Complete file version

1

(imported topic written by tazmir91)

Hi, need to pull the full file version of c:\winnt\system32\urlmon.dll to check if a hotfix is installed, file version reported by the OS is “7.00.6000.17100 (vista_gdr.110620-1500)” via properties of the file, but when I use the following relevance, I only get “7.00.6000.17100” as the retrieved information. I am using the following relevance for the retrieved property:

if exists file “C:\WINNT\system32\urlmon.dll” then file version of file “C:\WINNT\system32\urlmon.dll” as string else “No urlmon.dll file”

What do I need to add to my relevance so it will pull the full version number and name.

Thanks for the help.

2

(imported comment written by jeremylam)

q: value “FileVersion” of version block 1 of file “C:\windows\system32\urlmon.dll”

A: 8.00.7600.16385 (win7_rtm.090713-1255)

I: singular string

3

(imported comment written by tazmir91)

I used the above as a property in an analysis, this works well for 2k8r2 systems, but reports “” for almost all of 2k3 sp2 x86 & x64 systems.

4

(imported comment written by jeremylam)

What’s the error message? (mouseover text)

5

(imported comment written by tazmir91)

“Singular expression refers to nonexistant object”, this error is on systems that do have the urlmon.dll file in the correct path.

6

(imported comment written by SystemAdmin)

this will work for different versions of windows, and where windows isn’t on c:

Q: value “FileVersion” of version block 1 of file “urlmon.dll” of system folder