Missing .net updates?

Ron:

According to the MS security bulletin published today, it looks like those prior critical patches were indeed replaced:

KB2572066 in MS11-078 replaced by KB2604042

KB2656353 in MS11-100 replaced by KB2604044

KB2518864 in MS11-044 and KB2572073 in MS11-078 and KB2633880 in MS12-016 replaced by KB2604092

No update replaced by KB2604110

No update replaced by KB2604111

KB2518870 in MS11-044 and KB2572078 in MS11-078 and KB2633870 in MS12-016 replaced by KB2604121

http://technet.microsoft.com/en-us/security/bulletin/ms12-035

I suspect that Belarc's definition files haven't yet incorporated today's critical patches.

I haven't yet updated my XP/sp3 system yet, and Belarc tells me I'm up-to-date with all security updates, including the ones you list as missing.

HTH.

Thanks for the info.

I always check update status using Belarc after installing MS updates and should have noticed 3 updates were missing long before installing today's batch. So I suspected they had been replaced, especially since they didn't appear after reinstalling them.

Although I still use Belarc for various purposes, I find Secunia PSI 2.0 is quicker to update its definitions on Patch Tuesday, in order to verify successful patching from MSU. It is already telling me that MS critical patches need installing. (I still wait a day or two, to let others find any bugs).

Download: http://secunia.com/products/consumer/psi/

Follow-up:

Finally got around to carefully installing Patch Tuesday's critical security updates today, and ...
... I got exactly the same results as Ron listed in his first post, on my Xp/sp3 system.

 By  "carefully" I mean I installed each update one at a time, particularly the .Net ones, manually from the MSU site, using the "Custom" scan. MSU claimed all were successfully installed (confirmed by my Update History at MSU).

The problem child is the .Net update KB2604092. MSU says it installed correctly, and it is listed in my Add/Remove Programs. Yet when I run a new Custom scan from MSU, it keeps offering the KB2604092 again. And Secunia PSI said it was not installed.

I tried several fixes to no avail, but to make a long story short, I finally did what I should have done in the first place: I called the MS toll-free number for free help with security updates (1-866-PCSAFETY) and gave remote control over my PC to the tech there.

After he had rummaged around in my files for a while, he said:
"If MSU says it installed successfully, and it is listed in your Add/Remove Programs, then you should hide the prompt to install it at MSU".

This I have done. And Secunia PSI now says I am 100% updated with all programs (including all .Nets) - but I still wonder.

What a head-ache! I hate .Net updates.

Wondering about the radical approach:   Do we really need .NET at all, and if so, just how much of it?

On a work machine, which is running very slowly (most likely due to Symantec Corporate, and other imposed obstacles), I completely removed ALL .NET versions, and at the moment, the machine is running everything else I regularly use there without a problem.

On my home/main laptop, I installed .NET "just because" I figured I should.   At present, I am only aware of one program that requires it --- the Windows Debugging Tools.   As my system has been behaving, I haven't run the Debugger in several months.   So perhaps I could get rid this tool, AND .NET together?

Worst case:  if you remove .NET, and subsequently find you need it, you can always reinstall it --- together will all its updates.   At home, I don't think I'm gonna bother.

Notes:   I believe Vista and Win7 have some of the lower-numbered .NETs built in to the O/S.   Those cannot be removed.  EDIT:  Windows XP Media Center Edition & Tablet PC Edition come with .NET Framework 1.0; Windows Server 2003 comes with .NET Framework 1.1; Windows Vista & Windows Server 2008 come with .NET Framework 2.0 & .NET Framework 3.0.

For those using the FileHippo Update Checker, it requires .NET 2.0.

For those who intend to try/use the new OpenDNS CRYPT, it requires .NET 3.5 .

If anyone else knows of other required uses of .NET, perhaps you can reply, to expand the list here.

Wondering about the radical approach:   Do we really need .NET at all, and if so, just how much of it?

I have been sorely tempted to uninstall all .Net software on more than one occasion, but as my XP is the MCE version I know that I need at least some of the .Nets. Trying to determine which other programs I have installed on a 7 year old system need .Net has proved an exercise in futility. (I'm certain I recall having to download one or more versions to install programs in the past).

The simplest info I could find on the need for .Net is:

http://ask-leo.com/what_is_the_net_framework_and_do_i_need_all_these_versions.html

I particularly liked Leo's prediction from that 2008 article:
"Rumors are that the mess will get cleaned up in a future version, but in all honesty, I'm skeptical."

How true!

Follow-up: Finally got around to carefully installing Patch Tuesday's critical security updates today, and ... ... I got exactly the same results as Ron listed in his first post, on my Xp/sp3 system.  By  "carefully" I mean I installed each update one at a time, particularly the .Net ones, manually from the MSU site, using the "Custom" scan. MSU claimed all were successfully installed (confirmed by my Update History at MSU). The problem child is the .Net update KB2604092. MSU says it installed correctly, and it is listed in my Add/Remove Programs. Yet when I run a new Custom scan from MSU, it keeps offering the KB2604092 again. And Secunia PSI said it was not installed. I tried several fixes to no avail, but to make a long story short, I finally did what I should have done in the first place: I called the MS toll-free number for free help with security updates (1-866-PCSAFETY) and gave remote control over my PC to the tech there. After he had rummaged around in my files for a while, he said: "If MSU says it installed successfully, and it is listed in your Add/Remove Programs, then you should hide the prompt to install it at MSU". This I have done. And Secunia PSI now says I am 100% updated with all programs (including all .Nets) - but I still wonder. What a head-ache! I hate .Net updates.

Let me amend that statementt: "I hate updates!"

I just ran Belarc Advisor with their newest definitions file. It now says I'm fully up-to-date. The 3 patches Belarc previously reported as missing (KB2518864,  KB2572073 and  KB2633880) aren't listed anywhere in the Belarc summary as being installed or missing.  Poof - they're gone!

"I just ran Belarc Advisor with their newest definitions file".

Belarc must have "wized-up" and either:

1) now looks for the presence of  the newer updates... and if they're are present, knows you're okay; or

2) to avoid the "issues" here, just ignores the older updates, since they've been superseded by the new ones.

Hopefully they followed the first approach.

I'm betting it's behind door #2. :emotion-4:

Well out of the blue, Automatic Updates popped-up today, alerting me that I now needed some critical updates --- specifically, the 3 being discussed in this thread:  KB2518864,  KB2572073 and  KB2633880.   I find it strange that I had NOT been impacted by this issue until today --- TWO WEEKS after you guys!   I intend to research the matter when I can --- to see if perhaps anything has changed: e.g., if Microsoft has re-issued these updates in response to the problems you all were having.   In the absence of new evidence, I will probably just hide these, like you have. 

EDIT:   1) The information for MS11-044 http://support.microsoft.com/kb/2518864 , version 3.1, was "last review[ed] May 15, 2012", if that gives us any hint...

2) Perhaps, in reaction to MS-Updates finding these, Secunia's PSI is now also asserting I have 3 insecure versions of .NET on my system.

3) Looking at the updates already installed under add/remove programs, I see I have the following:

a - KB2656353 (ms12-035), .NET 1.1, which replaced KB2572067 in MS11-078

b - KB2604092 (ms12-035), .NET 2.0 SP2, which [as Joe noted above] replaced KB2518864 in MS11-044, KB2572073 in MS11-078, KB2633880 in MS12-016 

c - KB2604110 (ms12-035), .NET 3.0 SP2 [new, not a replacement]

d - KB2604111 (ms12-035), .NET 3.5 SP1 [new, not a replacement]

e - KB2656407 (ms12-034), .NET 3.0 SP2 [new, not a replacement]

4) As an extra-check, I have confirmed the file manifests for most (all??) of the above, to see that I have the most-current file versions on my system.

ACCORDINGLY, I have told Windows Updates to "hide" these particular updates it was offering... which resulted in Secunia no longer asserting I need them.

Also got an alert yesterday about these same 3 .net updates. I had previously tried to manually install them but that didn't satisfy Belarc until they updated their definitions file and it no longer looked for them.

I assumed MS just revised them after all the problems so  I let Microsoft Updates download and install them yesterday.  The update site reported all 3 were successfully installed.

BUT, the update shield doesn't go away on my task bar even affer cold rebooting and I can't find any evidence for the 3 newly installed updates in Add/Remove Programs or by using most recent Belarc definitions file (no update was available when I checked today).

If I search the drive for anything related to the 3 updates, I find a very large log file for each one, all dated yesterday, and all ending with "Configuration completed successfully".

So were they or weren't they..????? :emotion-7:

That's my story and I'm sticking to it! :emotion-2:

One more thing...I went to the Update site just now and it says there are no updates available for me so the site still thinks the 3 .net updates were installed.

I don't understand...

Ron,

I did not look for the presence of the updates offered/questioned, since all have been superseded by newer updates... rather, I simply confirmed I have the newer ones, and decided that's sufficient.

The mistery of Microsoft Update .NET Framework :emotion-4:

Hey Ron I believe it was door # 3 :emotion-2:

Usually I get the updates a couple of days late ( Automatically ). This time it was May 11. I let them download into my sys automatically and then I decide when to install them ( Usually after reading reports what they are for and no one has reported problems with them ). This time, eventhough I got 4 .NET Framework updates out of 19, none of them carried the KB # described in Ron's OP. So that you know, they were: KB2656407, KB2604092 ( This I did not had any trouble to install or was offered to me again like it happened to Ron and Joe ), KB2604110, KB2604111. I did not worry about the other updates Ron reported, because experience has taught me that not all KB# are the same for me who live down here in South America. Beside I manually checked for more updates and none was offered. So I was glad everything went right.

Well.. Like David. I got this automatic Microsoft updates just now, and you believe they are the ones Ron was talking about in his first post :emotion-3: KB2518864, KB2633880, KB2572073. I rebooted none was offered again and I also checked for more but I do not have any.

OH! Microsoft it is hard to love you :emotion-7:.

I did not get them the first time. I did not even get a few named by Joe replacing the old updates. As a matter of fact I got now KB2633880 that, supposedly, was replaced by KB2604092 which I got the first time and I did not even have KB2633880 at the time. :emotion-12:

" Life is like a box of chocolate.. " Who said that ? :emotion-2: 

The mistery of Microsoft Update .NET Framework :emotion-4: Hey Ron I believe it was door # 3 :emotion-2: Usually I get the updates a couple of days late ( Automatically ). This time it was May 11. I let them download into my sys automatically and then I decide when to install them ( Usually after reading reports what they are for and no one has reported problems with them ). This time, eventhough I got 4 .NET Framework updates out of 19, none of them carried the KB # described in Ron's OP. So that you know, they were: KB2656407, KB2604092 ( This I did not had any trouble to install or was offered to me again like it happened to Ron and Joe ), KB2604110, KB2604111. I did not worry about the other updates Ron reported, because experience has taught me that not all KB# are the same for me who live down here in South America. Beside I manually checked for more updates and none was offered. So I was glad everything went right. Well.. Like David. I got this automatic Microsoft updates just now, and you believe they are the ones Ron was talking about in his first post :emotion-3: KB2518864, KB2633880, KB2572073. I rebooted none was offered again and I also checked for more but I do not have any. OH! Microsoft it is hard to love you :emotion-7:. I did not get them the first time. I did not even get a few named by Joe replacing the old updates. As a matter of fact I got now KB2633880 that, supposedly, was replaced by KB2604092 which I got the first time and I did not even have KB2633880 at the time. :emotion-12: " Life is like a box of chocolate.. " Who said that ? :emotion-2:

Forest Gump

No cheating, you already know what's behind door #3 - more updates!

The 3 updates in my OP were correctly installed long before the May 5th offering of new .net updates. It was only after those new ones were installed that the 3 old ones went missing, at least according to Belarc Advisor. And no amount of manual installations could get them installed. I stopped wondering about them after a Belarc definitions update stopping flagging them for re-installation.

They suddenly popped up yesterday so I installed them right away. I don't normally get update notices from Microsoft until Wed or Thurs after "Patch Tues". Since the notice appeared on a Mon, I took it seriously and did the updates right away. But as I said, I see no evidence of their installation other than the log files. Perhaps they can't be uninstalled so that's why they're not listed in Add/Remove..?? I dunno...

The update shield was still in my system tray this morning hours after a cold boot. Left the system idle and went to meetings for a couple hours. When I returned, the notice was gone, but I still don't see any evidence they're installed.

Also noticed Belarc and qfecheck are not reporting KB2656407 even though it's listed in Add/Remove Programs.

I give up...!  :emotion-9: