Thanks to FDV for his bandwidth generosity, he will be hosting the update lists.

Windows 2000 Post SP4 hotfix list. Maintained by tommyp

Windows XP x86 Post SP3 hotfix list. Maintained by mimo

Windows 2003 Server x86 Post SP2 hotfix list. Maintained by fdv

Please advise if there are any CRITICAL updates missing. This thread is not intended as a game to who posts first on what replaces what on patch Tuesdays. If one needs to get information as early as possible on patch availability visit this site.

----------

Site updated to reflect these most current lists. Thanks, tommyp!

appreciate the updates gentlemen!
looking forward to this for cleaner installation thanks!

Hi again TommyP!
Can i abuse of your patience again?
The XP list could be better if you add the ie6 and ie7 hf. This could be possible?

Generally, i forget to thanks you TommyP, and all the other guys working for free for proyects like this.
I'm so sorry for that. Thank you! All of you!

Guys, thanks for the 2K3 list. That's grunt work that's probably beyond the call of duty.

tommyp, for the 2000 list, the Windows2000-KB918118-x86-ENU.EXE update links to Windows2000-KB914388-x86-ENU.EXE

It should be:

http://www.microsoft.com/downloads/details...;displaylang=en

Hello tommyp,

As said before: big thanks for the effort and the list you compiled! I've updated my stickied post now to avoid any duplicates. However I have a few suggestions and improvement ideas:

1) It might be a good idea to have a special column with possibly a link to the corresponding thread in case the inclusion of an update requires more than just putting it into the respective directory. There are some problematic updates that need additional treatment like special .reg files to be included. I deal with some of them in my list.

2) It should be easily visible for each update for which sources it is valid. Basing on SP3 is okay, but there should be a differentiation between WM9, WM10 and WM11, and between IE6, IE7 and (in future) IE8. Maybe additional columns (I know, even more ) could be used, marking with an "X" the applicability of this update. Some updates are valid for only one WM and/or IE version, others for several at once (with the D/L links still being different).
Additionally some time in the future you might encounter problems with language-specific updates in case you want to link directly to the files.

The best solution would be something dynamic like TC76 had it, but I can imagine this to be too much work...

3) Could you add the date to the .cab files (e.g. for WU/MU) also? I'd suggest to use the server-side date of this files (exact day, not only month and year). Thus updates could be recognized easily. Alternatively the versions should be shown.
For the LegitCheckControl.cab I'd use the generic link (http://go.microsoft.com/fwlink/?linkid=39204) instead of a version specific one, as it might get updated occasionally. The same for OGAControl.cab (http://go.microsoft.com/fwlink/?linkid=67633).

4) There are some outdated links in the list as well. Scanning it quickly I at least identified that you have KB950760 (cumulative ActiveX update of June) listed but at the same time KB956391 also (cumulative ActiveX update of October, which fully replaces the previous one).
And you should mention that the time zone updates via the .cab files (HFTOOLS package) are not the most recent ones.

I hope I have time during Christmas holidays to fully review the list. Perhaps we can again achieve a separation between a part with critical (mandatory) and a part with optional (recommended) patches.

Regards,
Tomalak

Tomalak - Thanks for the constructive criticism. To answer some of your Qs
1. If I remember right, there was one update that required a registry entry. The script was modded (the beta thread) which addresses this (I tested this and it works).
2. I'll need a hand with the WMP with XP. I don't use XP and I will never use WMP. Figuring out all the updates will take too much time. I welcome corrections/etc to make the IE/WMP section complete.
3. Thanks for the direct links. I'll use the date of the INF file inside the CAB on the update page.
4. I was unaware of the october activex update hotfix replacing a previous one. The KB article does not say that the old one is replaced. (?!) Have you verified this?

All - rememeber, I don't use XP and there are more than enough variations to test out (i.e. different WMPs, IEs, etc). I don't have time to test them all. But I'll be more than willing enough to update and consolidate the lists with feedback.

I can confirm what Tomalak has said. KB956391 replaces KB953839 which replaced KB950760. To verify this you need to see the Security Advisories, not the KB articles.
(Source: http://www.microsoft.com/technet/security/...ory/956391.mspx)

(Source: http://www.microsoft.com/technet/security/...ory/953839.mspx)

MS08-032 is KB950760.

Thanks for compiling and maintaining these new lists.

.

Wish to be useful this time...
IE7 Updates:
KB938127 (Security Update)
KB956390 (Cumulative Security Update)

WMP11 Updates:
KB936782 (Security Update)
KB939683 (Windows Validation Required)
KB954154 (Security Update)

Thanks for the tips guys, more hands means less work. I think we are ready to go. Pardon the changelog for now, I haven't been keeping up with it the last few iterations. However, there is a timestamp on when I made the last update to the page. When new hotfixes come out, the change log will get populated.

If anything else is missing, please advise.

I didn't make it clear that this applies to both Windows 2000 and Windows XP. Not sure whether you know this, because only the Windows 2000 list has been changed.

Updated the lists.. Please advise of the WMP updates on Win XP as I won't test out every single combination (yes, I enjoy time away from the PC).

I think the 954459 (http://support.microsoft.com/kb/954459) should point to 955969 (http://support.microsoft.com/kb/955969) in the list.

Also I believe 955839 (http://support.microsoft.com/kb/955839) replaces 951072 (http://support.microsoft.com/kb/951072).
955839 is the December 2008 cumulative time zone update for Microsoft Windows operating systems.

tf

Thanks turdflinger!

I followed your list and after that WU is still asking for KB954600, KB952069 critical updates and for KB943729. Also is asking for WM11 updates KB939683 and KB929399.
Why don't you add them in your list?

Were you slipstreaming WMP11 to get that result?

Hi again, tommyp
Here is the updated list of updates for wmp11 and ie7:

wmp11 - 939683
wmp11 - 941569
wmp11 - 936782

ie7 - 938127
ie7 - 958215

The 958127 is referencing a link which doesn't exist. I believe it should be 958215 (http://support.microsoft.com/kb/958215)


The 927177 (http://support.microsoft.com/kb/927177) refers to "How to uninstall Internet Explorer 7". I believe the correct link should be to 940767 (http://support.microsoft.com/kb/940767) "Description of the Windows Internet Explorer 7 Installation and Availability Update"

tf

Yes I'm slipstreaming WMP11, also IE7. XP Greek Pro SP3

Hi tommyp,
Looks like 893803 and 911564 are not needed for XP SP3.
When trying to install them at fresh hfslipped xp pro sp3,
there is a message that tells they are already installed...

I also wonder what use is LegitCheckControl.cab because
WindowsUpdateAgent30-x86.exe is enough for me to
access windows update without downloading/accepting
any activex/updates (898461 & 892130 are of course included).

Maybe slipstreaming IE7 causes this?

I believe this one 'optional' based upon the info from http://www.microsoft.com/technet/security/...n/ms08-062.mspx as it only affects users running IIS:
I am running one of the platforms that are listed in the affected software table. Why am I not being offered the update?
The update will only be offered to systems on which the affected component is installed. Microsoft Windows 2000 and Windows XP systems that do not have Microsoft Internet Information Services (IIS) installed are not affected and will not receive this update. Windows Server 2003 and Windows Server 2008 systems that do not have both IIS and Internet printing installed are not affected and will not receive this update.
Would it be a good idea to include a note indicating this is optional unless IIS is installed?

On a side note: with SP3 slipstreamed (before using HFSLIP), 951748 is not displayed via MBSA 2.1 or Windows Update. I've searched for a reason why but cannot for the life of me see why this isn't being included via MBSA 2.1 or Windows Update. I show adf.sys being updated later from 956803 but dnsapi.dll(a), mswsock.dll(a), tcpip.sys(B) and tcpip6.sys(B) all show as version 5.1.2600.5512 and dated 4/13/08 for (B) and 4/14/08 for (a) (see http://support.microsoft.com/kb/951748). Based upon the list by FDV and TommyP, I would expect MBSA 2.1 or Windows Update should be offering 951748 but neither one appears to do so.

911564 is included in XP SP3 via 946480 (http://support.microsoft.com/kb/946480/).
946480 is the List of fixes that are included in Windows XP Service Pack 3.

tf

turdflinger - I'd prefer not to include other info such as you mentioned about IIS. It's not my intent to offer all scenerios of who installs what and what hotfixes are required for their system. It's already a pita with the various flavors of WMP and IE. In the case of the IIS update you mention, if someone has their winnt.sif file set up to install IIS, then the latest IIS will be installed. If the option is turned off, then it won't install, but the latest fileset still resides on the installation CD. The severity rating will remain as what MSFT says. It's not my call to redefine how MSFT rates their OS software.

spamkonto1 - Thanks for the tips. 911564 removed, but it appears that package installer 893803 is not part of the XPSP3, or at least that's what it says at KB946480. The legitcheckontrol.cab is periodically updated. It's good to keep the latest version there. I don't know how to answer your Q if it's an IE7 thing or not. I don't use IE7 or XP. I dislike both.

Thanks, I was only leaving some comments after trying HFSLIP tool - I find it very useful.
I tried to use nlite, but it failed to produce successfull installation cd XPSP3+IE7
(battery problem - looks like unsigned drivers settins were to blame).
Then I found that nLite does more than I wanted (editing sfc.dlls) and since there
is this HFSLIP tool that any reasonable user can use, STUDY and, in case
of problem, FIX himself, I was delighted.

FYI: when trying to install 893803 under XPSP3 message says that
newer package installer version is already included.
That "question" about IE7 was not really a question ;-) but only information
that it was not exactly fresh XPSP3, but IE7 was extra added (so that
might caused mentioned symptoms).
Anyway, I will try to install really clean XPSP3, then 893803 and report
it later.

One question about scripting - I am new to cmd, but it looks like pretty good
shell (bash is my poison), but can you tell me why HFSLIP does not use
parameters when CALL-ing "shell functions" (i.e. CALL :HF %hotfix_filename%)?
Some 2K/XP/2003/Vista incompatibility? cmd limitation?

It's not a limitation, it's just a if-it's-not-broke-don't-fix-it thing. Sure there could be lots of optimization to the script, but personal life and work get in the way. I don't think I get the error for the package installer but if more folks say that the file isn't needed, I'll remove it.

thanks tommyp, i agree pita and that makes sense enough to me!

Per, 893803:
Supported Operating Systems: Windows 2000 Service Pack 3; Windows 2000 Service Pack 4; Windows Server 2003; Windows XP; Windows XP Service Pack 1; Windows XP Service Pack 2
It doesn't list XPsp3 though...

Hi all,

I would give my little contribution to keep updated Windows 2000 list:

1) KB926121 (Remote Installation Services - RIS) is an optional component. If RIS is not installed, the update gives an error message...

2) KB926122 has been replaced by KB934484 (http://www.microsoft.com/technet/security/bulletin/MS08-003.mspx),
wich has been replaced by KB949014 (http://www.microsoft.com/technet/security/bulletin/ms08-035.mspx).
So, only KB949014 (currently missing) should be included in the list.

3) KB937894 has been replaced by KB951071 (http://www.microsoft.com/technet/security/bulletin/MS08-065.mspx)

4) KB941569 is listed twice.

5) Security and optional updates missing from the list:
-KB941644 (http://www.microsoft.com/technet/security/bulletin/ms08-001.mspx)
-KB950760 (http://www.microsoft.com/technet/security/bulletin/MS08-032.mspx), NOT replaced by KB9353839
-KB953839 (http://www.microsoft.com/technet/security/advisory/953839.mspx)
-KB957280 (http://www.microsoft.com/technet/security/bulletin/MS08-060.mspx)
-WindowsRightsManagementServicesSP2-KB917275-Client-XXX-x86.EXE (http://support.microsoft.com/kb/917275/en-us)

Ciao

Thanks for the contribution Lions. I'll try to knock these issues down one by one.
1. I don't get an error when slipstreaming 926121.
2. This is the infamous active directory hotfix. The overall hotfix is actually 957280.
3. List updated. Thanks!
4. Agreed, 941569 is listed twice. It's needed if you install codecs only. It's also included if you want to slipstream WMP9. A dynamic hotfix list would be better suited, but I'm not an HTML coder.
5. 941644 updates tcpip.sys. There is already a hotfix that updates this file (941644 is superceded).
950760 & 953839 are those infamous activex kill bits hotfixes. These two updates do not appear for me.
957280. See answer #2.
WindowsRights 917275. I'll reluctantly add this one to the list. I haven't seen the need to use this update yet.

Hi All,

Yesterday I installed a SP3 slipstreamed XP (Dutch), and installed IE7.
Then visited windows update, these are sugested updates:

892130
898461
890830
952069
954600
956802
958215
955839
955069
954459
957097
958644
954211
956391
956803
956841
957095
905474
938464
938127
951066
946648
952954
950974
952287
951978
951698
951376
950762
923789

So it looks like you don't need 893803, 950760 & 951748...

Merry Christmas Everyone

These are my results as well.
There are no bulletins replaced for WinXPsp3 regarding 950760 & 951748. 893803 doesn't list Windows XP Service Pack 3 (SP3).
I wonder if this has anything to do with it. Or, it might be a bug in the WUA (which would affect MBSA 2.1 as well).

Is your slipstreamed xpsp3 using an RTM or VLK version?

tf

Yeah, i recently updated my sisters new PC which had WinXP-SP3 on(i tried to convince her to change to 2k, but couldn't ), anyway, when i followed Tommy's list and then came to KB893803v2, then i could see that it didn't installed right from the batchfile i had made and when i then tried to install it manually, then a prompt stated that the SP level on the system(i.e. SP3) wasen't supported for that update...

Note, this wasen't a slipstream, though... Just a FYI...

FWIW, I just finished evaluating a Windows XP SP2 machine (not slipstreamed) which hadn't been upgraded in about a year.
Checking Windows Update showed 893803, 950760 and 951748 as being needed (plus a few others).
Instead of getting all the updates, I went ahead and upgraded the machine to SP3.
I checked Windows Update and 893803, 950760 and 951748 weren't offered.

I tried installing 951748 against SP3 too and it installed without issue. It seems to me this one should probably be included in a slipstream process regardless of what WUA and MBSA 2.1 indicate (or don't indicate as the case may be).

tf

The WindowsXP-KB915865-v11-x86-ENU.exe points to Windows-en-US-KB943729.exe. The correct I think is Windows-en-US-KB943729.exe
regards

same question here !

the description , the date and the link are all pointing to KB943729 but only the filename is wrong !

some copy/paste error ?

thanks

yes, it was a copy/paste error. I'll send the new version to FDV for hosting. The hotfix lists are pretty much generated by a spreadsheet. I have all the KB numbers and MS article numbers. From there, I use some concatenate functions to generate the HTML code. So it's just a copy/paste thing at this point. I feel it's 99% there. But with any software, there is always room for improvement.

Merry Christmas.

special.reg the continued need for ActiveX Killbits(kb956391)in hfsvcpack folder?
thanks

Are you using the latest beta? The beta should add in that "fix." What's the reg file you need to use?

in the latest beta everything is fixed either ecepcion of adding an activex killbits .....
adding one. reg published here if the update fixes
compile everything again to see if you ask me ActiveX killbits in Windows Update

I worked the whole process again and still the asking kb956391 update I have not made any modification of the process and I have used the latest beta of hfslip......
but if we put this. reg in hfsvcpack not ask me to update the ActiveX killbits:





I am also a doubt ... because it is blocked windows installer 4.5 in the latest versions of hfslip? Is it a problem caused by this update? Solve WindowsXP-KB958655-x86-ENU.exe this problem?

willydejoe1234 - HFSLIP already addresses this activex issue. Perhaps you have another file that is reversing this fix?

this is my compilation

Please keep this thread on topic for windows update list corrections.

It may be worthwhile to edit your hfslip.ini file to delete the NoKillBits line. Also, it maybe worthwhile for you to compare your hotfix list from what is presented on the xp hotfix page. Please start a new thread if you run into probs.

I have compiled this whole process .reg and everything went perfect ... I think you should put on the page updates for XP SP3 ..... I do not know that I have HFANSWER.INI anything about killbits
so that other users know ....
any suggestions regarding my question on the Windows Installer 4.5?
thank you and sorry for the inconvenience.
I feel much painful English

Hi Tommy

Thank you so much for making such a great update list, i really appreciate your efforts, mate

I think that the XML3 update 'Windows2000-KB955069-x86-ENU.EXE', shouldn't be listed as 'Optional' under it's 'Notes' section...

(If i'm wrong then i apologise).

Very minor issue, but just thought that i would report it...

Thank's again, mate

Thanks Martin H. It's a yes and no situation. The entire msxml "block" is optional. If you slipstream msxml, then it's critical. If you don't slipstream msxml then you don't need it. So you're right, it's optional. However, I take the ratings from MSFT's security bulletin (MSxx-yyy).

Thank's for your reply, mate

Anyway, sorry for my bad wording maybe, but what i meant was that i believe that XML3 is default in Win2k-SP4, and hence, XML3 updates wouldn't be 'Optional' then...

On Tomcat's old list, then when you haven't selected any of the optional XML installers, then the 'HF' section still lists this update:

Windows2000-KB936021-x86-ENU.EXE S MS07-042 Vulnerability in MSXML3

And that update has now been replaced by the XML3 update on your new list i.e. 'Windows2000-KB955069-x86-ENU.EXE'.

Again, if i'm wrong, then i'm really sorry for wasting your time with my nonsence...


CU, Martin.

Edit: I found this on wikipedia's MSXML page:

Windows 2000 SP4 also ships with MSXML 3.0

http://en.wikipedia.org/wiki/MSXML

Hi Tommy

Sorry for keeping bothering you, but when you have the time/motivation, then could you please tell me if you disagree with what i said above?

Thanks in advance.

I'll move the MSXML 3 hotfixes out of the optional and in the "upper" list. The severity rating that is presented will still be what MSFT says.

Thanks alot for your reply, mate

Btw, it's just 1 hotfix and i've never disagreed with your severity ratings...

Thanks again, mate

@Tommy:

When using your Win2k list, then hfnetchk/qfecheck shows no missing patches/problems, but on WU, then except the obvious ones that i didn't include, then states that i'm missing:

• Windows2000-KB926122-x86-ENU.EXE (MS07-039)
• IE5.01sp4-KB938127-Windows2000sp4-x86-ENU.exe (MS07-050)

The first one is an error since it's for 2K-Server, but the next one seems legit to me:

When downloading and unpacking it, then it contains one updated binary: vgx.dll v5.0.3854.2500, and the inf copies/overwrites it into '%programfiles%\Common Files\Microsoft Shared\VGX\', and the old vgx.dll on the ISO is v5.0.3014.1003

Again, if i'm wrong, then i'm really sorry for the bother...

Edit: Btw, i know that KB938127 is replaced on Win2k with IE6-SP1, but not for Win2k IE5-SP4...