MS03-026

[K L]

I have installed MS03-026 on my machine several time
Still everytime I go to windows update page, it asks me to install it
It appears everytime in the critical list
What should I do?
Why is it not installing properly ?
Is it because my computer is already infected by msblast ? Is the virus
disallowing this patch from getting installed ?

 

[Nicholas]

K L --

Questions regarding Windows Update issues should be addressed to the
experts in the Windows Update newsgroup. Many solutions to Windows
Update issues are currently posted in that specialized newsgroup.

The "Official" Windows Update newsgroup:
news://msnews.microsoft.com/microsoft.public.windowsupdate


--
Nicholas

----------------------------------------------------------------------------------


| I have installed MS03-026 on my machine several time
| Still everytime I go to windows update page, it asks me to install it
| It appears everytime in the critical list
| What should I do?
| Why is it not installing properly ?
| Is it because my computer is already infected by msblast ? Is the virus
| disallowing this patch from getting installed ?
|
|
|

 

[Kelly]

Hi,

Run the script on line 257. It will verify if the patch is installed.
http://www.kellys-korner-xp.com/xp_tweaks.htm

For update issues check here under Updates:

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm

 

[Kelly]

Wrong line, Jay. ) You need the 257 RPC script. Or better yet, here you
go:

This script removes all variants of the W32.Blaster.Worm (original, b and c)
and will inform you whether or not the patch is already installed. Direct
download: http://www.kellys-korner-xp.com/regs_edits/msblast.vbs

However, speaking about line 258, that is to let you know if you are running
32 or 64 bit. Open the VBS in notepad and read the message for 64 bit
users. ) All in fun, but the script does work.
/xp_tweaks.htm

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm

 

[Jay O'Brien]

Whoops, we were both posting at the same time!

I ran the vbs script. It did nothing at first, as I use
Netscape as a Browser. I used IE and it ran ok.

I got "No Repairs Made" and "The script did not find the
W32.Blaster.Worm file, your system has not been cleaned."

Then it gave me an opportunity to download still another
copy of the patch. That's all I need.

My systems are NOT infected. The patch has been installed
on all. Windows Update keeps telling me to install it
again. And again. And again.

Jay

 

[KathyB]

Kelly,
I get the same messages as Jay when I run your vbs script, Is your script
supposed to come up with a box that says the patch is installed? (Because it
doesn't...just gives a link to download it) I already have installed it 3
times (once from the automatic update and twice from from the windows update
site).
It seems to be in my registry. And it shows up as a successful install 3
times on my what's installed list.

Kathy

 

[Kelly]

Hi Kathy,

Yes, the exact message should read:

You already have the patch for the Blaster Worm exploit installed.

/xp_tweaks.htm

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm

 

[KathyB]

Kelly,

Thanks for getting back so quickly.
I just tried to reinstall it again, as the update site said I needed
it,,,and it seemed to install. I now have 4 instances of "successful"
installations of 82390 on my what's installed log

Then I ran your vbs script again....and I still didn't get the message that
it's installed. :-(
It's in my registry (dated as of the first date I installed it, Aug. 8).
When I went to verify the file information in the registry, I noticed my
version number is different from the version number in the KB article.

Should I delete ir from the registry, and try again? (If should, I would
need instructions on how to delete it)

 

[KathyB]

Kelly,

Oooops I went back to the KB article and rechecked my version number,
and I do have the correct ones for XP home. So it is in my registry with
all the correct file info.

Any light you can shed on this would sure be appreciated!

Kathy

Kelly,

Thanks for getting back so quickly.
I just tried to reinstall it again, as the update site said I needed
it,,,and it seemed to install. I now have 4 instances of "successful"
installations of 82390 on my what's installed log

Then I ran your vbs script again....and I still didn't get the message that
it's installed. :-(
It's in my registry (dated as of the first date I installed it, Aug. 8).
When I went to verify the file information in the registry, I noticed my
version number is different from the version number in the KB article.

Should I delete ir from the registry, and try again? (If should, I would
need instructions on how to delete it)

Hi Kathy,

Yes, the exact message should read:

You already have the patch for the Blaster Worm exploit installed.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

 

[Kelly]

Hi Kathy,

Export the key(s) where this is listed in the registry and this key if it is
not the same and send them to me via email:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall

/xp_tweaks.htm

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm

Kelly,

Thanks for getting back so quickly.
I just tried to reinstall it again, as the update site said I needed
it,,,and it seemed to install. I now have 4 instances of "successful"
installations of 82390 on my what's installed log

Then I ran your vbs script again....and I still didn't get the message that
it's installed. :-(
It's in my registry (dated as of the first date I installed it, Aug. 8).
When I went to verify the file information in the registry, I noticed my
version number is different from the version number in the KB article.

Should I delete ir from the registry, and try again? (If should, I would
need instructions on how to delete it)

Hi Kathy,

Yes, the exact message should read:

You already have the patch for the Blaster Worm exploit installed.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

 

[Doug Knox MS-MVP]

Kath,

Kelly and I took a look at the REG files you sent her. After a little
research, it was found that the Windows Update routine was looking for the
following Registry key.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KB823
980

It doesn't have to have anything in it, but it does have to exist. Kelly
has posted a small script on her site,
www.kellys-korner-xp.com/xp_tweaks.htm, Line 266, Left Column that will
create this key for you. After you run the script, check Windows Updates,
and it should no longer prompt for this update. By the way, did you
happen to use my Hotfix Backup Removal Utility? Or did you clean out the
Add/Remove Programs entries manually?

 

[KathyB]

Kelly
Thanks for your help via email.

Kathy
PS Now your vbs script notifies me that I have the patch installed.

 

[KathyB]

Doug - Kelly sent me the reg file, and now Windows Update does recognize
that I have the patch
installed

And yes, come to think of it, I had recently used your Hotfix Backup Removal
Utility...and that's when the update site started prompting me.

Thanks so much to you and Kelly for your help!

Kathy
****

 

[Doug Knox MS-MVP]

Kathy,

Ok, thanks for confirming that. I'll be updating that program today or
tomorrow to use a different method of keeping the hot fixes from showing in
Add/Remove Programs, while still doing its job. That update should be out
today or tomorrow.

 

[Kelly]

Great, glad to hear it Kathy and you are most welcome. )

For others with the same issue:

Prevent Prompting for Hotfix KB823980 (Line 266)
http://www.kellys-korner-xp.com/xp_tweaks.htm

/xp_tweaks.htm

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm

 

[MIZERY1]

This solved my problem too with 823980 not installing.
Thanks a bunches..

BTW, is there any way to edit the Windows Update Installation History. I would
like to get rid of the 20 or so times I installed 823980

TIA

 

[Doug Knox MS-MVP]

If you're referring to the installation history available on Windows Update,
I personally wouldn't worry about it.

 

[SuperGumby]

BTW: I've opened box2 and WU indicates 26 criticals and 14 OS patches.

Applied only MS03-026 via WU.

Sent her back to WU and she still wants to do 26 and 14.

With box3 I'll try doing MS03-026 last.

 

[Doug Knox MS-MVP]

Its happening for one of two reasons, that I know of. They both involve
removing the Hotfix backup files and the associated registry entries in
Add/Remove Programs. Some people used an earlier version of my utility to
do this, others have probably done it manually. If the specific uninstall
key for KB823980 isn't present, Windows Update will offer the update, even
though its been installed. And it appears that since there are other keys
relating to this fix, it won't recreate the entry for Add/Remove. I haven't
had a chance to test this last assumption. However just recreating the
empty key will take care of this problem. I've modified the code in my
utility (Hotfix Backup Remove) to account for this issue.

 

[Doug Knox MS-MVP]

Ok, that's an interesting one. If you can, please go into REGEDIT and look
for the following key.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KB823
980

Post back whether or not it exists. Before trying the KB823980 install
again.