KB891711 trouble seems to be graphic issue

On the one hand, I am reluctant to start a new thread, with so many already
scattered about. On the other hand, I have something concrete that I
discovered, and it seems to warrant a new thread.

As a background, I found that the "Kb891711.exe" patch caused problems on
one of my computers. Poking around the groups I found a scattered list of
possible causes. Broswers. AV programs. Software firewalls. Processors. In
every case, somebody had a counter example to the claim.

My solution to avoid the crashes was to stop the process with the Close
Programs list; the computer running Windows ME. Then use Add/Remove Programs
from the Control Panel to remove it from the system. This deletes four
registry keys, and two system files; leaving only the folder to which the
system files were written. So there is no need to take super drastic steps;
like System Restore rollback, or Format & Reinstall. Worst case is that you
would have to boot in Safe Mode, I should think.

However, I was curious. Because of the counter examples, I decided to
install the patch on a second, identical computer. Both computers are HP
Pavilion 6745Cs. Intel Celeron 700MHz processors. Intel 82810 graphics chip
set. Windows ME. Kb891711 crashes one computer ("Megumi"), but not the other
computer ("Naomi"). Differences? A few programs in startup; but none on
Megumi that are definitively problematic on every computer with crashes; I
can find a counter example for each program on Megumi, which doesn't cause
crashes on some other computer.

When I checked the driver versions, I notice that I hadn't updated the
graphics drivers on Naomi. As things stood, I had the following:

Megumi:
-------

Intel Celeron 700MHZ processor
Intel 82810 graphics chip set (driver version: 4.13.01.3196)
Windows ME

Naomi:
------

Intel Celeron 700MHZ processor
Intel 82810 graphics chip set (driver version: 4.13.01.3004)
Windows ME

Kb891711 causes all browsers to blue screen on Megumi, but causes no
problems on Naomi.

So I just rolled back the driver update on Megumi; it is now, like Naomi, on
Intel driver version 4.13.01.3004. I just reinstalled the Kb891711 "patch".
Tested launch on all browsers which crashed Megumi before. MSIE6 SP1,
Firefox 1.0.1, Mozilla 1.7.5, Netscape 7.2. No crashes.

It looks, to me, like a graphics driver issue. I don't know if the onus
should be on Intel to provide an updated graphics driver for the 82810
graphics chip set, but I suspect not. Kb891711 is a "kludge", not a "patch".
It does not patch system files, it runs resident from the RunServices key.
The vulnerability that it "fixes" is still present. In my opinion, this
"kludge" needs to be fixed with a true patch; one that won't break the OS
when current graphics drivers are installed.

Now to review the MSFT write up on the vulnerability. It may be that I don't
need to run kb891711.exe; if my default browser, Firefox 1.0.1, isn't
vulnerable, I will just restore things. On Megumi, anyway.

--
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint

Looks good to me Norman. I did ask you elsewhere whether the bios version
was the same for both systems (shades of the Prescott XP SP2 debacle last
year) but it would appear that your findings have dispensed with that as
being a possible reason for the problem.
--
http://www.microsoft.com/windowsxp/e...ts/nichol.mspx
In memory of a very dear friend, Windows MVP Alex Nichol

Mike Maltby MS-MVP



N. Miller wrote:

On the one hand, I am reluctant to start a new thread, with so many
already scattered about. On the other hand, I have something concrete
that I discovered, and it seems to warrant a new thread.

As a background, I found that the "Kb891711.exe" patch caused
problems on one of my computers. Poking around the groups I found a
scattered list of possible causes. Broswers. AV programs. Software
firewalls. Processors. In every case, somebody had a counter example
to the claim.

My solution to avoid the crashes was to stop the process with the
Close Programs list; the computer running Windows ME. Then use
Add/Remove Programs from the Control Panel to remove it from the
system. This deletes four registry keys, and two system files;
leaving only the folder to which the system files were written. So
there is no need to take super drastic steps; like System Restore
rollback, or Format & Reinstall. Worst case is that you would have to
boot in Safe Mode, I should think.

However, I was curious. Because of the counter examples, I decided to
install the patch on a second, identical computer. Both computers are
HP Pavilion 6745Cs. Intel Celeron 700MHz processors. Intel 82810
graphics chip set. Windows ME. Kb891711 crashes one computer
("Megumi"), but not the other computer ("Naomi"). Differences? A few
programs in startup; but none on Megumi that are definitively
problematic on every computer with crashes; I can find a counter
example for each program on Megumi, which doesn't cause crashes on
some other computer.

When I checked the driver versions, I notice that I hadn't updated the
graphics drivers on Naomi. As things stood, I had the following:

Megumi:
-------

Intel Celeron 700MHZ processor
Intel 82810 graphics chip set (driver version: 4.13.01.3196)
Windows ME

Naomi:
------

Intel Celeron 700MHZ processor
Intel 82810 graphics chip set (driver version: 4.13.01.3004)
Windows ME

Kb891711 causes all browsers to blue screen on Megumi, but causes no
problems on Naomi.

So I just rolled back the driver update on Megumi; it is now, like
Naomi, on Intel driver version 4.13.01.3004. I just reinstalled the
Kb891711 "patch". Tested launch on all browsers which crashed Megumi
before. MSIE6 SP1, Firefox 1.0.1, Mozilla 1.7.5, Netscape 7.2. No
crashes.

It looks, to me, like a graphics driver issue. I don't know if the
onus should be on Intel to provide an updated graphics driver for the
82810 graphics chip set, but I suspect not. Kb891711 is a "kludge",
not a "patch". It does not patch system files, it runs resident from
the RunServices key. The vulnerability that it "fixes" is still
present. In my opinion, this "kludge" needs to be fixed with a true
patch; one that won't break the OS when current graphics drivers are
installed.

Now to review the MSFT write up on the vulnerability. It may be that
I don't need to run kb891711.exe; if my default browser, Firefox
1.0.1, isn't vulnerable, I will just restore things. On Megumi,
anyway.

Very interesting, all.

This is the problem I am currently having after downloading that same WinME
security update last Friday (3/11). I kept getting blue screen (Windows)
error messages (crashes requiring restarts) while online, then even before
getting online! I uninstalled it today, then ran "msconfig" and unselected
"StartUp Group" items (in Selective Startup), restarted my PC, and did some
puter maint (Disk cleanup, ScanDisk, and Disk Defrag). Then I went into
msconfig again and re-selected startup group items in Selective Startup again
(I always run my pc on selective startup--too many hookups when I use
"Normal" startup), and restarted my PC again.

So far, no blue screens! Tho, I did go to Windows Update and tried to
re-download the security patch, but can't because--even after uninstalling
it--the scan ignores my uninstall and the Update History page still shows a
successful download of that patch! Ack! So annoying. But, then again, if
the patch is so damaging to WinME, do I really NEED it? I have, and run,
Norton Internet Security 2004 with Live Update--plus I update DAILY!

The patch isn't as such damaging to Win Me but rather causes major
problems such as you are seeing for certain video card/video driver
combinations.

A couple of questions if I may. What video card/chip does your PC have
and what driver version do you have installed. You will find this
information at System Properties | Device Manager. Also what is the make,
model and speed of your processor, that is AMD or Intel, etc.

Regards,
--
http://www.microsoft.com/windowsxp/e...ts/nichol.mspx
In memory of a very dear friend, Windows MVP Alex Nichol

Mike Maltby MS-MVP



CataBird62 wrote:

Very interesting, all.

This is the problem I am currently having after downloading that same
WinME security update last Friday (3/11). I kept getting blue screen
(Windows) error messages (crashes requiring restarts) while online,
then even before getting online! I uninstalled it today, then ran
"msconfig" and unselected "StartUp Group" items (in Selective
Startup), restarted my PC, and did some puter maint (Disk cleanup,
ScanDisk, and Disk Defrag). Then I went into msconfig again and
re-selected startup group items in Selective Startup again (I always
run my pc on selective startup--too many hookups when I use "Normal"
startup), and restarted my PC again.

So far, no blue screens! Tho, I did go to Windows Update and tried to
re-download the security patch, but can't because--even after
uninstalling it--the scan ignores my uninstall and the Update History
page still shows a successful download of that patch! Ack! So
annoying. But, then again, if the patch is so damaging to WinME, do
I really NEED it? I have, and run, Norton Internet Security 2004
with Live Update--plus I update DAILY!

In article , =?Utf-8?B?
Q2F0YUJpcmQ2Mg==?= says...

So far, no blue screens! Tho, I did go to Windows Update and tried to
re-download the security patch, but can't because--even after uninstalling
it--the scan ignores my uninstall and the Update History page still shows a
successful download of that patch! Ack! So annoying. But, then again, if
the patch is so damaging to WinME, do I really NEED it? I have, and run,
Norton Internet Security 2004 with Live Update--plus I update DAILY!

If you didn't get the program files out of the folder they installed to,
Windows Update will find them, and declare your system to be current. For
Windows Me, C:\WINDOWS\SYTEM\KB891711; you will find two files the
Q891711.EXE and Q891711.DLL. The installation also creates four registry
keys; all of which have "891711" in them.

--
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint

"N. Miller" wrote in message
om...
In article ,
=?Utf-8?B?
Q2F0YUJpcmQ2Mg==?= says...

If you didn't get the program files out of the folder they installed to,
Windows Update will find them, and declare your system to be current. For
Windows Me, C:\WINDOWS\SYTEM\KB891711; you will find two files the
Q891711.EXE and Q891711.DLL. The installation also creates four registry
keys; all of which have "891711" in them.

So what is the method to cleaning up the bad update so that future fixed
updates will download and install?

Sarah

Norman, have you tested whether just renaming the two file's extensions, to
file_name.old, for example will permit Windows Update to reoffer the
"patch"?

--
Jack E. Martinelli 2002-05 MS MVP for Shell/User / DTS
Help us help you: http://www.dts-L.org/goodpost.htm

http://www.microsoft.com/athome/secu...t/default.aspx
In Memorium: Alex Nichol
http://www.microsoft.com/windowsxp/e...ts/nichol.mspx
Your cooperation is very appreciated.
------
"N. Miller" wrote in message
om...
In article ,
=?Utf-8?B?
Q2F0YUJpcmQ2Mg==?= says...

So far, no blue screens! Tho, I did go to Windows Update and tried to
re-download the security patch, but can't because--even after
uninstalling
it--the scan ignores my uninstall and the Update History page still
shows a
successful download of that patch! Ack! So annoying. But, then again,
if
the patch is so damaging to WinME, do I really NEED it? I have, and
run,
Norton Internet Security 2004 with Live Update--plus I update DAILY!

If you didn't get the program files out of the folder they installed to,
Windows Update will find them, and declare your system to be current. For
Windows Me, C:\WINDOWS\SYTEM\KB891711; you will find two files the
Q891711.EXE and Q891711.DLL. The installation also creates four registry
keys; all of which have "891711" in them.

--
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint

So what is the method to cleaning up the bad update so that future fixed
updates will download and install?

Sarah

Any new WU update will almost certainly have a new number to distinguish it
from this one, KB891711.
--
Jack E. Martinelli 2002-05 MS MVP for Shell/User / DTS
Help us help you: http://www.dts-L.org/goodpost.htm

http://www.microsoft.com/athome/secu...t/default.aspx
In Memorium: Alex Nichol
http://www.microsoft.com/windowsxp/e...ts/nichol.mspx
Your cooperation is very appreciated.
------
"Sarah" wrote in message
...
"N. Miller" wrote in message
om...
In article ,

SNIP

So what is the method to cleaning up the bad update so that future fixed
updates will download and install?

Sarah

"N. Miller" wrote in message
om...
In article ,
=?Utf-8?B?
Q2F0YUJpcmQ2Mg==?= says...

So far, no blue screens! Tho, I did go to Windows Update and tried to
re-download the security patch, but can't because--even after
uninstalling
it--the scan ignores my uninstall and the Update History page still
shows a
successful download of that patch! Ack! So annoying. But, then again,
if
the patch is so damaging to WinME, do I really NEED it? I have, and
run,
Norton Internet Security 2004 with Live Update--plus I update DAILY!

If you didn't get the program files out of the folder they installed to,
Windows Update will find them, and declare your system to be current. For
Windows Me, C:\WINDOWS\SYTEM\KB891711; you will find two files the
Q891711.EXE and Q891711.DLL. The installation also creates four registry
keys; all of which have "891711" in them.

--
Norman

Excellent info. I used Add/Remove to get rid of KB891711, however, the
KB891711 folder with the two files mentioned in you post are in the
windows/system folder. Also, a search of the registry for KB891711 found a
couple of them. Do I understand correctly that to get completely rid of
this patch/update I can delete all of these findings--the kb891711
folder/files and the registry references?
MLD

If Task Manager reports that KB891711.exe is not executing after a Normal
Mode boot, then you are fine.
You can manually delete the other 891711 items if that makes you feel
better.
Deleting the folder with the two files will cause WU to offer the update
again. Ignore it.
--
Jack E. Martinelli 2002-05 MS MVP for Shell/User / DTS
Help us help you: http://www.dts-L.org/goodpost.htm

http://www.microsoft.com/athome/secu...t/default.aspx
In Memorium: Alex Nichol
http://www.microsoft.com/windowsxp/e...ts/nichol.mspx
Your cooperation is very appreciated.
------
"MLD" wrote in message
news:6Tj_d.7210$aS5.1986@trndny05...

"N. Miller" wrote in message
om...
In article ,
=?Utf-8?B?
Q2F0YUJpcmQ2Mg==?= says...

So far, no blue screens! Tho, I did go to Windows Update and tried to
re-download the security patch, but can't because--even after
uninstalling
it--the scan ignores my uninstall and the Update History page still
shows a
successful download of that patch! Ack! So annoying. But, then
again,
if
the patch is so damaging to WinME, do I really NEED it? I have, and
run,
Norton Internet Security 2004 with Live Update--plus I update DAILY!

If you didn't get the program files out of the folder they installed to,
Windows Update will find them, and declare your system to be current.
For
Windows Me, C:\WINDOWS\SYTEM\KB891711; you will find two files the
Q891711.EXE and Q891711.DLL. The installation also creates four registry
keys; all of which have "891711" in them.

--
Norman

Excellent info. I used Add/Remove to get rid of KB891711, however, the
KB891711 folder with the two files mentioned in you post are in the
windows/system folder. Also, a search of the registry for KB891711 found
a
couple of them. Do I understand correctly that to get completely rid of
this patch/update I can delete all of these findings--the kb891711
folder/files and the registry references?
MLD