3

I have a Windows 7 machine that has the file ucrtbase.dll of Universal C Runtime installed in the version 10.0.10586.1412.

However, the latest official MS Update I can find patching this file for Windows 7 is KB3118401, which contains this file in version 10.0.10586.9.

Given this Windows-7 machine, how can I find out which Update KB installed this specific version of ucrtbase.dll?

I would like to solve this problem generically, because we have issues with Windows system DLLs from time to time: In our development dep we have 5 different Visual Studio Versions and so it happened from time to time that one dev would have a newer version of some System32 dll and we weren't even sure where it came from.

Things I've tried:

  • Correlating the update installation list with the file creation date.
    Unfortunaltely the Hotfix history only seems to be keeping the date, and on the date this file was created on disk, I seem about a 100 KB fixes installed. (Expected bulk install of fixes at this date.)
  • Searching through %WINDIR%\WindowsUpdate.log - timestamps start after suspected install
  • Googling: No luck. I only find KB3118401 and KB999226 (an older version).
  • Looking at the WinSxS folder name of said file.
    • E.g. the WinSxSfolder for the 64 bit version is amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.1.7601.23303_none_0a7a73e149361a18 - I haven't found how this could help.
Martin
  • 563
  • 4
  • 10
  • 25
  • Sometimes the version number (6.1.7601.23303) from the WinSxS folder name is a useful search term, but it doesn't seem to be in this case. Have you checked the date the WinSxS folder was created? The file creation date is usually when Microsoft built the file, not when it was installed on your system; but I think the folder creation date and time will correspond to when the installation occurred. (You might want to check it against the install times for applications as well as hotfixes.) – Harry Johnston Feb 09 '19 at 08:23

1 Answers1

0

Search your .dll in windows\winsxs. You will find it in one of the packages there. By the folder's name of the package you can find what KB it belongs to.

In your case, 6.1.7601.23303 corresponds to a specific update, which is a KB or cumulative update.

Also, at the location:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\ComponentDetect

you may find information on such components.

By checking the date of the files present there, you can indirectly determine the date of the installed KB.

The easiest method to make a good correlation is to run dism /online /get-packages . This will list the package version (as in your 6.1.7601.23303 case) and the date of the package was installed, along with the KB package name.

Overmind
  • 2,970
  • 2
  • 15
  • 24
  • I tried that I have found the file in the WinSxs folder, but how am I supposed to go from the WinSxS folder name `amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.1.7601.23303_none_0a7a73e149361a18` to the KB / Hotfix number? – Martin Feb 08 '19 at 15:30
  • You have the build number and further the date when the file was put there, which is a direct clue of the KB installed that day. – Overmind Feb 11 '19 at 10:20
  • Apparently I had 2 instances of the page open and only part of the answer was initially posted (without the dsim part). I have appended that also. – Overmind Feb 11 '19 at 11:15
  • The package version `.23303` (nor `.24048`) is **not** listed by dism get-packages. I get a somewhat matching date, but the files of the associated KB do not contain the file that I am looking for. – Martin Feb 13 '19 at 09:01