Rollback KB not relevant

morrisjh · April 2, 2015, 11:51am

Trying to create a rollback task for KB2553154. Obviously its really straight forward but after creating this task no PCs report relevant. I can literally see this KB installed on several PC’s around the office. Here is the mess of relevance:

((name of it = “WinXP” AND NOT ia64 of it) of operating system OR (name of it = “WinXP-2003” AND NOT ia64 of it) of operating system OR (name of it = “WinVista” AND NOT x64 of it AND NOT ia64 of it) of operating system OR (name of it = “WinVista” AND x64 of it AND NOT ia64 of it) of operating system OR (name of it = “Win7” AND NOT x64 of it AND NOT ia64 of it) of operating system OR (name of it = “Win7” AND x64 of it AND NOT ia64 of it) of operating system OR ((name of it = “Win8” AND value “CurrentVersion” of key “HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersion” of native registry as string is “6.2”) AND NOT x64 of it AND NOT ia64 of it) of operating system OR (name of it = “Win8” AND value “CurrentVersion” of key “HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersion” of native registry as string is “6.2” AND x64 of it AND NOT ia64 of it) of operating system OR (((name of it = “Win8” AND value “CurrentVersion” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion” of native registry as string is “6.3”) OR name of it = “Win8.1”) AND NOT x64 of it AND NOT ia64 of it) of operating system OR (((name of it = “Win8” AND value “CurrentVersion” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion” of native registry as string is “6.3”) OR name of it = “Win8.1”) AND x64 of it AND NOT ia64 of it) of operating system) AND (if ((name of it = “WinXP” AND NOT ia64 of it) of operating system OR (name of it = “WinXP-2003” AND NOT ia64 of it) of operating system) then (value “UninstallString” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KB2553154” of native registry as string contains “spuninst.exe” AND name of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KB2553154” of native registry as string does not contain “Service Pack”) else if ((name of it = “WinVista” AND NOT x64 of it AND NOT ia64 of it) of operating system OR (name of it = “WinVista” AND x64 of it AND NOT ia64 of it) of operating system) then (number of (elements of ((set of (if (exists key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of native registry) then elements whose (it contains “KB2553154” AND it does not contain “") of ((set of ((substrings before “~” of substrings after "for” of names of keys whose (name of it contains “for_” AND (it = 96 or it = 112 or it = 6 or it = 7) of (value “CurrentState” of it as integer)) of key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of native registry) as uppercase))) else (nothing))))) > 0) else if ((name of it = “Win7” AND NOT x64 of it AND NOT ia64 of it) of operating system OR (name of it = “Win7” AND x64 of it AND NOT ia64 of it) of operating system) then (number of (elements of ((set of (if (exists key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of native registry) then elements whose (it contains “KB2553154” AND it does not contain “") of ((set of ((substrings before “~” of substrings after "for” of names of keys whose (name of it contains “for_” AND (it = 96 or it = 112 or it = 6 or it = 7) of (value “CurrentState” of it as integer)) of key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of native registry) as uppercase))) else (nothing))))) > 0) else if (((name of it = “Win8” AND value “CurrentVersion” of key “HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersion” of native registry as string is “6.2”) AND NOT x64 of it AND NOT ia64 of it) of operating system OR (name of it = “Win8” AND value “CurrentVersion” of key “HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersion” of native registry as string is “6.2” AND x64 of it AND NOT ia64 of it) of operating system) then (number of (elements of ((set of (if (exists key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of native registry) then elements whose (it contains “KB2553154” AND it does not contain “") of ((set of ((substrings before “~” of substrings after "for” of names of keys whose (name of it contains “for_” AND (it = 96 or it = 112 or it = 6 or it = 7) of (value “CurrentState” of it as integer)) of key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of native registry) as uppercase))) else (nothing))))) > 0) else if ((((name of it = “Win8” AND value “CurrentVersion” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion” of native registry as string is “6.3”) OR name of it = “Win8.1”) AND NOT x64 of it AND NOT ia64 of it) of operating system OR (((name of it = “Win8” AND value “CurrentVersion” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion” of native registry as string is “6.3”) OR name of it = “Win8.1”) AND x64 of it AND NOT ia64 of it) of operating system) then (number of (elements of ((set of (if (exists key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of native registry) then elements whose (it contains “KB2553154” AND it does not contain “") of ((set of ((substrings before “~” of substrings after "for” of names of keys whose (name of it contains “for_” AND (it = 96 or it = 112 or it = 6 or it = 7) of (value “CurrentState” of it as integer)) of key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of native registry) as uppercase))) else (nothing))))) > 0) else (false))

Thoughts on what to do with this?

jmaple · April 2, 2015, 12:42pm

It may be a bit unconventional but I took the relevance clause that looks into the registry used to apply MS14-082 and stuck a “not” in front of it. Maybe try that?

32-bit

not ((exists key whose ((name of it equals "00004109C10000000000000000F01FEC" OR name of it equals "00004119510000000000000000F01FEC" OR name of it equals "00004109510000000000000000F01FEC" OR name of it equals "00004109660000000000000000F01FEC" OR name of it equals "00004119310000000000000000F01FEC" OR name of it equals "00004119610000000000000000F01FEC" OR name of it equals "00004109610000000000000000F01FEC" OR name of it equals "00004119AB0000000000000000F01FEC" OR name of it equals "00004109AB0000000000000000F01FEC" OR name of it equals "00004119440000000000000000F01FEC" OR name of it equals "00004109440000000000000000F01FEC" OR name of it equals "000041191A0000000000000000F01FEC" OR name of it equals "000041091A0000000000000000F01FEC" OR name of it equals "00004119A10000000000000000F01FEC" OR name of it equals "00004109A10000000000000000F01FEC" OR name of it equals "00004119330000000000000000F01FEC" OR name of it equals "00004119810000000000000000F01FEC" OR name of it equals "00004109810000000000000000F01FEC" OR name of it equals "00004119B30000000000000000F01FEC" OR name of it equals "00004109B30000000000000000F01FEC" OR name of it equals "00004119A30000000000000000F01FEC" OR name of it equals "00004109A30000000000000000F01FEC" OR name of it equals "00004119110000000000000000F01FEC" OR name of it equals "00004119D11000000000000000F01FEC" OR name of it equals "00004109110000000000000000F01FEC" OR name of it equals "00004119410000000000000000F01FEC" OR name of it equals "00004119910000000000000000F01FEC" OR name of it equals "00004109910000000000000000F01FEC" OR name of it equals "00004109710000000000000000F01FEC" OR name of it equals "00004109D30000000000000000F01FEC" OR name of it equals "00004119B80000000000000000F01FEC" OR name of it equals "00004109B80000000000000000F01FEC" OR name of it equals "00004119210000000000000000F01FEC" OR name of it equals "00004109210000000000000000F01FEC" OR name of it equals "00004119750000000000000000F01FEC" OR name of it equals "00004109750000000000000000F01FEC" OR name of it equals "00004119B10000000000000000F01FEC" OR name of it equals "00004109B10000000000000000F01FEC" OR name of it equals "00004109260000000000000000F01FEC" OR name of it equals "00004109160000000000000000F01FEC") AND (exists key whose (name of it equals "InstallProperties" AND value "DisplayVersion" of it as string as version = "14.0.7015.1000") of it) AND (not exists key whose (name of it equals "5AB96D0D9DB4E93408F470CD08FC4580") of key "Patches" of it)) of it)) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" of native registry

64-bit

not ((exists key whose ((name of it equals "00004109C10000000100000000F01FEC" OR name of it equals "00004119510000000100000000F01FEC" OR name of it equals "00004109510000000100000000F01FEC" OR name of it equals "00004119310000000100000000F01FEC" OR name of it equals "00004119610000000100000000F01FEC" OR name of it equals "00004109610000000100000000F01FEC" OR name of it equals "00004119AB0000000100000000F01FEC" OR name of it equals "00004109AB0000000100000000F01FEC" OR name of it equals "00004119440000000100000000F01FEC" OR name of it equals "00004109440000000100000000F01FEC" OR name of it equals "000041191A0000000100000000F01FEC" OR name of it equals "000041091A0000000100000000F01FEC" OR name of it equals "00004119A10000000100000000F01FEC" OR name of it equals "00004109A10000000100000000F01FEC" OR name of it equals "00004119330000000100000000F01FEC" OR name of it equals "00004119810000000100000000F01FEC" OR name of it equals "00004109810000000100000000F01FEC" OR name of it equals "00004119B30000000100000000F01FEC" OR name of it equals "00004109B30000000100000000F01FEC" OR name of it equals "00004119A30000000100000000F01FEC" OR name of it equals "00004109A30000000100000000F01FEC" OR name of it equals "00004119110000000100000000F01FEC" OR name of it equals "00004119D11000000100000000F01FEC" OR name of it equals "00004109110000000100000000F01FEC" OR name of it equals "00004119410000000100000000F01FEC" OR name of it equals "00004119910000000100000000F01FEC" OR name of it equals "00004109910000000100000000F01FEC" OR name of it equals "00004109710000000100000000F01FEC" OR name of it equals "00004109D30000000100000000F01FEC" OR name of it equals "00004119B80000000100000000F01FEC" OR name of it equals "00004109B80000000100000000F01FEC" OR name of it equals "00004119210000000100000000F01FEC" OR name of it equals "00004109210000000100000000F01FEC" OR name of it equals "00004119750000000100000000F01FEC" OR name of it equals "00004109750000000100000000F01FEC" OR name of it equals "00004119B10000000100000000F01FEC" OR name of it equals "00004109B10000000100000000F01FEC") AND (exists key whose (name of it equals "InstallProperties" AND value "DisplayVersion" of it as string as version = "14.0.7015.1000") of it) AND (not exists key whose (name of it equals "DBC42117476B1A74EB69135ED0DE84F0") of key "Patches" of it)) of it)) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" of native registry

Using that logic you should be able to make a copy of the MS14-082 fixlet, replace the registry lookup relevance with these and you’ll find your PCs that need it removed. Then you’ll need to change the action to include the removal action generated by the wizard. But that’s just a theory really. Not sure if it’ll work.