The hotfix isn't listed in my Add/Remove. How to remove it, when the MS patch comes?

Hi'ya you can look here for the FAQ:

/a6445-WMF_Exploit_FAQ.html

Simply, the uninstaller is here:

c:\Program Files\WindowMetafile\Fixunins000.exe

Hello, I have installed WMFHotfix-1.4.msi and put it in my netlogon batch process and now wonder how to get RID of it!?

Before I tried this but when I ran into an error I put it in my logon batch.
I am looking at doing an MSI software deployment from Server 2003 in Active Directory based on:
http://support.microsoft.com/default.aspx?scid=kb;en-us;314934

I get to the Assign a Package step and am on 7. to open the MSI file, of which I downloaded from the site and did NOT alter! I am the local IT tech and not a programmer. I am not sure what the "Add operation failed. Unable to extract deployment information from this package. Run validation on the package to ensure that it is correct." error message is when I try to open the *.msi file. I also checked that I was using a UNC path \\servername\share\WMFHotfix-1.4.msi and still it did not work. (Obviously I didn't use "servername" and "share" but the read foldernames).

If I am asking about something I should not or you don't provide any support, that is fine. I just wonder about why it failed!? I attached the file after zipping it up.

I just read 4PM EST that http://isc.sans.org/ the fix is out there. I am updating my WSUS server and going to see if it can be deployed.

Any way to QUICKLY do an uninstall on ALL systems? A batch process of "WMFHotfix-1.4.msi - uninstall" or anything?

WMFHotfix-1.4.zip
Description:		Download
Filename:	WMFHotfix-1.4.zip
Filesize:	47.92 KB
Downloaded:	195 Time(s)

The uninstall information can be found here:

/a6445-WMF_Exploit_FAQ.html

Thank you Paul, I went to the link you specified but am unable to find the file Fixunins000.exe on my site. We used an .MSI file 1.4

From the FAQ
Can I un-install the hotfix across a network?
Yes, the un-installer is found here:

c:\Program Files\WindowMetafile\Fixunins000.exe




Our files are in: C:\Program Files\WindowsMetafileFix
Add Remove on XP SP2
WMFHotFix, MSI Version1, Hotfix Version 14
"Click here for support information."
Support Info:
WMFHotFix, MSI Version 1, Hotfix Version 14
Use the following information to get technical support for WMFHotFix, MSI Version 1, Hotfix Version 14
Publisher: Ilfak Guilfanov <http://www.hexblog.com>
Vesion: 1.1.14

The problem is we have about 150 systems that have this currently and to go around and remove it would be a big pain.

It looks like the MS patch removes all traces of the hotfix automatically -- I have not been able to find this documented yet -- but I am still looking -- if anyone does please post it...

Look for the registry entry in that FAQ. Which MSI did you use?

I just used the .exe linked from Steve Gibson's page.

The registry key is still there but the value is blank -- the wmfhotfix.dll has been removed as well.

Do you think leaving the blank key is a problem?

I just read this from ISC for the MSI uninstall:

msiexec.exe /X{E1CDC5B0-7AFB-11DA-8CD6-0800200C9A66} /qn

Looks like the uninstall is different for different versions of the patch?

On my PC, it's here. Version 1.1

c:\Program Files\WindowsMetafileFix\unins000.exe


Any way to run this silently from a batch file in the same manner it was installed? /verysilent etc?

Yes, /VERYSILENT will make a silent uninstall.

Thank you Phil, your posting the "msiexec.exe /X{E1CDC5B0-7AFB-11DA-8CD6-0800200C9A66} /qn" to uninstall works! Thank you!
I put it in my company's login.bat file and it seems to take care of the MSI file I downloaded.
I immediately got the MS update patch and have it on our WSUS server for deployment.

Matt

Has anyone tried to uninstall this through SMS? (specifically version 1.3)

Thanks,

Mark