP
> > > [AE-Windows® XP]
> > >
> > > Troubleshooting Windows XP
> > > http://www.kellys-korner-xp.com
> > > http://www.kellys-korner-xp.com/xp_abc.htm
> > > http://www.kellys-korner-xp.com/xp_tweaks.htm
> > >
> > > Top 10 Frequently Asked Questions and Answers
> > > http://www.kellys-korner-xp.com/top10faqs.htm
> > >
> > >
> > > > > > I don't recall that 823980 showed up in my uninstall list. Go
to
> > your
> > > > > > Windows folder and check to see if KB823980.log is there. If it
> is,
> > > > > > been 823980 has installed. Just make sure there's not a file
> called
> > > > > > KB823980Uninst.log as well. If it is, that means 823980 has been
> > > > > > uninstalled.
> > > > >
> > > > > Yep it's there, so I can safely assume that the patch has been
> > > installed?
> > >
> >
> >
>


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.512 / Virus Database: 309 - Release Date: 8/19/2003

[Kelly]

Thanks for the feedback, Torgeir. And geezz, what a script that is! :o)

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com
http://www.kellys-korner-xp.com/xp_abc.htm
http://www.kellys-korner-xp.com/xp_tweaks.htm

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Torgeir Bakken (MVP)" > wrote in message
...
> Kelly wrote:
>
> > Close Windows Explorer, run the edit on line 257 which includes the
prompt
> > for the patch once your system has been cleaned. This script removes all
> > variants of the W32.Blaster.Worm (original, b and c) and will inform you
> > whether or not the patch is already installed.
> > http://www.kellys-korner-xp.com/xp_tweaks.htm. Direct download:
> > http://www.kellys-korner-xp.com/regs_edits/msblast.vbs
>
> Hi
>
> Msblst.vbs is doing testing on the registry value
>
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\KB823980\DisplayNa
me",
> and I don't define that as a sure test.
>
> If the dll's are downgraded later on by some rough installation, or the
hotfix
> installation fails some way that the registry value is updated, but not
the
> files , this test will give a false positive (but I agree it will not
happen
> often). Also, when WinXP SP2 / Win2k SP5 is released, this test will be
> incorrect.
>
>
> Here is a script that checks on the version level on the rpcrt4.dll file
on
> WinXP and Win2k (it will e.g. handle future service packs ok as well):
>
>
> Set oShell = CreateObject("WScript.Shell")
> Set oFSO = CreateObject("Scripting.FileSystemObject")
>
> sOSVer = GetOsVersionNumber()
> sSPVer = GetSPNumberSW()
>
>
> If sOSVer < 4 Then
> MsgBox "Win9X/ME does not need the RPC patch!",, "RPC flaw check"
>
> ElseIf sOSVer = 5 Then
> ' Win2k
> If sSPVer < 2 Then
> MsgBox "Win2k SP or better needed to install the RPC patch!", _
> vbCritical, "RPC flaw check"
> WScript.Quit
> Else
> sNeededRpcVer = "5.0.2195.6753"
> End If
>
> ElseIf sOSVer = 5.1 Then
> ' WinXP
> If sSPVer > 0 Then
> sNeededRpcVer = "5.1.2600.1230"
> Else
> sNeededRpcVer = "5.1.2600.109"
> End If
>
> Else
> MsgBox "This script only will only check Win2k and WinXP computers",,
_
> "RPC flaw check"
> End If
>
> Set sWinSysDir = oFSO.GetSpecialFolder(1)
>
> sResult = CompareFileVersions(sNeededRpcVer, sWinSysDir & "\rpcrt4.dll")
>
>
> If sResult = "FirstFileNewest" Then
> MsgBox "You do *NOT* have the RPC update installed. Please install it",
_
> vbOkOnly, "Important"
> Else
> MsgBox "You already have the RPC update installed.", vbOkOnly,
"Finished"
> End If
>
>
> Function GetOsVersionNumber()
> '''''''''''''''''''''''''''''''''''''''''''''''''' ''''''''''''''''
> ' Determines OS by reading reg val & comparing to known values
> ' OS version number returned as number of type double:
> ' Windows 2k: 5
> ' Windows XP: 5.1
> ' Windows Server 2003: 5.2
> ' Windows x: >5.2
>
> ' Note: Decimal point returned is based on the Locale setting
> ' of the computer, so it might be returned as 5,1 as well.
> '
> '''''''''''''''''''''''''''''''''''''''''''''''''' ''''''''''''''''
> Dim sOStype, sOSversion
>
> On Error Resume Next
> sOStype = oShell.RegRead(_
> "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptio ns\ProductType")
> If Err.Number<>0 Then
> ' Hex(Err.Number)="80070002"
> ' - Could not find this key, OS must be Win9x
> Err.Clear
>
> sOStype = oShell.RegRead(_
> "HKLM\SOFTWARE\Microsoft\Windows" & _
> "\CurrentVersion\VersionNumber")
>
> Select Case sOStype
> Case "4.00.950"
> sOSversion = 1 ' Windows 95A
> Case "4.00.1111"
> Dim sSubVersion
> sSubVersion = oShell.RegRead(_
> "HKLM\SOFTWARE\Microsoft\Windows" & _
> "\CurrentVersion\SubVersionNumber")
> Select Case sSubVersion
> Case " B"
> sOSversion = 1 ' Windows 95B
> Case " C"
> sOSversion = 1 ' Windows 95C
> Case Else
> sOSversion = 1 ' Unknown Windows 95
> End Select
> Case "4.03.1214"
> sOSversion = 1 ' Windows 95B
> Case "4.10.1998"
> sOSversion = 2 ' Windows 98
> Case "4.10.2222"
> sOSversion = 2 ' Windows 98SE
> Case "4.90.3000"
> sOSversion = 3 ' Windows Me
> Case Else
> sOSversion = 1 ' Unknown W9x/Me
> End Select
> Else ' OS is NT based
> sOSversion = oShell.RegRead(_
> "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentVersion")
> If Err.Number<>0 Then
> GetOsVersion = "Unknown NTx"
> ' Could not determine NT version
> Exit Function ' >>>
> End If
> End If
>
> ' Setting Locale to "en-us" to be indifferent to country settings.
> ' CDbl might err else
> SetLocale "en-us"
> GetOsVersionNumber = CDbl(sOSversion)
> End Function
>
>
> Function GetSPNumberSW()
> '''''''''''''''''''''''''''''''''''''''''''''''''' ''''''''''''''''
> ' Determines Service Pack number by reading reg val CSDVersion in
> ' HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDVersion
> '
> ' CSDVersion in System\CCS is updated AFTER a reboot when
> ' installing a SP
> '
> '''''''''''''''''''''''''''''''''''''''''''''''''' ''''''''''''''''
> Dim sOStype, sOSversion, iSPNumber, aSPNumber
>
> On Error Resume Next
> sOStype = oShell.RegRead(_
> "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptio ns\ProductType")
> If Err.Number<>0 Then
> ' Hex(Err.Number)="80070002"
> ' - Could not find this key, OS must be Win9x
> Err.Clear
> GetSPNumberSW = "W9x"
> Exit Function ' >>>
> End If
>
> iSPNumber = oShell.RegRead(_
> "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDVersion")
> If Err.Number<>0 Then
> GetSPNumberSW = 0
> ' Could not determine Service Pack
> Exit Function ' >>>
> End If
>
> ' CSDVersion is e.g. "Service Pack 2"
> aSPNumber = Split(iSPNumber)
> GetSPNumberSW = Cint(aSPNumber(2))
> End Function
>
>
> Function CompareFileVersions(sFileInfo1, sFileInfo2)
> Dim sFileVer1, sFileVer2, aFileVer1, aFileVer2, iCount, iDateDiff
>
> If sFileInfo1 = "" Or sFileInfo2 = "" Then
> MsgBox _
> "CompareFileVersions error: Invalid argument, empty argument
given!", _
> vbExclamation, "Machine Logon script"
> Err.Raise 5 'Invalid procedure call or argument
> End If
>
>
> If oFSO.FileExists(sFileInfo1) Then
> sFileVer1 = oFSO.GetFileVersion(sFileInfo1)
> Elseif UBound(Split(sFileInfo1, ".")) = 3 Then
> sFileVer1 = sFileInfo1
> Else
> MsgBox "CompareFileVersions error: 1. argument is not an existing file
" _
> & "or correct file version format: " & sFileInfo1, _
> vbExclamation, "Machine Logon script"
> Err.Raise 5 'Invalid procedure call or argument
> End If
>
> If oFSO.FileExists(sFileInfo2) Then
> sFileVer2 = oFSO.GetFileVersion(sFileInfo2)
> Elseif UBound(Split(sFileInfo2, ".")) = 3 Then
> sFileVer2 = sFileInfo2
> Else
> MsgBox "CompareFileVersions error: 2. argument is not an existing file
" & _
>
> "or correct file version format: " & sFileInfo2, _
> vbExclamation, "Machine Logon script"
> Err.Raise 5 'Invalid procedure call or argument
> End If
>
> If sFileVer1 <> "" And sFileVer2 <> "" Then
> If sFileVer1 = sFileVer2 Then
> CompareFileVersions = "SameVersion"
> Else
> aFileVer1 = Split(sFileVer1, ".")
> aFileVer2 = Split(sFileVer2, ".")
> For iCount = 0 To 3
> If CInt(aFileVer1(iCount)) > CInt(aFileVer2(iCount)) Then
> CompareFileVersions = "FirstFileNewest"
> Exit For
> ElseIf CInt(aFileVer1(iCount)) < CInt(aFileVer2(iCount)) Then
> CompareFileVersions = "SecondFileNewest"
> Exit For
> Else
> CompareFileVersions = "UnknownStatus"
> End If
> Next
> End If
>
> Elseif sFileVer1 <> "" And sFileVer2 = "" Then
> CompareFileVersions = "FirstFileNewest"
> Elseif sFileVer1 = "" And sFileVer2 <> "" Then
> CompareFileVersions = "SecondFileNewest"
> Else
> iDateDiff = DateDiff("s", oFSO.GetFile(sFileInfo1).DateLastModified, _
> oFSO.GetFile(sFileInfo2).DateLastModified)
> If iDateDiff < 0 Then
> CompareFileVersions = "FirstFileNewest"
> ElseIf iDateDiff > 0 Then
> CompareFileVersions = "SecondFileNewest"
> Else
> CompareFileVersions = "SameVersion"
> End If
> End If
> End Function
>
>
> --
> torgeir
> Microsoft MVP Scripting and WMI, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of the 1328 page
> Scripting Guide: http://www.microsoft.com/technet/scriptcenter
>
>

[Kelly]

Same here, TC. I had a family member who had all of the symptoms two days
before msblast was even recognized or better said brought public.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com
http://www.kellys-korner-xp.com/xp_abc.htm
http://www.kellys-korner-xp.com/xp_tweaks.htm

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"T.C." > wrote in message
...
> I can't agree more. A client had the Blaster worm before there was any
info
> about it. It took me a half hour to find and fix the problem manually.
As
> time goes by, and I gain more and more knowledge about the OS, fixes
become
> easier using the processes of elimination and deduction. But, it helps to
> have a "special interest" as Kelly wrote. I like problem solving. It's
> like "Dr. Watson, the game is afoot."
> --
> T.C.
> Pay it forward...
>
> Delete [REMOVE] from email address to respond by email
>
> "Kelly" > wrote in message
> ...
> > Hi there,
> >
> > We don't "know" them, we create them. :o) Neither Doug nor I have had
> any
> > secondary training on computers. And as SG mentioned in part, in all of
> > "my" cases this has to do with special interest. You give me an issue
and
> I
> > will try to re-create it and find the cause and fix.
> >
> > --
> > All the Best,
> > Kelly
> >
> > MS-MVP Win98/XP
> > [AE-Windows® XP]
> >
> > Troubleshooting Windows XP
> > http://www.kellys-korner-xp.com
> > http://www.kellys-korner-xp.com/xp_abc.htm
> > http://www.kellys-korner-xp.com/xp_tweaks.htm
> >
> > Top 10 Frequently Asked Questions and Answers
> > http://www.kellys-korner-xp.com/top10faqs.htm
> >
> >
> > "PCyr" > wrote in message
> > ...
> > > Off topic question... how the heck do you and Doug Knox know all these
> > > fixes?!?
> > > Like seriously, I know more about computers than anyone I personally
> know,
> > > and I can kinda make sense of some basic registry things, but how do
you
> > two
> > > know *that* much about the OS? (Maybe since I haven't had any
> > > post-secondary training on computers I'm just making a big deal of
it.)
> > >
> > >
> > > --
> > > Check out http://www.kellys-korner-xp.com for amazing tweaks and fixes
> > >
> > > Member of "Newsgroups are for everyone"
> > >
> > > Email address is fake to prevent SPAM.
> > > Real email address is pcyr2000 AT hotmail DOT com
> > > Change the obvious to the obvious.
> > > ------------------
> > > "Kelly" > wrote in message
> > > ...
> > > > Close Windows Explorer, run the edit on line 257 which includes the
> > prompt
> > > > for the patch once your system has been cleaned. This script removes
> all
> > > > variants of the W32.Blaster.Worm (original, b and c) and will inform
> you
> > > > whether or not the patch is already installed.
> > > > http://www.kellys-korner-xp.com/xp_tweaks.htm. Direct download:
> > > > http://www.kellys-korner-xp.com/regs_edits/msblast.vbs
> > > >
> > > > Prevent Prompting for Hotfix KB823980 (Line 266)
> > > > http://www.kellys-korner-xp.com/xp_tweaks.htm
> > > >
> > > > List of installed Hotfixes (Line 193)
> > > > http://www.kellys-korner-xp.com/xp_tweaks.htm
> > > >
> > > > --
> > > > All the Best,
> > > > Kelly
> > > >
> > > > MS-MVP Win98/XP
> > > > [AE-Windows® XP]
> > > >
> > > > Troubleshooting Windows XP
> > > > http://www.kellys-korner-xp.com
> > > > http://www.kellys-korner-xp.com/xp_abc.htm
> > > > http://www.kellys-korner-xp.com/xp_tweaks.htm
> > > >
> > > > Top 10 Frequently Asked Questions and Answers
> > > > http://www.kellys-korner-xp.com/top10faqs.htm
> > > >
> > > >
> > > > > > > I don't recall that 823980 showed up in my uninstall list. Go
> to
> > > your
> > > > > > > Windows folder and check to see if KB823980.log is there. If
it
> > is,
> > > > > > > been 823980 has installed. Just make sure there's not a file
> > called
> > > > > > > KB823980Uninst.log as well. If it is, that means 823980 has
been
> > > > > > > uninstalled.
> > > > > >
> > > > > > Yep it's there, so I can safely assume that the patch has been
> > > > installed?
> > > >
> > >
> > >
> >
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.512 / Virus Database: 309 - Release Date: 8/19/2003
>