MS05-002 on 9x and ME

cquirke (MVP Windows shell/user) wrote:
John Corliss wrote:
John Corliss wrote:
Jerry Bryant [MSFT] wrote:

Microsoft has received reports about issues with KB891711 on Windows
98, Windows 98 SE and Windows ME. At this point, we have been able to
confirm these reports and are currently working on a resolution.

By the way, on the off chance that it might be an issue with my graphics
setup, here is what I have:

P4 1.9 ghz with 256 mb of RDRAM. As for the graphics card, it's a
Leadtek WinFast(R) A280LE with an nVIDIA GeForce4 Ti 4200 chip running
in an AGP8X slot. Driver is from nVIDIA, is dated 07/03/2002 and the
version is 4.13.01.3100.

In the absence of tech detail on this resident patch, I have to guess
that it intercepts access to certain material and modified how it is
processed. That the patch involves icons and problems may be linked
to SVGA, suggests the second possible point of failu

1) Duelling content interceptors

Think resident av and anti-c(ommercial)m(alware), Zone Alarm with
email protection, various media indexers, etc.

I don't run any AV in the background (I know, I know, it's dangerous but
I haven't been infected since the 90s, that was only once and it was
easy to remove.)

2) SVGA issues

Not just SVGA drivers, but other players in that space; mouse drivers,
and non-driver featureware.

Applying (2) to your case, I'd ask:

Do you have any of nVidia's desktop enhancements enabled, such
multiple virtual desktops

No.

transparency

No.

etc.? Try turning that off

I'm running the setup just as the default installation made it.

What driver and featureware versions, and installation history of
these? For example, did you start with your card's driver CD that
autoran and installed both drivers and featureware

This is what I did.

and then later
download a newer driver (only) and install that via Update Driver,
so that it may version-soup with older featureware?

Do you have any mouse enhancements, such as "special" mouse drivers,

Instead of Microsoft Intellimouse, I use an old Kensington Scroll Mouse
in a Box driver that I vastly prefer.

Comet Cursor, etc.?

God forbid. 80)

Does setpping back the SVGA performance slider by
one notch (to disable mouse pointer acceleration) help?

Do you have any other visual enhancement software, such as on-screen
magnifiers (MSs or ZoomText) or gamma setting stuff?

Hmmm. Just remember that I've adjusted the gamma within the graphics
driver UI.

Are you overclocking anything, including the guts of the SVGA card?

No.

How's your mileage on:

Well, frankly I haven't tried any of these. When the problem occured....
(see next remark)

- Safe Mode
- Safe Mode after explicitly running the patch? Is it resident?

I used System Restore to remove the KB891711 and KB888113 patches after
the black screen of death problems occured. Not too eager to reinstall
them. I'm not too sure which of them caused my problem, but given that
so many others claim that KB891711 caused them problems, that would be
my main suspect.

- Normal mode with all Startup suppressed in MSConfig?
- Normal mode with only the patch enabled in Startup in MSConfig?
- SVGA Acceleration slider, each notch?
- SVGA 256 (8-bit) and other color depths?

Trickier to test (caution: may be a pain to undo!):
- SVGA 16 (4-bit) color depth (disables hware accel)?
- vanilla VGA drivers?

I'm not going to worry about this too much. I don't go to websites that
I'm not familiar with for the most part and will wait until MS fixes the
problem with KB891711, then give it a try again.

--
Regards from John Corliss

Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] wrote:
John Corliss wrote:
Noel Paton wrote:

John
could you please download and run Everest Home Edition
(www.lavalys.hu) and send me a full report? my email addy is valid.

Hmm..... I use Aida, Everest's precursor. But a "full" report? That's
giving you a whole lot of info, some of it stuff that I may not want
anybody else to have. Heck, I don't even understand some of it and
don't know whether or not I should provide it to others. And that's 84
pages of stuff to sift through in order to edit that info out...

Sorry Noel, it's nice of you to offer to help and I mean no offense,
but frankly I'd rather not do this.

Then call PSS. It will be a free call.

Susan,
Just curious, but what is PSS?

--
Regards from John Corliss

On Mon, 28 Mar 2005 06:47:14 -0800, John Corliss
cquirke (MVP Windows shell/user) wrote:
John Corliss wrote:
John Corliss wrote:
Jerry Bryant [MSFT] wrote:

Microsoft has received reports about issues with KB891711 on Windows
98, Windows 98 SE and Windows ME. At this point, we have been able to
confirm these reports and are currently working on a resolution.

By the way, on the off chance that it might be an issue with my graphics
setup, here is what I have:

P4 1.9 ghz with 256 mb of RDRAM. As for the graphics card, it's a
Leadtek WinFast(R) A280LE with an nVIDIA GeForce4 Ti 4200 chip running
in an AGP8X slot. Driver is from nVIDIA, is dated 07/03/2002 and the
version is 4.13.01.3100.

That the patch involves icons and problems may be linked
to SVGA, suggests the second possible point of failu

1) Duelling content interceptors

Think resident av and anti-c(ommercial)m(alware), Zone Alarm with
email protection, various media indexers, etc.

I don't run any AV in the background

OK.

FWIW, I used to use on-demand scanning only, but things have shifted
in various ways - more poorly-defined frontiers, clickless entry,
modern PCs fast enough to handle underfootware av, and also that most
users don't manage generic download skills for manual updates.

2) SVGA issues

Not just SVGA drivers, but other players in that space; mouse drivers,
and non-driver featureware.

Do you have any of nVidia's desktop enhancements enabled, such
multiple virtual desktops
No.
transparency
No.

etc.? Try turning that off

I'm running the setup just as the default installation made it.

OK. Did you see the settings etc. I'm referring to? I think during
the install it asks you if you want the "nVidia desktop" turned on, or
something; this is the stuff I'm thinking of.

What driver and featureware versions, and installation history of
these? For example, did you start with your card's driver CD that
autoran and installed both drivers and featureware

This is what I did.

OK. No updates since? That's how I like it, too :-)

Do you have any mouse enhancements, such as "special" mouse drivers,

Instead of Microsoft Intellimouse, I use an old Kensington Scroll Mouse
in a Box driver that I vastly prefer.

Does that use XP's native drivers, or did you install anything extra?

Does setpping back the SVGA performance slider by
one notch (to disable mouse pointer acceleration) help?

That's worth a try, BTW. Points to mouse/SVGA interaction if that's
it, may be worthwhile comparing hware vs. sware mouse pointers if so.

Do you have any other visual enhancement software, such as on-screen
magnifiers (MSs or ZoomText) or gamma setting stuff?

Hmmm. Just remember that I've adjusted the gamma within the graphics
driver UI.

OK - try with that off, as well as with "gamma loader" deselected from
startup via MSConfig

How's your mileage on:

Well, frankly I haven't tried any of these. When the problem occured....
(see next remark)

- Safe Mode
- Safe Mode after explicitly running the patch? Is it resident?

I used System Restore to remove the KB891711 and KB888113 patches after
the black screen of death problems occured. Not too eager to reinstall
them. I'm not too sure which of them caused my problem, but given that
so many others claim that KB891711 caused them problems, that would be
my main suspect.

OK, fair enough - I wouldn't want to roll such spiky dice either! I
did install that patch on my ATi Radeon 7xxx / Win98SE / IE6SP1 box
and I've had no problems at all, which doesn't help.

Any other readers notice a link between particular SVGA chipsets and
this issue, either way?

- Normal mode with all Startup suppressed in MSConfig?
- Normal mode with only the patch enabled in Startup in MSConfig?
- SVGA Acceleration slider, each notch?
- SVGA 256 (8-bit) and other color depths?

Trickier to test (caution: may be a pain to undo!):
- SVGA 16 (4-bit) color depth (disables hware accel)?
- vanilla VGA drivers?

I'm not going to worry about this too much. I don't go to websites that
I'm not familiar with for the most part and will wait until MS fixes the
problem with KB891711, then give it a try again.

Yes... an understandable position, but I think I'd go further and try
to air-gap MS's code from any web or HTML exposure. Thinking Firefox
(keep up to date with subversions!) and an email app that does not
pass HTML to the OS to be rendered, and attention paid to Sun's Java
VM subversions, with old versions uninstalled.



---------- ----- ---- --- -- - - - -
Gone to bloggery: http://cquirke.blogspot.com
---------- ----- ---- --- -- - - - -

The Win2k 891711 patch was released in January; my file dates said 1/25, but
indeed another poster had indicated that the 891711 patch was actually
released sooner in January, again, the "second Tuesday". Nonetheless,
obviously MONTHS before the WinME patch was released.

No one answered my posts on the Win2k update forum, so obviously no one was
taking the issue seriously (or no one was monitoring that forum). A Google
for this patch will uncover that indeed some development companies HAD seen
a major problem with Win2k and 891711 back in January and February.

I will speculate that the reason this has not shown up as widespread on
Win2k system as it has on WinME is because more ME systems are likely to be
using older or cheaper hardware. The defective patch has likely affected
millions of users with ME, whereas on Win2k it was likely just a trickle.

"Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]"
wrote in message ...
http://www.winserverkb.com/Uwe/Forum...nious-reseting

Earl... understand this .. patches only get released on the second Tuesday
of the month, thus there were no patches on 1/25

I'd still call into PSS, but I have not seen enough traffic on any of the
patching forums I monitor to see an across the board problem with Windows
2000 and this patch.

Earl wrote:
I will do so Gary, but I'm quite shocked Microsoft decided to release
this "patch" to the WinME community in March after I had already posted
about it several times on the microsoft.public.win2000.windows_update
forum since they first released the patch for Win2k -- back in January
(doesn't anyone "upstairs" read the update forums???). All of my users
have long ago uninstalled KB891711 on their malfunctioning Win2k systems.

But releasing 891711 to WinME after it had known issues with Win2k ...
well, that was just throwing grease on the fire.

Read the following threads:

"Catastrophic OS failures with latest security updates" posted on
2/8/2005
"Strange spontanious reseting", posted on 2/8/2005
"Win2k and KB891711 a disaster", posted on 3/7/2005
"Which Updates to Install?", posted on 3/8/2005



"Gary S. Terhune" wrote in message
...

Please call the number below and share your experience with MS Support.
I'm not sure they have sufficient data on this issue as it affects Win2K
systems. (Wait until Monday, OK?)

1-866-PCSafety (1-866-727-2338)

--
Gary S. Terhune
MS MVP Shell/User
http://www.grystmill.com/articles/cleanboot.htm
http://www.grystmill.com/articles/security.htm

"Earl" wrote in message
...

Jerry,

This issue absolutely affects Windows 2000 also.


"Jerry Bryant [MSFT]" wrote in message
.. .

Microsoft has received reports about issues with KB891711 on Windows

98,

Windows 98 SE and Windows ME. At this point, we have been able to

confirm

these reports and are currently working on a resolution.

Please note that by uninstalling the current update, the machine

will

return to a vulnerable state. At this point, we are currently not

aware

of customer's being exploited by way of the vulnerability fixed in
MS05-002 on Windows 98, Windows 98 SE and Windows ME. If you need
additional assistance regarding this update, please contact +1 (866)
PCSAFETY. When calling, please indicate that you are having issues

with a

security update.
--
Regards,

Jerry Bryant - MCSE, MCDBA
Microsoft IT Communities

Get Secure! www.microsoft.com/security


This posting is provided "AS IS" with no warranties, and confers no
rights.






--
An open letter to the Security Community::
http://msmvps.com/bradley/archive/2004/12/12/23540.aspx

Thanks Gary,

This phone number posted by you and Jerry is the generic "catch-all" number
for support. And then I get a non-English speaking person on my first trip
into the voice-jail.... then he routes me into a phone call where someone
wants to "help me fix something" ... then when I'm not a "Premier" customer,
they want me to go to the Microsoft website and put this issue into a "wish
list"... Give me a break, if Microsoft wants to get serious about fixing
this, they need a dedicated number, because I am not going to jack around
with all the b.s.

"Gary S. Terhune" wrote in message
...
I'll resist commenting on your report (not because I discount it, but
because additional comment isn't required, s.)

...Except to say that, no, MS does not normally monitor these
newsgroups. For such issues to find their way to the people who can do
something about them, it usually requires many calls to PSS by many,
*many* affected users, and/or an MVP or other Partner Level entity to
take up the cause and push hard to get attention for it. This particular
issue, as it relates to Win9x systems, had gone unnoticed by the people
who were in a position to do anything about it until, by happenstance, I
managed to drop a report into the right place from which others who are
in a position to do so managed to get it the attention it needed. And
even then, it took quite a bit of time for the people who actually
answer Support calls to get on board and quit giving erroneous advice
about the update.

--
Gary S. Terhune
MS MVP Shell/User
http://www.grystmill.com/articles/cleanboot.htm
http://www.grystmill.com/articles/security.htm

"Earl" wrote in message
...
I will do so Gary, but I'm quite shocked Microsoft decided to release
this
"patch" to the WinME community in March after I had already posted
about it
several times on the microsoft.public.win2000.windows_update forum
since
they first released the patch for Win2k -- back in January (doesn't
anyone
"upstairs" read the update forums???). All of my users have long ago
uninstalled KB891711 on their malfunctioning Win2k systems.

But releasing 891711 to WinME after it had known issues with Win2k ...
well,
that was just throwing grease on the fire.

Read the following threads:

"Catastrophic OS failures with latest security updates" posted on
2/8/2005
"Strange spontanious reseting", posted on 2/8/2005
"Win2k and KB891711 a disaster", posted on 3/7/2005
"Which Updates to Install?", posted on 3/8/2005



"Gary S. Terhune" wrote in message
...
Please call the number below and share your experience with MS
Support.
I'm not sure they have sufficient data on this issue as it affects
Win2K
systems. (Wait until Monday, OK?)

1-866-PCSafety (1-866-727-2338)

--
Gary S. Terhune
MS MVP Shell/User
http://www.grystmill.com/articles/cleanboot.htm
http://www.grystmill.com/articles/security.htm

"Earl" wrote in message
...
Jerry,

This issue absolutely affects Windows 2000 also.


"Jerry Bryant [MSFT]" wrote in
message
...
Microsoft has received reports about issues with KB891711 on
Windows
98,
Windows 98 SE and Windows ME. At this point, we have been able
to
confirm
these reports and are currently working on a resolution.

Please note that by uninstalling the current update, the machine
will
return to a vulnerable state. At this point, we are currently
not
aware
of customer's being exploited by way of the vulnerability fixed
in
MS05-002 on Windows 98, Windows 98 SE and Windows ME. If you
need
additional assistance regarding this update, please contact +1
(866)
PCSAFETY. When calling, please indicate that you are having
issues
with a
security update.
--
Regards,

Jerry Bryant - MCSE, MCDBA
Microsoft IT Communities

Get Secure! www.microsoft.com/security


This posting is provided "AS IS" with no warranties, and confers
no
rights.

Good luck. Hope you have a better experience than I did :=)

"Paul Adare" wrote in message
om...
In article , in the
microsoft.public.security news group, John Corliss
says...

Just curious, but what is PSS?


Product Support Services.

--
Paul Adare
http://www.identit.ca/blogs/paul/
Scientists were excited this week at having isolated a brief sound which
occurred immediately before the Big Bang.
Apparently, the sound was, "uh oh".

On Sat, 26 Mar 2005 17:00:39 -0500, "Rick Chauvin"
PA Bear wrote:

Rick, I don't think MS05-002/KB891711 has anything to do with the issue
about which you post.

Of course we all knowMS05-002/KB891711 has nothing to do with the link I
gave. http://www.frankprovo.com/win98ie6filesproblem.htm

As I said I took this extra opportunity to tag onto Jerry Bryant MCSE,
MCDBA post to express to the MS coders about another issue that is
of great importance for 9x to get fixed - besides what the OP is about.
I apologize for tagging onto it, but felt it was important enough.

I'm inclined to agree with Rick on this; this is IMO the biggest
hassle with Win9x, and a poor show that it's remained unfixed.

(As you know, my position is that IE6 with SP1 installed has
fixed your issue for the vast majority of Win98 users.)

Nope. It's a difficult issue to pin down, as it is intermittent but
"sticky" - I suspect it latches into problem mode once tripped there
by some sort of race condition (mis-timed, ?simultaneous events).

So it's been hard to pin it down to particular versions of anything.
I'm not even that sure it affects only IE 6 xx or Win98xx, for example

But it's significant, given that it makes it extremely tedious to do
real, bread-and-butter file management. That's why it's such an
embarrasment; an OS that can't copy files from one place to another is
like a car that can't turn its wheels around.

I can tell you this, though; IE 6 SP1 doesn't fix the issue in
Win98SE. I know, because that's the hardware I live with, and I see
this issue on a regular basis! Once the issue starts - classically
after doing a bulk erase or copy, whether Recycle Bin is bypassed or
not - then every attempt to rename or delete files or create new
folders will fail in the same way. The problem stops when
Explorer.exe is restarted, either by killing it as a task in the
Ctl+Alt+Del list, or by shutting down and restarting Windows.

Again here too Robert I have no idea what you are referring to, but surely
you are mistaken here of what we are talking about which has been well
confirmed in this 9x newsgroup a hundred times over the last 2 years;
thousands of times elsewhere. The issue that the link
http://www.frankprovo.com/win98ie6filesproblem.htm speaks about was never
fixed and I can guarantee it's 100% immutable that the problem does exist for
W98x. I would of not stuck my neck out to make my post if it wasn't.

Yes, this problem has been often raised, and until the reference to
BrowseLC.dll and BrowseUI.dll, no solution has ever been apparent.

There's a similar sort of problem where a fake (null-properties) W:
drive letter appears in the left pane of Explorer, sometimes with all
other drive letters vanishing. That was attributed to WinZip and
(AFAICR) some IE 5.xx versions, though I didn't find such a solid link
(i.e. I think I saw it in the absence of WinZip).

Then there's general flakiness of Windows Explorer, such that renames
or deletions often don't appear in the left pane until an explicit F5
to refresh. Happens especially in Start Menu.

Then there's the slowdown in Start Menu that started with Win98 (may
be related to IE 4's "Desktop Integration"). Whereas in pre-IE4
Win95xx, the Start Menu appears as fast as delay setting allows, and
appears in a single flash, in Win98+ it dribbles from top downwards;
you can feel the slowness as each icon gets painted in.

This may be hidden by the artificially-added slowness of Win98's
"animation" feature. It's pretty obvious once that feature's
disabled; one wonders if the "feature" was added to cover it up!


Now I know some see shuffling those .DLLs as a definitive fix; I would
too, as long as I don't have to fall below IE 5.5 SP2 (and thus run
the risk or regressing to the point that MIME-spoofing attacks are
once again facilitated by the OS).



---------- ----- ---- --- -- - - - -
Gone to bloggery: http://cquirke.blogspot.com
---------- ----- ---- --- -- - - - -

On Sat, 26 Mar 2005 21:39:54 -0800, "Susan Bradley, CPA aka Ebitz -

Why not upgrade to IE6 sp1?

Because that doesn't fix the problem! I'm running IE 6 SP1 or
Win98SE, and it gets so bad that I've taken to spawning a Command.com
instance to do deletes, renames and folder creations instead of using
the GUI. That's a pretty dire state of affairs, IMBS.



---------- ----- ---- --- -- - - - -
Gone to bloggery: http://cquirke.blogspot.com
---------- ----- ---- --- -- - - - -

But I thought you had seen the light, and swapped the DLLs. Are you still
holding out? :-)

cquirke (MVP Windows shell/user) wrote:
On Sat, 26 Mar 2005 21:39:54 -0800, "Susan Bradley, CPA aka Ebitz -

Why not upgrade to IE6 sp1?

Because that doesn't fix the problem! I'm running IE 6 SP1 or
Win98SE, and it gets so bad that I've taken to spawning a Command.com
instance to do deletes, renames and folder creations instead of using
the GUI. That's a pretty dire state of affairs, IMBS.



---------- ----- ---- --- -- - - - -
Gone to bloggery: http://cquirke.blogspot.com
---------- ----- ---- --- -- - - - -

On Sun, 27 Mar 2005 21:00:06 -0700, "Bill in Co."
Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] wrote:

Then call PSS.

I cannot replicate the issue, you can. If you have a system that can
replicate this you do others a service by calling in.

As this is not a malware issue, there are cost implications for most
folks, over and above the effort of logging the bug in detail :-)

It 'cannot' be handled in a newsgroup.
Doesn't look like it can be handled by MS, either.

I don't see this as an adverse reflection on PSS, but with one notable
exception, Ive always found usenet solved by problems before the first
PSS post-back. The exception was the Prescott-vs.-SP2 problem, where
PSS delivered the heavy lifting needed to pin down and address the bug

The stand-out features of this problem a
- it's intermittent, though usually associated with bulk file ops
- it's not a hard lockup; if left for several minutes, it clears
- once it starts, it persists for the runtime of Explorer.exe
- yes, it affects IE 6 SP1 as well as IE 6 original

It occurs when "View As Web Page" is disabled, BTW. What I mean by
"if left for several minutes, it clears" plus "once it starts, it
persists" is that after the problem arises the first time, it will do
so whenever any rename, delete or new folder operation is done. Each
time, the apparent hang (affecting Explorer only; other apps OK) will
clear if Explorer is left along long enough - but as soon as one of
the trigger operations are done, it happens all over again.

It usually takes a bulk operation (number of files, not file size) to
trigger the problem, but once triggered, any of the ops I mentioned
will trigger the problem - delete or rename one file, or rt-click,
New, folder (which involves an implicit rename). If these tasks are
done from Command.com (Del somename.ext, Ren Blah.txt Blee.txt, MD
NewFol etc.) then no problem.

If you kill Explorer.exe as a task, so that the shell restarts, then
you're fine until the next bulk operation starts it over.



---------- ----- ---- --- -- - - - -
Gone to bloggery: http://cquirke.blogspot.com
---------- ----- ---- --- -- - - - -