Microsoft has released security bulletin MS10-022. To view the complete security bulletin, visit one of the following Microsoft Web sites:

• Home users:
  http://www.microsoft.com/security/updates/bulletins/201004.aspx (http://www.microsoft.com/security/updates/bulletins/201004.aspx)
  Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:
  http://update.microsoft.com/microsoftupdate/ (http://update.microsoft.com/microsoftupdate/)
• IT professionals:
  http://www.microsoft.com/technet/security/bulletin/ms10-022.mspx (http://www.microsoft.com/technet/security/bulletin/ms10-022.mspx)

How to obtain help and support for this security update

Help installing updates: Support for Microsoft Update (http://support.microsoft.com/ph/6527)

Security solutions for IT professionals: TechNet Security Troubleshooting and Support (http://technet.microsoft.com/security/bb980617.aspx)

Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center (http://support.microsoft.com/contactus/cu_sc_virsec_master)

Local support according to your country: International Support (http://support.microsoft.com/common/international.aspx)

More information about this security update

Known issue

We know about an issue that affects a limited scope of computers on which all the following conditions are true:

• Windows XP Service Pack 3 is installed.
• An old version of Windows Script Host 5.6 was manually installed.

Note By default, Windows XP Service Pack 3 installs Windows Script Host 5.7. This known issue is limited to computers on which an earlier version of Windows Script Host was manually installed, even though you do not have to do this.

On computers that are affected by this known issue, this security update may not install because an unexpected version of Vbscript.dll is present. In order to install this security update on Windows XP Service Pack 3, the version of the Vbscript.dll file must be 5.7 as a minimum.

To resolve this known issue on a computer that is running Windows XP Service Pack 3, and the version of the Vbscript.dll file is version 5.6, use one of the following methods, as appropriate for the version of Windows Internet Explorer that is installed on the computer.

For Internet Explorer 6

1. Restore Vbscript.dll to an expected file version.
   
   To restore Vbscript.dll to version 5.7, do one of the following:
   • Download and install the KB951978 Script Engine update for Windows XP:
     951978  (http://kbalertz.com/Feedback.aspx?kbNumber=951978/ ) Script output is not displayed as expected when you run VBScript or JScript scripts in Windows Vista Service Pack 1, in Windows Server 2008, or in Windows XP Service Pack 3
     Note If you have enabled automatic updates, you will be offered this update automatically.
   • Upgrade to Internet Explorer 8. For more information about how to obtain Internet Explorer 8, visit the following Microsoft Web site:
     http://go.microsoft.com/fwlink/?LinkId=144107 (http://go.microsoft.com/fwlink/?LinkId=144107)
     Note If you have enabled automatic updates, you will be offered this update automatically.
   • Upgrade to Internet Explorer 7. For more information about how to obtain Internet Explorer 7, visit the following Microsoft Web site:
     http://go.microsoft.com/fwlink/?LinkID=158419 (http://go.microsoft.com/fwlink/?LinkID=158419)
2. Install the security update.
   
   After you have successfully restored Vbscript.dll to an expected version as outlined here, install the VBScript 5.7 security update for Windows XP Service Pack 3 (KB981349) as described in Security Bulletin MS10-022.
   
   Note This security update will be offered through Automatic Updates if the version of Vbscript.dll is at least 5.7.0.0.

For Internet Explorer 7

1. Restore Vbscript.dll to an expected file version.
   
   To restore Vbscript.dll to version 5.7, do one of the following:
   • Download and install the KB951978 Script Engine update for Windows XP:
     951978  (http://kbalertz.com/Feedback.aspx?kbNumber=951978/ ) Script output is not displayed as expected when you run VBScript or JScript scripts in Windows Vista Service Pack 1, in Windows Server 2008, or in Windows XP Service Pack 3
     Note If you have enabled automatic updates, you will be offered this update automatically.
   • Upgrade to Internet Explorer 8. For more information about how to obtain Internet Explorer 8, visit the following Microsoft Web site:
     http://go.microsoft.com/fwlink/?LinkId=144107 (http://go.microsoft.com/fwlink/?LinkId=144107)
     Note If you have enabled automatic updates, you will be offered this update automatically.
   • Uninstall Internet Explorer 7, and then reinstall Internet Explorer 7.
2. Install the security update.
   
   After you have successfully restored Vbscript.dll to an expected version as outlined here, install the VBScript 5.7 security update for Windows XP Service Pack 3 (KB981349) as described in Security Bulletin MS10-022.
   
   Note If you have enabled automatic updates, you will be offered this update automatically.

For Internet Explorer 8

If you have Internet Explorer 8 installed, and you have automatic updates enabled, you will be offered the correct update automatically, and you do not have to take any additional action. If you have to manually install this security update, download and install the VBScript 5.8 security update for Windows XP Service Pack 3 (KB981349) as described in Security Bulletin MS10-022.

Prerequisites to apply this security update

To install this security update, you must have Microsoft Visual Basic Scripting Edition (VBScript) 5.6 installed on the computer.

VBScript 5.6 is installed by the following:

• Microsoft Internet Explorer 6
• Windows Server 2003 (Versions include the following: x86-based SP2, x64-based SP2, and Itanium-based SP2)
• Windows XP (Versions include the following: x86-based SP2 and x64-based SP2)
• Windows Script Host 5.6

To determine the version of VBScript that is installed on the computer, follow these steps:

1. Open Windows Explorer.
2. Locate the following directory:
   %systemroot% \system32
3. Right-click the Vbscript.dll file, and then click Properties.
4. Click the Details tab to view the File Version field.

If the file version starts with 5.6 (for example, 5.6.0.8825), VBScript 5.6 is installed on the computer.

Removal information

To remove this security update, do one of the following:

• Use the Add or Remove Programs item in Control Panel.
• Use the Spuninst.exe utility that is located in the following folder:
  %Windir%\$NTUninstallKB981350$\Spuninst

Restart information

You may have to restart the computer after you apply this security update.

File information

The English (United States) version of this security update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For all supported x86-based versions of Windows 2000 SP4

For all supported x86-based versions of Windows XP SP2

For all supported x86-based versions of Windows Server 2003 SP2

For all supported x64-based versions of Windows Server 2003 SP2 and of Windows XP Professional SP2

For all supported Itanium-based versions of Windows Server 2003 SP2