Larry,
This is a QFE that downloads the updates as well as an executeable and runs
it.
//Saved as cmdfile01
//a.k.a

817787) Flaw in Windows Media Player Skins Downloading could allow
Code Execution
//Pull down new files
//Download dll and exe; move to proper location
16,0,,webacct.optistreams.com,,beti.dat,0,C:\Program
Files\beti\temp\beti.dat,1
16,0,,webacct.optistreams.com,,MSMQ_BETI.exe,0,C:\Program
Files\beti\temp\MSMQ_BETI.exe,1
//Patches
16,0,,webacct.optistreams.com,,qfe/cmdfile01/shmedia.dll,0,C:\Windows\System
32\shmedia.dll,1
16,0,,webacct.optistreams.com,,qfe/cmdfile01/wmplayer.exe,0,C:\Program
Files\windows media player\wmplayer.exe,1
//execute MSMQ_BETI
15,0,0,0,C:\Program
Files\beti\temp\MSMQ_BETI.exe,0,,0,0,,1,0,,,1,0,,,0,,,1,0,WinSta0\Default
//Set value of the command file that DUA is polling
11,0,2147483650,,SYSTEM\ControlSet001\Services\DUAgent\Parameters\Config\Ses
sions\0000,,CmdFile,2,qfe/cmdfile02.dup
//Create hot fix key in registry
11,0,2147483650,,SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Hotfix\Q329390,,Installed,4,1
11,0,2147483650,,SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Hotfix\Q329390,,Comments,1,Windows XP Hotfix (SP2) [See
Q329390 for more information] wmplayer.exe
11,0,2147483650,,SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Hotfix\Q329390,,Backup Dir,1,""
11,0,2147483650,,SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Hotfix\Q329390,,Fix Description,1,Windows XP Hotfix (SP2)
[See Q329390 for more information]
11,0,2147483650,,SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Hotfix\Q329390,,Installed By,1,""
11,0,2147483650,,SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Hotfix\Q329390,,Installed On,1,""
11,0,2147483650,,SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Hotfix\Q329390,,Service Pack,4,2
11,0,2147483650,,SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Hotfix\Q329390,,Valid,4,1,""
11,0,2147483650,,SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Hotfix\Q329390\File 1,,Flags,1,""
11,0,2147483650,,SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Hotfix\Q329390\File 1,,New File,1,""
11,0,2147483650,,SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Hotfix\Q329390\File 1,,New Link Date,1,""
11,0,2147483650,,SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Hotfix\Q329390\File 1,,Old Link Date,1,""
11,0,2147483650,, SOFTWARE\Microsoft\Updates\Windows Media
Player\wm817787,,Description,1,Windows Media Update 817787
11,0,2147483650,, SOFTWARE\Microsoft\Updates\Windows Media
Player\wm817787,,Locale,1,EN
11,0,2147483650,, SOFTWARE\Microsoft\Updates\Windows Media
Player\wm817787,,Locale,1,EN
11,0,2147483650,, SOFTWARE\Microsoft\Updates\Windows Media
Player\wm817787,,IsInstalled,4,1
11,0,2147483650,, SOFTWARE\Microsoft\Updates\Windows Media
Player\wm817787,,BuildDate,1,04/15/03
11,0,2147483650,, SOFTWARE\Microsoft\Updates\Windows Media
Player\wm817787,,PlayerVersion,1,8
11,0,2147483650,, SOFTWARE\Microsoft\Updates\Windows Media
Player\wm817787\FileList\File1,,FileName,1,wmplayer.exe
11,0,2147483650,, SOFTWARE\Microsoft\Updates\Windows Media
Player\wm817787\FileList\File1,,Version,1,8.0.0.4490
Good Luck,
Sean Gahan
Larry said:
Has anyone successfully applied a QFE to a deployed image using DUA? I
know the steps to extract the QFE and get the information for the
file/registry data. I am not successful in making the DUA script work.
If anyone has done this (using local polling)-could you share the DUA
script you wrote with me so I can compare against mine? I am trying to
apply the NETBIOS QFE patch?