VML Patch for Win9x?

See http://forums.techarena.in/showthread.php?t=595539

g,d&r...
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Security, Shell/User)

PA Bear wrote:

See http://forums.techarena.in/showthread.php?t=595539

See also:

http://www.google.ca/search?hl=en&q=...ndows+98&meta=


I'm a star.

From: "98 Guy"

|
| See also:
|
| http://www.google.ca/search?hl=en&q=...ndows+98&meta=
|
| I'm a star.

:-)

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

98 Guy wrote:
PA Bear wrote:

See http://forums.techarena.in/showthread.php?t=595539

See also:

http://www.google.ca/search?hl=en&q=...ndows+98&meta=


I'm a star.

So are you going to take up the slack for us 98 guy and test the August
patches for 98SE especially with regards to Internet Explorer and also
any future updates from Microsoft?

Dan wrote:

So are you going to take up the slack for us 98 guy and test
the August patches for 98SE especially with regards to
Internet Explorer and also any future updates from Microsoft?

ok, let's see.

There's this:

http://secunia.com/advisories/21557/

For which the problem was urlmon.dll, which was addressed in a
cumulative rollup:

http://www.microsoft.com/downloads/d...displaylang=en

Which had a bunch of replacement files but I think the only file dated
Aug/06 was urlmon.dll.

I have substituted the new urlmon.dll on the win-98 system I am using
to type this post and have surfed a few web sites and my system is
working just fine.

In searching for some tests for urlmon.dll, I found the following:

http://www.msfn.org/board/index.php?...8&#entry547658

The people in the above thread are talking about urlmon.dll.

They are also talking about DANIM.DLL, dxtrans.dll and dxtmsft.dll
from MS06-042 (Win-2K files for IE6).

Again, the Unofficial Win98 SE Service Pack is being updated to
reflect files patched by Microsoft for Win-2K but apparently also work
on Win-98.

This web site might also be of interest:

http://www.mdgx.com/ietoy.htm#IEC

Then there is this:

http://secunia.com/advisories/21396/

For which I can't find mention of specific files that are faulty.

I think that urlmon.dll is the only thing Win-98 users have to worry
about (or obtain) at this point, besides this new VML problem which is
solved with the new win-2k version of vgx.dll.

snip

Okay, system configured for system restore if necessary through GoBack.
I am going to replace urlmon.dll in C:\Windows\System with newer
urlmon.dll and will call old file urlmon.bak.

snipped for length concerns

Yeah that makes sense and from the secunia.com website the last one that
was in your post:

8) A boundary error exists in the patched version of URLMON.DLL in the
"CMimeFt::ReportProgress()" function when processing compressed URLs
after having been redirected. This can be exploited to cause a
heap-based buffer overflow via an overly long URL.

Successful exploitation allows execution of arbitrary code.

So, it seems like the urlmon.dll should definitely be replaced as you
advise. I am about to test this now and see how it works on my 98SE system.

98 Guy wrote:
Dan wrote:

So are you going to take up the slack for us 98 guy and test
the August patches for 98SE especially with regards to
Internet Explorer and also any future updates from Microsoft?

ok, let's see.

There's this:

http://secunia.com/advisories/21557/

For which the problem was urlmon.dll, which was addressed in a
cumulative rollup:

http://www.microsoft.com/downloads/d...displaylang=en

Which had a bunch of replacement files but I think the only file dated
Aug/06 was urlmon.dll.

I have substituted the new urlmon.dll on the win-98 system I am using
to type this post and have surfed a few web sites and my system is
working just fine.

In searching for some tests for urlmon.dll, I found the following:

http://www.msfn.org/board/index.php?...8&#entry547658

The people in the above thread are talking about urlmon.dll.

They are also talking about DANIM.DLL, dxtrans.dll and dxtmsft.dll
from MS06-042 (Win-2K files for IE6).

Again, the Unofficial Win98 SE Service Pack is being updated to
reflect files patched by Microsoft for Win-2K but apparently also work
on Win-98.

This web site might also be of interest:

http://www.mdgx.com/ietoy.htm#IEC

Then there is this:

http://secunia.com/advisories/21396/

For which I can't find mention of specific files that are faulty.

I think that urlmon.dll is the only thing Win-98 users have to worry
about (or obtain) at this point, besides this new VML problem which is
solved with the new win-2k version of vgx.dll.

Fix for urlmon.dll at least Intermediate and maybe even Advanced Users:

Well, I tried first in normal mode and no go -- file in use -- restarted
and no good either. Next, I tried safe mode and file still in use even
with a restart of safe mode. Okay, now it is time to get serious. I
had to choose a command prompt and that allowed me to rename urlmon.dll
to urlmon.bak. Next, I moved the newer Windows 2000 urlmon.dll into the
proper folder which in my case in 98SE was c:\windows\system. Success!
Next, I rebooted and no errors in the system yet. I will wait for a
while before actually suggesting this because I want to see if any
errors show up. It was a more difficult fix than the vgx.dll and that
is for sure --- at least in my case because the file could only be
renamed in the command prompt. It was like back in the olden days and
felt really good to use text to communicate with the operating system.

everyone remember cls for clearing the screen

dir/p/w --- directory pause each time and then hit enter to continue in
a wide view

grin

"PA Bear" wrote in message
...
| See http://forums.techarena.in/showthread.php?t=595539
|
| g,d&r...
| --
| ~Robear Dyer (PA Bear)
| MS MVP-Windows (IE/OE, Security, Shell/User)

What does it mean that McAfee will complain of "testvml[1].htm.vir" when
I click...
http://www.isotf.org/zert/testvml.htm
....at that techarena page? THEN, yea, it will quarantine or delete the
*.vir, but STILL I end up with a crashed IE. I haven't yet switched to
the Win2K .dll.

(1) What is crashing me, if McAfee has quarantined the virus?
(2) Is that virus supposed to be there?
(3) Or is this a diabolical plot of yours &/or of 98 Guy,
who IS prominently mentioned at that site?

From: "PCR"


|
| What does it mean that McAfee will complain of "testvml[1].htm.vir" when
| I click...
| http://www.isotf.org/zert/testvml.htm
| ...at that techarena page? THEN, yea, it will quarantine or delete the
| *.vir, but STILL I end up with a crashed IE. I haven't yet switched to
| the Win2K .dll.
|
| (1) What is crashing me, if McAfee has quarantined the virus?
| (2) Is that virus supposed to be there?
| (3) Or is this a diabolical plot of yours &/or of 98 Guy,
| who IS prominently mentioned at that site?
|

Mcafee can't determin if the test page is malicious or benign. It's signatures say it is
exploit code and reacts accordingly.

The fact that the *.HTM file in the TIF was renamed to *.HTM.vir means that your settings
are not set to auto-delete detected items but to rename them.

Basically, to perform this test, you would have to disable "On Access" scanning temporarily.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm