My rasmans.dll "Modified" date is EARLIER than MS's stated "original" KB911280

I was investigating regarding washingtondude's "Cannot backup rasmans.dll" thread and discovered something that confuses me. (marked with *'s below)

I use Windows XP Home SP2 and my 177K rasmans.dll files' properties (found by right-clicking on the file name and selecting "Properties ") are as follows:

rasmans.dll

Location: C:\WINDOWS\system32
Size: 177 KB (181,248 bytes)
Created: Monday, March 31, 2003, 8:00:00 AM
Modified: Sunday, May 14, 2006, 4:44:08 AM*
Version: 5.1.2600.2908
Description: Remote Access Connection Manager
Other Version Information: 5.1.2600.2908 (xpsp_sp2_gdr.060513-0343)

An identical backup of rasmans.dll is located in the C:\WINDOWS\system32\dllcache folder (hidden folder) as expected.


MD5 and SH-1 Hash Values (using Karen's Hasher):
Karen's Hasher v2.2.1
http://www.karenware.com

C:\WINDOWS\system32\rasmans.dll
MD5: [FONT= "Courier New"]D4BD2EEAB07FEF323F0A0CEECC954F51[/FONT]
SHA-1: [FONT= "Courier New"]B3C8FED2948A5D036D049656F546E83DF975EAE0[/FONT]

C:\WINDOWS\system32\dllcache\rasmans.dll
MD5: [FONT= "Courier New"]D4BD2EEAB07FEF323F0A0CEECC954F51[/FONT]
SHA-1: [FONT= "Courier New"]B3C8FED2948A5D036D049656F546E83DF975EAE0[/FONT]

Even though the "Modified" date may be different than yours, I hope your files are otherwise identical (as indicated by the MD5 and/or SHA-1 hash values) to each other and identical to mine.



C:\WINDOWS\$hf_mig$\KB911280\SP2QFE\rasmans.dll
Modified: Sunday, May 14, 2006, 4:48:18 AM* <-- 4 minutes later than the "Modified" dates above (Seems reasonable.)
MD5: [FONT= "Courier New"]DDA7C61E4D05D2DF27C97896F2C14168[/FONT]
SHA-1: [FONT= "Courier New"]373A13584B41B975B405B1696C26A9F114DB0D8D[/FONT]
If my understanding is correct, this rasmans.dll file was apparently replaced by a Windows Critical Update (KB911280).

Technical Information about KB911280


*It seems odd that my "Modified" dates are earlier than Microsoft's stated "original" KB911280 release date.

If your information indicates our files are indeed different, I would certainly like to know. If you can verify for me that your files are identical to mine (except possibly for the "Modified" date), I certainly would like to know that too.

If anyone can provide a reasonable explanation (or even a conjecture) for the "Modified" date discrepancy, that would be an added bonus.




EDIT: I found references online that have MD5 hash values matching mine and the "Modified" date matches as well. One of the "Modified" times differs slightly from mine however.

• programchecker.com (Look under the "TECH INFO" tab for MD5 values and file "Modified" dates.):
  • c:\windows\system32\dllcache\rasmans.dll
  • c:\windows\$hf_mig$\kb911280\sp2qfe\rasmans.dll

Both pages state,

However, I do not know if "programchecker.com" is trustworthy/reliable. (Anybody here ever heard of ProgramChecker before? Opinions?)

 

Not much different results here, mailman.

WINDOWS\system32\rasmans.dll
170 KB modified 8-04-2004
MD5 = 41a3c11e3517c962c9b44893bcec3b34
SHA1 = ad2b313ad4b514899d51210f7185cbac24b6a7f7

WINDOWS\SoftwareDistribution\Download\4f47c78d92d1e7d8afd6488622d909fd\sp2gdr\rasmans.dll
177 KB (181,248 bytes) modified 5-14-2006 3:44:08
MD5 = d4bd2eeab07fef323f0a0ceecc954f51
SHA1 = b3c8fed2948a5d036d049656f546e83df975eae0

WINDOWS\SoftwareDistribution\Download\4f47c78d92d1e7d8afd6488622d909fd\sp2qfe\rasmans.dll
176 KB (180,736 bytes) modified 5-14-2006 3:48:18
MD5 = dda7c61e4d05d2df27c97896f2c14168
SHA1 = 373a13584b41b975b405b1696c26a9f114db0d8d


What I find odd is that even though I have the updated versions, the one in system32 was not replaced.

As to why MS has a later modified date than what we have ........ who knows.

 

Thanks for resting my conscience, Dave. Much appreciated.

Perhaps you downloaded the update but forgot to install.

I suspect you are investigating your issue and I hope to find out what you discover.

BTW, I periodically use Belarc Advisor (free for personal use) to help me verify I have all MS security patches up to date and installed properly. Thought you might want to try it out.

BA occasionally flags the installed KB902400 patch on my computer as "Reinstall!" and I have not yet discovered why that particular patch seems to keep getting corrupted. I reinstall KB902400 and things will be fine for awhile. Then something, some time, apparently corrupts it again. Haven't found out a pattern/trigger yet.

I have found Belarc releases Belarc Advisor updates within a day or two after MS releases their security patches. If one already has Belarc Advisor installed, updates can be downloaded from http://www.belarc.com/advisor_update.html and applied. (I do not think there is any need to update immediately after initial install of BA.)

I keep that update link handy at the top of my browser window.


EDIT: If anyone prefers not to use BA because it is a 3rd-party application, you can check the integrity of your installed security patches with Qfecheck, directly from Microsoft.

• Microsoft: Qfecheck.exe verifies the installation of Windows 2000 and Windows XP hotfixes