Fixlet 1302925 - False positive

(imported topic written by SLB)

Me again :slight_smile:

I am seeing machines reporting relevant for 1302925 yet the files are of the expected patched version per the MS KB but the regsitry key being used for the fixlet detection is not present. Again, when trying to instal the patch from the MSU directly it throws up the message that the patch does not apply to this system (note it does not say that patch is already installed) and MBSA scans do not report the patch as required. The fixlet relevacne evaluates as true

Q: number of (elements of ((set of (if (exists key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of native registry) then elements whose (it contains “KB2813347” AND it does not contain “") of ((set of ((substrings before “~” of substrings after "for” of names of keys whose (name of it contains “for_” AND (it = 96 or it = 112 or it = 6 or it = 7) of (value “CurrentState” of it as integer)) of key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of native registry) as uppercase))) else (nothing))))) < 1

A: True

T: 0.443 ms

Yet the files present on the system are as per those in the patch, ie

Q: (pathnames of it, versions of it) of files (“Mstscax.dll”;“Tsgqec.dll”;“Aaclient.dll”) of (system folder ; system wow64 folder)

A: C:\WINDOWS\system32\Mstscax.dll, 6.1.7601.18079

A: C:\WINDOWS\system32\Tsgqec.dll, 6.1.7601.18079

A: C:\WINDOWS\system32\Aaclient.dll, 6.1.7601.18079

A: C:\WINDOWS\SysWOW64\Mstscax.dll, 6.1.7601.18079

A: C:\WINDOWS\SysWOW64\Tsgqec.dll, 6.1.7601.18079

A: C:\WINDOWS\SysWOW64\Aaclient.dll, 6.1.7601.18079

T: 86.248 ms

Regs

Rob

(imported comment written by sylviabeing)

Thanks for reporting.

We will look into it and keep you updated!

Regards,

Sylvia

(imported comment written by sylviabeing)

Hi Rob,

Your concerns about Fixlet 1302925, 1205437 and 1308129, 1308131, 1308135 have been tracked in our internal defect system. We will update the forum respectively once we have any progress on them

Regards,

Sylvia

(imported comment written by sylviabeing)

Sorry for the late reply.

Would you please try the attached custom copy for fixlet 1302925?

Thanks & Regards,

Sylvia

(imported comment written by SLB)

Hi Silvia, sorry for the late reply, and happy new year :slight_smile:

The new fixlet is resolving the issues with false positive on fixlet 1302925.

Thanks & Regards

Rob

(imported comment written by sylviabeing)

Hi Rob,

Happy new year!

Thanks for the feedback. We are doing another round testing on this fixlet and the content will be re=published once the test passed.

Cheers!

Sylvia