Avast interrupted download of Panda ActiveX & KB917344 missing issue

Avast Free Antivirus / Premium Security
21

I would have thought it better to go to windows update as that concentrates only on windows OS and related updates rather than microsoft update which also includes all other MS products.

Though that would/should include OS and related updates.

I simply don’t know enough to offer any cast iron advice I don’t know your OS as many of the updates are also OS dependant.

This however, does say IE7 is effected in both XP and Vista with IE7, http://www.microsoft.com/technet/security/bulletin/ms07-057.mspx.

The javascript one http://www.microsoft.com/technet/security/bulletin/ms06-023.mspx

I feel even if it is from 2006 it should be downloaded and you will have to check if it is PTB or PTG and I suspect the latter. Since this one is also a cumulative IE seurity update you should install this one first as it is an older update and there would also appear to be another one you need to check with belarc if it has been installed, see below

Caveats: Microsoft is releasing this update as a companion to the update included with [url=http://www.microsoft.com/technet/security/Bulletin/MS06-021.mspx]Microsoft Security Bulletin MS06-021: Cumulative Security Update for Internet Explorer (916281)[/url]. We recommend that you install this update at the same time as that update as a security update in that bulletin could expose this vulnerability or cause application compatibility issues.

This is the problem with the manual checking for updates as you often up in a circular route, which is very difficult to decipher. When you then add the the fact that you are also looking at the Portuguese version there are further complications as the security bulletins are based on the English versions as far as I’m aware. As I said previously I simply don’t know enough about this.

I’m sorry if this isn’t too helpful.

22

PTB is Portuguese-Brazilian. PTG is Portuguese (Portugal).

23

I’ve tested Belarc now and seems a false positive.
For me, the KB937143-IE7 is missed… but Windows Update says nothing.
You should believe more on Windows Update than Belarc.

24

As i upgraded from Windows Update to Microsoft Update, even if i try to go to Windows Update site, my browser automatically redirects me to the Microsoft Update site. Unless, if i try to downgrade my system configuration to revert back to Windows Update. But i thought that all the updates from the Windows Update site were also available at Microsoft Update site. Isn’t this true?

I already told in Reply#17 that i’m using the the portuguese version of Windows XP Home Edition. I haven’t specified tough that it is Service Pack 2 (build 2600).

Where did you read that ‘Vulnerability in Microsoft JScript Could Allow Remote Code Execution (917344)’ is also a cumulative IE security update ? I didn’t find that information in Microsoft Security Bulletin MS06-023. Internet Explorer doesn’t appear either under Affected components.

About this one, i don’t have it installed, but nor Belarc Advisor nor Housecall reported it as a missing update. In the Microsoft Security Bulletin MS06-021, under Affected Components, i see IE 5.01 SP4 and several versions of IE6, but find no IE7. Perhaps this update isn’t for IE7 ?

I think that the language issue adds no further complications. I searched and found the security bulletins for the same updates, but written in portuguese. Furthermore, in the download page of the security updates, under Quick Details, if you change the language to Portuguese and click the ‘Change’ button, the portuguese page for that download is shown, and the file …-ENU.exe shifts to …-PTG.exe (e.g. ‘IE7-WindowsXP-KB939653-x86-ENU.exe’ shifts to ‘IE7-WindowsXP-KB939653-x86-PTG.exe’).

Yeah, i also confirmed that.

Hey, I have that specific update, the one that Belarc reports as missing in your System. I’ve downloaded and installed it on August, 15 2007 via automatic updates. If you have IE7 installed, i couldn’t think of a reason why you don’t have it and i have it. Please go to Your Windows Control Panel>Add or Remove programs. Verify the check box ‘Mostrar atualizações’ (or ‘Show updates’?) in the top of the window. Then scroll down until you see ‘Windows Internet Explorer 7 - Atualizações de Software’ (or ‘Windows Internet Explorer 7 - Software Updates’?), and under that, check the updates installed, and confirm whether you have it or not.
I’m not sure if i should trust Windows Update. Is it to be considered foolproof ? Both Trend Micro Housecall and Belarc Advisor reported KB917344 as a missing update/vulnerability, not just Belarc.

P.S. This time, i took more than 5 hours to write this post! This must come to an end! :frowning:

25

The Javascript vulnerability and the IE cumulative security update are related only in the caveat in 06-023 javascript vulnerability, that I quoted it states that it is recommended that you also install 06-021 update IE cumulative security.

Which is what I was saying about going round in circles when checking other links within these security bulletins, it makes it very complex.

26

Yes, i agree that following links in the security bulletins which point to other related missing updates makes it very complex. I do not intend to install 916281 (Bulletin MS06-021), although i don’t find it amongst my installed updates. First, that cumulative update wasn’t reported as a required missing update nor by Belarc Advisor, nor by Housecall. Second, in the Microsoft Security Bulletin MS06-021, under Affected Components, i see IE 5.01 SP4 and several versions of IE6, but find no IE7. How do i know if IE7 itself or any IE7 cumulative update coming later (including KB939653 which failed verification by Belarc) replaced the need for the 916281 ? Do you get my point ?

Hey! I just found that, although Belarc Advisor failed verification of KB939653, this update is listed in my ‘Add or Remove programs’ under ‘Windows Internet Explorer 7 - Software Updates’ ! I’ll remove it and reinstall it again, and see if Belarc detects it.

27

I just uninstalled and reinstalled KB939653, and Belarc Advisor still fails verification of that update, so it’s most probably a false positive.

Now, about KB917344, which both Trend Micro Housecall and Belarc Advisor reported as a missing update/vulnerability, i ckecked all my installed Windows Updates and Internet Explorer Updates listed in ‘Add or Remove Programs’ and verified that i don’t have it. Could any of you who have Windows XP SP2 Home Edition and Internet Explorer 7 check in your system if it is listed under ‘Add or Remove Programs’, please ?

28

Why are you taking so long to post?

Most probably…

29

That’s because i have some difficulty in expressing exactly what i want to say, especially in English. Also i’m still learning how to use the SMF Bulletin Board Code, attach images to my posts, etc. Also, i had to look for the right webpages with the right links which i wanted to copy/past here.

I’m still waiting for your answer, guys.

So Tech, is KB937143-IE7 truly missing in your system, like Belarc reported (even tough Windows Update says nothing), or rather, you confirmed that you have it, and so Belarc wrongly reported it as missing ? It would be useful to know.

30

I would say you’re pretty good on this. You’re learning fast. Your posts are in pretty English and very well formated too. Congratulations.

I’ve downloaded it manually. When I try to install, the installer reported that my system doesn’t need this update. So, I don’t have it, it’s not listed into Add/Remove programs, and Belarc is wrongly reporting it in my opinion.

31

LOL

So, as I have it installed (and therefore, need it), but you don’t have it nor need it, my guess is that you don’t have the same OS as I have, or you don’t have the same Windows components, or you don’t have IE7.

If I knew that someone with the same OS as mine, and with IE7, with all the needed Windows Updates installed to date, had KB917344, then, I’d think that perhaps this update was truly necessary to my system, and i should download and install it manually.
So, i’m still waiting for your answer, guys.

32

Could be. For sure mine is Portuguese (Brazilian) XP SP2 fully updated to this language.

33

I don’t get this. The fact that you have the Portuguese (Brazilian) edition of Windows XP SP2 while i have the Portuguese (Portugal) edition of the same OS shouldn’t make any difference in what comes to the updates necessary and available in the Windows Update site, because the identification number of the updates are the same, no matter the language version. But what do I know ?
Unless you have the Professional Edition, not the Home Edition of XP, and perhaps that could explain the difference. And do you also have Internet Explorer 7 fully updated ?

34

But the downloaded files are different… I don’t know how Belarc manages this.

Nothing. Trust on Windows Update.

Oops. I have the Pro version. IE7 fully updated.

35

I can’t figure out why nobody attended to this simple request…But it doesn’t matter anymore.

Anyway, I posted this issue at Microsoft Discussion Groups > microsoft.public.windowsupdate and i’m getting specialized help on this.
I’ve found that if KB917344 had been successfully applied, the file jscript.dll (on Windows\system32) should be version 5.6.0.8831, but turns out that my jscript.dll is the old version (v. 5.6.0.8825), so it hasn’t been updated as it should. However, my Windows registry keys correspond to version 5.6.0.8831, and not to the version of the file I have, and that explains why the Microsoft Update website doesn’t prompt me to install KB917344. It appears that ‘something’ did not allow the file to be updated but did allow the change in the registry.

Anyone interested and those who want to know the details and further developments on this should go to http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.windowsupdate&mid=7120113e-4d54-4875-9495-b2032abe671e. There, search for Hugo_Pt in the search box, and my thread should appear in the search results. It is titled ‘Missing Windows update reported as a vulnerability by TMH…’

I thank DavidR and Tech for their willingness.

36

It’s nothing personal, just that we don’t have that much people form Portugal here. Another guy from there is VaMPiRiC_CRoW.
So, in your case Belarc was reporting correctly and Microsoft wrongly? Is it this way?

37

Someone from Portugal wasn’t necessary. Only someone with Windows XP Home SP2 and IE7 fully updated. Although the update could be different depending on the language, it is still and always KB917344, no matter if the downloaded file is -PTG.exe, -PTB.exe, -ENU.exe, -FRA.exe, -ITA.exe, etc. (different language versions of the same Windows update).

Belarc and Housecall reported correctly about KB917344, because my jscript.dll wasn’t updated to version 5.6.0.8831 as it should be if KB917344 had been applied correctly. My Windows registry could be matching with the update, but my Windows\system32\jscript.dll don’t. See my thread in http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.windowsupdate&mid=7120113e-4d54-4875-9495-b2032abe671e for details.