“For a complete guide to security, check out ”Security+ Study Guide and DVD Training System” from Amazon.com“
What is SPCheck?
SPCheck is a handy support tool that allows you to determine the service pack level of most installed components on your XP based system on a file by file basis. Once you download, install and run the tool, the tool will generate a report file for you to examine. All of this will be covered in this article. SPCheck will generate a report file that will list the origin of each file for each installed component. SPCheck is used to report on the current service pack levels for:
- TCP/IP
- IPX/SPX
- SNMP
- Client for Microsoft Networks
You will see all these categories in the actual report generated by this tool.
Downloading SPCheck
The SPCheck tool / file is available for download from the Microsoft Download Center:
http://download.microsoft.com/download/6/e/0/6e0b8c10-a71b-44f1-99d5-27f6fc535f5c/XPSPChk.exe
Note:
This file is downloadable directly from Microsoft so you can save it to your desktop and run it.
Installing SPCheck
After you download the executable, you only need to double click on it to run it. Follow these steps:
- Once you run it, agree to the license agreement
- Next, select where you want to install it to
- Go to the Directory in which you just installed it via the command prompt.
- Go to Start => Run => Type CMD => Hit Enter
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\SYSTEM32>cd\
C:\>cd xpspchk
C:\xpspchk>dir
Volume in drive C has no label.
Volume Serial Number is BCD6-A664
Directory of C:\xpspchk
10/03/2004 03:16 PM <DIR> .
10/03/2004 03:16 PM <DIR> ..
04/08/2003 11:18 AM 16,256 eula.txt
11/07/2001 04:27 PM 656 readme.txt
06/02/2003 03:05 PM 73,728 spcheck.exe
09/03/2004 03:00 PM 8,463 spcheck.ini
10/03/2004 03:16 PM 6,032 spcheck.rpt
5 File(s) 105,135 bytes
2 Dir(s) 2,982,526,976 bytes free
C:\xpspchk>
- One you are at the XPSPCHK prompt, you can run the executable.
Using SPCheck
There are a few things that you should know about SPCheck.
- SPCheck must be run under the local administrator account, or one with local administrator rights. Although you may get away with running it without such credentials, you may have an issue with files not being reported and so on, so it’s imperative that you follow this rule. Local Administrator credential should be used.
- The PATH system variable (as seen here), is what SPCheck uses to search for files with. Make sure that if files are reported as missing even if they are installed, they are located within the PATH statement.
C:\xpspchk>path
PATH=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
C:\xpspchk>
- Once you run the executable from the Command Prompt, a report will be generate in the XPSPCHK directory. You can use Windows Explorer to browse to the report or simply launch it from the command prompt and selecting notepad to open it with.
C:\xpspchk>spcheck
Switches for SPCheck
You can use the following switches with SPCheck for additional functionality.
/i
A default file name of SPCheck.ini file is used unless you use this switch and then you can specify the name of the *.ini file used.
/r
A default file name of SPCheck.rpt file is used unless you use this switch and then you can specify the name of the *.rpt file used.
SPCheck Output and Report Reading
Once you have generated a report and now know how to locate it and open it, let’s take a look at it.
************************** Start of Report ****************************
SPCHECK Report File
System Date: Sun Oct 03 15:16:22 2004
The last Windows service pack to be installed on this system was:
Version 5.1 Service Pack 1 (Build 2600)
Check the system analysis section of this report, to see if all files are Service Pack 1 files
System Analysis
===================
[XP Internet Protocol TCP/IP]
C:\WINDOWS\SYSTEM32\DRIVERS\MSGPC.SYS SP0-1
C:\WINDOWS\SYSTEM32\DRIVERS\NETBT.SYS Unknown
C:\WINDOWS\SYSTEM32\DRIVERS\WANARP.SYS SP0-1
C:\WINDOWS\SYSTEM32\LMHSVC.DLL SP0-1
C:\WINDOWS\SYSTEM32\ICMP.DLL SP0-1
C:\WINDOWS\SYSTEM32\WSOCK32.DLL SP0-1
C:\WINDOWS\SYSTEM32\WS2_32.DLL SP0-1
C:\WINDOWS\SYSTEM32\WS2HELP.DLL SP0-1
C:\WINDOWS\SYSTEM32\MPRAPI.DLL SP0-1
C:\WINDOWS\SYSTEM32\TCPMON.DLL SP0-1
C:\WINDOWS\SYSTEM32\TELNET.EXE Unknown
C:\WINDOWS\SYSTEM32\PATHPING.EXE SP0-2
C:\WINDOWS\SYSTEM32\NSLOOKUP.EXE SP0-1
C:\WINDOWS\SYSTEM32\FINGER.EXE SP0-2
C:\WINDOWS\SYSTEM32\RSH.EXE SP0-1
C:\WINDOWS\SYSTEM32\REXEC.EXE SP0-1
C:\WINDOWS\SYSTEM32\RCP.EXE SP0-1
C:\WINDOWS\SYSTEM32\TFTP.EXE SP0-2
C:\WINDOWS\SYSTEM32\NBTSTAT.EXE SP0-2
C:\WINDOWS\SYSTEM32\NETSTAT.EXE SP0-1
C:\WINDOWS\SYSTEM32\ARP.EXE SP0-2
C:\WINDOWS\SYSTEM32\HOSTNAME.EXE SP0-2
C:\WINDOWS\SYSTEM32\DRIVERS\TCPIP.SYS SP1
C:\WINDOWS\SYSTEM32\DRIVERS\IPSEC.SYS SP1
C:\WINDOWS\SYSTEM32\OAKLEY.DLL SP1
C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL SP1
C:\WINDOWS\SYSTEM32\DNSAPI.DLL SP1
C:\WINDOWS\SYSTEM32\IPCONFIG.EXE SP1
C:\WINDOWS\SYSTEM32\FTP.EXE SP1
C:\WINDOWS\SYSTEM32\PING.EXE SP1
C:\WINDOWS\SYSTEM32\TRACERT.EXE SP1
C:\WINDOWS\SYSTEM32\NTSHRUI.DLL SP1
[XP Internet Protocol TCP/IP] Summary:
Missing files: 0
Unknown files: 2
SP0-1: 14
SP0-2: 6
SP1: 10
————————————————————–
[XP Client for Microsoft Networks]
C:\WINDOWS\SYSTEM32\WSHNETBS.DLL SP0-2
C:\WINDOWS\SYSTEM32\MSWSOCK.DLL SP0-1
C:\WINDOWS\SYSTEM32\NETRAP.DLL SP0-1
C:\WINDOWS\SYSTEM32\RPCSS.DLL Unknown
C:\WINDOWS\SYSTEM32\WSHISN.DLL SP0-2
C:\WINDOWS\SYSTEM32\MPRAPI.DLL SP0-1
C:\WINDOWS\SYSTEM32\NETMSG.DLL SP0-2
C:\WINDOWS\SYSTEM32\WKSSVC.DLL Unknown
C:\WINDOWS\SYSTEM32\MSGSVC.DLL Unknown
C:\WINDOWS\SYSTEM32\RASADHLP.DLL SP0-1
C:\WINDOWS\SYSTEM32\NETSHELL.DLL Unknown
C:\WINDOWS\SYSTEM32\RSAENH.DLL SP1
C:\WINDOWS\SYSTEM32\WIN32SPL.DLL SP1
C:\WINDOWS\SYSTEM32\NETCFGX.DLL SP1
C:\WINDOWS\SYSTEM32\DRIVERS\NETBIOS.SYS SP1
C:\WINDOWS\SYSTEM32\BROWSER.DLL SP1
C:\WINDOWS\SYSTEM32\NETLOGON.DLL SP1
[XP Client for Microsoft Networks] Summary:
Missing files: 0
Unknown files: 4
SP0-2: 3
SP0-1: 4
SP1: 6
————————————————————–
[XP SNMP]
C:\WINDOWS\SYSTEM32\LMMIB2.DLL Missing
C:\WINDOWS\SYSTEM32\HOSTMIB.DLL Missing
C:\WINDOWS\SYSTEM32\SNMPMIB.DLL Missing
C:\WINDOWS\SYSTEM32\EVNTAGNT.DLL Missing
C:\WINDOWS\SYSTEM32\EVNTCMD.EXE Missing
C:\WINDOWS\SYSTEM32\EVNTWIN.EXE Missing
C:\WINDOWS\SYSTEM32\SNMP.EXE Missing
C:\WINDOWS\SYSTEM32\SNMPTRAP.EXE Missing
C:\WINDOWS\SYSTEM32\INETMIB1.DLL SP0-1
C:\WINDOWS\SYSTEM32\MSOBJS.DLL SP0-2
C:\WINDOWS\SYSTEM32\IGMPAGNT.DLL SP0-1
C:\WINDOWS\SYSTEM32\MCASTMIB.DLL SP0-1
C:\WINDOWS\SYSTEM32\PERFOS.DLL SP0-1
C:\WINDOWS\SYSTEM32\RTIPXMIB.DLL SP0-1
C:\WINDOWS\SYSTEM32\SNMPAPI.DLL SP1
[XP SNMP] Summary:
Missing files: 8
Unknown files: 0
SP0-1: 5
SP0-2: 1
SP1: 1
————————————————————–
[XP DHCP]
C:\WINDOWS\SYSTEM32\DHCPSAPI.DLL SP0-2
C:\WINDOWS\SYSTEM32\DHCPCSVC.DLL Unknown
[XP DHCP] Summary:
Missing files: 0
Unknown files: 1
SP0-2: 1
————————————————————–
[XP NWLink IPX/SPX]
C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKIPX.SYS SP0-1
C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKSPX.SYS SP0-2
C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKNB.SYS SP0-2
[XP NWLink IPX/SPX] Summary:
Missing files: 0
Unknown files: 0
SP0-1: 1
SP0-2: 2
————————————————————–
System Totals:
Total missing files: 8
Total unknown files: 7
SP0-1: 24
SP0-2: 13
SP1: 17
************************** END of Report ****************************
The summary at the top is the first place to start. Let’s take a look at the fact that from this report alone, you can see very quickly that XP Service Pack 2 is not installed on this system.
The last Windows service pack to be installed on this system was:
Version 5.1 Service Pack 1 (Build 2600)
Now that you know what, you can see from the categories (on a file by file basis) what components have been updated and to what levels.
The end of the report shows you totals… which shows you that there are some ‘missing’ and ‘unknown’ files found.
The end portion of this report is very helpful in determining what to do next about any issues you have with the report:
Understanding and/or troubleshooting the report:
================================================
A) A range of service packs may be identified as the source of a file:
- A specific file version can be included in several service packs i.e. the file version doesn’t change from service pack to service pack
- SPCheck will indicate the applicable service pack range
- For example, SP0-4 indicates that the file version was included with all service packs from SP0 to SP4
- If the currently installed service pack is within that range, the file version found is consistent with that service pack
B) If files are reported as missing, possible causes include:
- The file is actually missing
- The file could not be read because of restricted file permissions
- Check the file’s permissions
- The file did not exist in the location specified in the ini file or in any directory listed in the path environmental variable or in the default directory on any other local drive
- Edit the ini file and specify the actual location of the file or add the directory where the file(s) are located to the path variable
- A system environmental variable used in the ini file has not been set
- Ensure that all system environmental variables used in the ini file are set
- The file’s name and/or path specified in the ini file has embedded spaces
- Use a long file name alias in the ini file instead of embedded spaces
- Refer to Microsoft KB article Q142982 for details
- Use a long file name alias in the ini file instead of embedded spaces
C) If files are reported as installed, but all files for a particular component are not installed:
- The component is not installed
- Some files are installed with Windows, before a component is installed
- The files are shared with other component that are installed
The last section keys into why they were missing or unknown, which could simply be that the component its looking for is simply not installed or files are being shared with other components installed so it may not always be an issue.
Summary
We learned in this article the use of the Windows XP support tool called SPCheck. This is a handy tool that can be quickly used to assess the service pack level of installed components on a file by file basis. In this article we will look at how to acquire this tool, how it install it as well as how to use it and read the reports it produces.
