Re: MS01-041

From: Doug Neal [MSFT] (dugn_at_online.microsoft.com)
Date: 06/25/04

  • Next message: notgetinit: "Re: MS01-041"
    Date: Fri, 25 Jun 2004 15:13:42 -0700
    
    

    In your e-mail, it's not clear what the problem happens to be. And it may
    be helpful to post your concerns on the SMS newsgroup to notify the best
    experts in the field. For general MBSA issues, we usually request a bit of
    information to help us troubleshoot the issue. If you could reply with
    details below, it may help us investigate the issue you are having:

    The following information is helpful to accurately determine if there is an
    MBSA problem.

    If MBSA reports a "Patch NOT Found" warning (indicated by a red 'X" in the
    GUI interface), this means a patch for a security vulnerability needs to be
    installed immediately to protect your system. Or, if MBSA reports a
    'greater than expected', 'invalid checksum' or "required registry key"
    warning, we will need additional information to identify the issue. Please
    reply with the following four files captured in a ZIP file:

    Run MBSACLI /HF /V /TRACE > OUTPUT.TXT (on the local machine - or add the /H
    <Hostname>" parameter for a remote scan) - and capture the HF.LOG and
    OUTPUT.TXT file

    Also run MBSACLI /HF /V -History 1 /TRACE > HISOUTPUT.TXT - and capture the
    new HF.LOG file and HISOUTPUT.TXT file

    Please also include

      a.. The exact error message being reported (a screen shot and/or the exact
    text if possible)
      b.. The version of MBSA being used (from 'About MBSA' or command-line
    output)
      c.. The version of the MSSECURE.XML file (open the MSSECURE.XML file in
    NOTEPAD and check the 'DataVersion="xx.xx.xx.xx' information)
      d.. Provide the OS, OS service pack and OS language of the target machine
      e.. Indicate which type of scan is being performed (MBSA GUI scan, MBSACLI
    or
      MBSACLI /HF scan) - and what command-line parameters are being used (if
    you are using MBSACLI)

    This will help us quickly identify the root of the problem. Thank you!

    -- 
    Doug Neal [MSFT]
    dugn@online.microsoft.com
    This posting is provided "AS IS" with no warranties, and confers no rights.
    If newsgroup discussion with experts and MVPs is unable to solve a problem
    to your satisfaction, feel free to contact PSS for the Microsoft Baseline
    Security Analyzer (MBSA) at the following link:
    http://support.microsoft.com/default.aspx?scid=fh;en-us;Prodoffer20a
    This e-mail address does not receive e-mail, but is used for newsgroup
    postings only.
    "Yanze" <Yanze.18f15r@mail.mcse.ms> wrote in message 
    news:Yanze.18f15r@mail.mcse.ms...
    >
    > We get this on EVERY NT4-machine in our network. :angry
    >
    > We're running on SMS 2.0 with SUS implemented. All security-updates are
    > applied to all machines, including MS01-041, but Web Reporting still
    > shows a lot of this update "missing" ...
    >
    > I hope MS will fix this!
    >
    >
    > Jonathon Douglas wrote:
    >> *Not sure if i reported this before or not. I only get this on an NT4
    >> server.
    >>
    >> MS01-041
    >> Malformed RPC Request Can Cause Service Failure
    >> File version is greater than expected.
    >> [\\pixel\C$\WINNT\system32\riched32.dll, 5.0.1458.47 > 4.0.835.1381]
    >> *
    >
    >
    >
    > --
    > Yanze
    > ------------------------------------------------------------------------
    > Posted via http://www.mcse.ms
    > ------------------------------------------------------------------------
    > View this thread: http://www.mcse.ms/message743424.html
    > 
    

  • Next message: notgetinit: "Re: MS01-041"

    Relevant Pages

    • RE: Problem when resolving problems listet in MBSA.
      ... Thank you for posting in SBS newsgroup. ... I have read the question clearly, it seems like the information of the MBSA ... | the Local System account, ...
      (microsoft.public.windows.server.sbs)
    • RE: MS defends MBSA
      ... Subject: MS defends MBSA ... Uninstall Client for Microsoft Networking and it will not run at all, ... come directly from a Microsoft security bulletin, ... malicious admin could fool the MBSA reports? ...
      (Focus-Microsoft)
    • New MSSecure.XML Version 2004.12.01.0 Now Available
      ... MSSECURE.XML Data Version 2004.12.01.0 (for use by MBSA 1.2 and SMS SUS ... Note messages do not indicate that the computer that you are scanning is not ... Microsoft.public.sms.software_updates newsgroup instead. ... This posting is provided "AS IS" with no warranties, ...
      (microsoft.public.sms.tools)
    • New MSSecure.XML Version 2004.12.01.0 Now Available
      ... MSSECURE.XML Data Version 2004.12.01.0 (for use by MBSA 1.2 and SMS SUS ... Note messages do not indicate that the computer that you are scanning is not ... Microsoft.public.sms.software_updates newsgroup instead. ... This posting is provided "AS IS" with no warranties, ...
      (microsoft.public.security)
    • RE: MS defends MBSA
      ... I just started using MBSA so I can't say too many things about it. ... using mbsacli better though because I can write scripts to do everything for ... mbsacli as opposed to the GUI and a combination the ... malicious admin could fool the MBSA reports? ...
      (Focus-Microsoft)