how to manually remove KB2661254-v2

[askjoy]

I need to remove KB2661254-v2 on a XP pro sp3 computer.

FYI,
In add & remove programs it's listed as "unable to remove" and the link provided for support does not give the steps. I do have admin rights and I'm use to modifying registry entries when needed. I've also checked the KB article

Microsoft Security Advisory: Update for minimum certificate key length

I have been told to remove this update due to issue with updating Adobe programs.

I checked and I do have the folders in windows directory
$NtUninstallKB2661254-v2_0$
$NtUninstallKB2661254-v2$

and both have the spunist.exe in Spuninst folder. Do I use the command
C:\WINDOWS\$NtUninstallKB 2661254-v2$\spuninst\spuninst.exe
& also for the KB2661254-v2_0$

If so I assume I can do this using cmd since this is XP account with Admin rights I don't need to do this in Recovery Console or safe mode? Aslo want to know what I should do before doing this, example
backup registry, create restore point, etc.

Thanks for your time and assistance.

 

[niemiro]

Hello, and welcome to Sysnative :)

My advice would be not to try to uninstall this update if at all possible. Firstly, it seems ridiculous that Adobe are forcing this. The update was created to fix a security issue. Removing it is not ideal.

Do they not provide an update - a proper update?

Worst case scenario, I guess the problem is that they are using an old <1024byte encryption key.

Understanding the risks (ask me if you do not fully understand the risks), and knowing that you should not perform this on any production environment, you can leave the update installed but still allow small, insecure encryption keys:

Let's assume you need a 512 (hex 0x200) byte key as your min, either:

certutil ‐setreg chain\minRSAPubKeyBitLength 512

or edit registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config

Creating REG_DWORD values (name of value, data):

EnableWeakSignatureFlags: 2
minRSAPubKeyBitLength: 512

Hope this helps. I suspect it would be better than an uninstall.

Richard

 

[askjoy]

I agree with your opinion on uninstalling this update. Believe it or not it's the IT dept. requesting I uninstall it. I'm guessing there is an issue with SCCM updates they've pushing for Adobe updates. This update is showing up on the Security Patch State, I believe its in the windowsUpdate.log and IT is accessing this thru SCCM Client Center.

Would they still see it if I removed that reference to KB2661254? Is it a log file on the c:\ drive or in the registry?

Thanks.