[prev in list] [next in list] [prev in thread] [next in thread] 

List:       patchmanagement
Subject:    RE: Last Known Good rolling back patches
From:       "Tossell, Donald" <don () notrs ! com>
Date:       2005-04-20 21:34:26
Message-ID: 313B722C3F65D743BF8CED6314C52B0A01D2650F () svr01 ! notrs ! org
[Download RAW message or body]

If memory serves, each time the machine successfully boots a copy of
HKLM\System\CurrentControlSet is made. When a "Last Known Good" is
called it should resurrect from the previous copy of the Current Control
Set. 

-----Original Message-----
From: Federated Information Security
[mailto:FederatedInformationSecurity@federatedinv.com] 
Sent: Wednesday, April 20, 2005 1:22 PM
To: Patch Management Mailing List
Subject: Last Known Good rolling back patches

We did more research, and found out that the spyware link was just a
coincidence.  The problem actually comes from booting the "Last Known
Good" configuration.  For some reason, when we boot from last known
good, we're resurrecting a bunch of old files.  This doesn't happen with
a standard machine that's patched using Automatic Updates, so I have a
feeling it's with the way we're pushing patches.  Can anyone shed light
on how "Last known good" reboots work, or where they restore system
files from?

Thanks for your help!

-----Original Message-----
From: Federated Information Security
Sent: Friday, April 15, 2005 1:38 PM
To: Patch Management Mailing List
Subject: RE: Spyware & Rolled Back Patches


It looks like the most common problems are with MS03-008 and MS03-011.
These are for jdbmgr.exe and msjava.dll, so there's a possiblity
something may be stomping on the java engine.  But our images are pretty
tight, and there are no old versions of these files in any software we
distribute, so it's still kind of odd.


---
PatchManagement.org is hosted by Shavlik Technologies

To unsubscribe send a blank email to
leave-patchmanagement@patchmanagement.org.
If you are unable to use this unsubscribe address (because you've
changed mail
accounts or your from address doesn't match the address known by the
listserver)
you can still unsubscribe by sending an email to the unique
'List-Unsubscribe' 
address listed in the header of each email.



---
PatchManagement.org is hosted by Shavlik Technologies

To unsubscribe send a blank email to leave-patchmanagement@patchmanagement.org.
If you are unable to use this unsubscribe address (because you've changed mail
accounts or your from address doesn't match the address known by the listserver)
you can still unsubscribe by sending an email to the unique 'List-Unsubscribe' 
address listed in the header of each email.

[prev in list] [next in list] [prev in thread] [next in thread]