Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security NTBugtraq
[Top] [All Lists]

Re: A question about preparation for patching

Subject: Re: A question about preparation for patching
Date: Tue, 7 Sep 2004 10:33:24 -0500
Mark,

I think you make a wonderful point, but I wanted to add some detail to
it.

Run a 
chkdsk %systemroot% /f
Reboot, this addresses the risk of a corrupted registry. (I am sure that
many of you could share fun stories of recovering from registry
corruption while applying patch updates)
Apply the patch and a final reboot. What you may receive push back from
people stating that there are too many reboots. The reboots could be
staged and automated, remotely and coordinated via scripts. Most patch
installation packages wouldn't coordinate these events.

Hopefully this will clear up the issues around "clearing up any weird
settings" and "changes hanging around".
There are only a few things that require a reboot under windows. 
Changes queued in this registry key:
HKLM\SYSTEM\CurrentControlSet\Control\Session
Manager\FileRenameOperations
A File that is in use that can not be unloaded(which if it is a patch it
will update the above key)
A new driver is installed and not started by the installation program.
A new service is installed and not started by the installation program.

Crashes are also the result of Ring 0 operations that are not properly
handled, Ring 3 operations can't crash the operating system. Some of you
may also argue and say that isn't true; there are Ring 3 operations that
will cause Ring 0 operations to crash the system. It is still the result
of Ring 0 operation and not a Ring 3. This same issue holds true with
linux/unix. The kernel panics while in Windows you get the lovely BSOD.

- There are two types of people in this world, one who groups people in
categories and another group that doesn't.

-----Original Message-----
From: Windows NTBugtraq Mailing List
[mailto:NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM] On Behalf Of Perry, Mark-Allen
(Mark-Allen)
Sent: Tuesday, August 24, 2004 2:17 AM
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: A question about preparation for patching

To all:
 
I've never seen this explicitly mentioned but I thought I'd post the
question.
 
How many people reboot their machines just before applying a patch that
requires again a reboot?
 
In my opinion, this would clear out any weird settings and changes
hanging around and remove any doubt whether a crash was caused by the
patch or had been waiting there before.
 
Is this a better idea than just patching and THEN rebooting?
 
Comments?
 
many thanks,

--
Mark-Allen Perry 
ALPHA Systems
Marly, Switzerland


This communication is confidential and may be legally privileged.  If you are 
not the intended recipient, (i) please do not read or disclose to others, (ii) 
please notify the sender by reply mail, and (iii) please delete this 
communication from your system.  Failure to follow this process may be 
unlawful.  Thank you for your cooperation.

-----
NTBugtraq Editor's Note:

Want to reply to the person who sent this message? This list is configured such 
that just hitting reply is going to result in the message coming to the list, 
not to the individual who sent the message. This was done to help reduce the 
number of Out of Office messages posters received. So if you want to send a 
reply just to the poster, you'll have to copy their email address out of the 
message and place it in your TO: field.
-----

<Prev in Thread] Current Thread [Next in Thread>
  • Re: A question about preparation for patching, Beegle, Chris <=