Microsoft Monthly Update

[Guest Paracelsus]

Ugh.  People like that should be allowed to own computers...

<{POST_SNAPBACK}>

It seems that they already do :">

[epp_b]

It seems that they already do

<{POST_SNAPBACK}>

I hate typos :">

[Peachy]

Security Bulletin MS05-016Vulnerability in Windows Shell That Could Allow Remote Code Execution (893086)Security Bulletin MS05-017Vulnerability in Message Queuing Could Allow Code Execution (892944)Security Bulletin MS05-018Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege and Denial of Service (890859)Security Bulletin MS05-019Vulnerabilities in TCP/IP Could Allow Remote Code Execution and Denial of Service (893066)Security Bulletin MS05-020Cumulative Security Update for Internet Explorer (890923)

[Stonegiant]

Ehhh... Wasn't SP2 supposed to roll out for Automatic Update today?

[Peachy]

It will probably only show up in Windows Update if your computer doesn't have SP2 installed. I checked my SUS server and noticed that Service Pack 1 for Windows Server 2003 was waiting for approval. The security updates page only lists the new security updates for the month. Service Pack 2 would not fit that criterion.

[Guest LilBambi]

Boy, they are on the stick this month!Mine were downloaded automatically last night. Back in February, my computer didn't get the rollout till several days later.

[Stonegiant]

I should clarify: It was supposed to roll out for everyone using Automatic Updates. At work, Automatic Updates are limited to critical updates if you are just a User. Admins can update everything at any time.

[epp_b]

Is KB891711 safe yet??

[Marsden11]

What is unsafe about it? I'm just curious what you think is unsafe about it.

[epp_b]

Safe meaning "Will it screw up my entire OS like last time or have they done something to fix it?"Read on...

Hi Zlim,Is there anymore info posted on the internet regarding the problems 891711 is causing?  I'm also having super bigtime problems and can't find anything posted on the internet regarding it.  I have WinMe and when my windows update downloaded/installed 891711 and 888113 everytime I use IE or other similar applications I get the blue screen of death.  I had to use system restore to put things back in order (but then that blew up my Norton AntiVirus installation and I had to reinstall that... nothing but major headaches).I hope Microsoft resolves this, but as I said before I haven't heard much news at all aside from your comment on this forum.Thanks and regards, Fish

<{POST_SNAPBACK}>

I ran into this Sat.  PC would boot to a BLACK (not blue) screen.  I booted to Safe Mode and used MSCONFIG to stop KB891711 from starting which resolved the booting problem.I also noticed that they were running an older version of the free version of ZoneAlarm (the one I put on last fall).  I upgraded it to the current version.  After booting and seeing everything was OK I reenabled KB891711.  Rebooted and the system came up fine.hth

<{POST_SNAPBACK}>

I just had a laptop that hit my bench that was spyware invested and never had ANY updates.  Still running IE 5, ick.  Got it clean and fully patched and KB891711 stop it cold.  Would freeze on boot up.  Uninstalled it and everything is fine.  I would seriously avoid this patch on 98.

<{POST_SNAPBACK}>

[zlim]

I installed the latest KB891711 patch on my 98SE and didn't notice a problem BUT, all computers are different so there is no guarantee.Startup Monitor informed me that it wanted to run at startup...I didn't let it. I'm not sure if that somehow negates the protection. I'll have to search a bit more to find out.

[rbdietz]

(Emphasis added)

Technical updateApril 12, 2005:• Security update 891711 Microsoft Windows Millennium Edition, Windows 98 Second Edition, and Windows 98 packages were re-released on April 12, 2005.• When you install the security update 891711 original packages on a computer that is running Windows Millennium Edition, Windows 98 Second Edition, or Windows 98, the computer may stop responding. This issue has been corrected in the April 12, 2005, release.• The April 12, 2005, release runs as a system service on Windows Millennium Edition, Windows 98 Second Edition, and Windows 98. The Close Program dialog box does not list Kb891711.exe.• The "Known issues" section was added to this article.

http://support.microsoft.com/kb/891711

[Guest LilBambi]

Have not run into problems with this patch on computers I have updated running Win98SE, but I always make sure the latest ZoneAlarm is on the computer before updates and disable antivirus during updates. My own Win98SE box had no problems with any of the updates in the list either, but as always, as zlim mentioned, each computer is different and yes, it is in my msconfig starting on boot.However, many folks are still having trouble with this patch! NetZero sometimes causes problems, and other places identify other causes as noted from the following Google search, some folks still feeling its effects even since the April 2005 update for 891711:http://www.google.com/search?q=891711+prob...:en-US:officialIncluding one that states:

Name: KenOathDate: March 26, 2005 at 19:55:39 PacificSubject: 891711- MS comes clean & owns up.OS: Win98se + XP pro.CPU/Ram: athlon2400+/512mb ramComment:    Well browsing the web today I found an    article that claims MS has owned up to the    fact the patch was never meant for 98-ME &    by uninstalling the patch your system    becomes vulnerable to the effects the patch    was designed to fix..

On behalf of the Microsoft Security Response Center (MSRC), the following message was just posted to the 95, 98, and ME general discussion newsgroups concerning Security Bulletin MS05-002:Microsoft has received reports about issues with KB891711 on Windows 98, Windows 98 SE and Windows ME. At this point, we have been able to confirm these reports and are currently working on a resolution.Please note that by uninstalling the current update, the machine will return to a vulnerable state. At this point, we are currently not aware of customer's being exploited by way of the vulnerability fixed in MS05-002 on Windows 98, Windows 98 SE and Windows ME. If you need additional assistance regarding this update, please contact +1 (866) PCSAFETY. When calling, please indicate that you are having issues with a security update.Source:http://bink.nu/Article3716.bink

Here's some info from MS05-002 Vulnerability in Cursor and Icon Format Handling Could Allow Remote Code Execution (891711):http://www.microsoft.com/technet/security/...n/ms05-002.mspxIssued: January 11, 2005 - Updated: April 12, 2005 - Version: 2.0From the FAQ:

Why was this security bulletin updated on April 12, 2005?After the release of the MS05-002 security bulletin, Microsoft became aware of an issue affecting customers deploying the Windows 98, 98SE and ME security update. In most cases, the issue caused machines to unexpectedly restart.Microsoft has investigated this issue and has made available revised security updates for these platforms. These revised security updates are available from Windows Update and the Microsoft Download Center. Customers who have not yet applied the original version of these updates should visit Windows Update to receive the revised updates.Customers who have already applied the original Windows 98, 98SE and ME security update are advised to install the current revision of the update from Windows Update.

Are Windows 98, Windows 98 Second Edition, or Windows Millennium Edition critically affected by any of the vulnerabilities that are addressed in this security bulletin?Yes. Windows 98, Windows 98 Second Edition, and Windows Millennium Edition are critically affected by this vulnerability. A Critical security update for these platforms is available and is provided as part of this security bulletin and can be downloaded only from the Windows Update Web site. For more information about severity ratings, visit the following Web site.

Leads were found here: http://www.computing.net/windows95/wwwboar...rum/164793.htmlAs always, be cautious with any updates since each person's mileage will vary depending on the computer's state at the time.

[Guest LilBambi]

More here on Annoyances.org:Update KB891711 still being offered!?http://www.annoyances.org/exec/forum/win98/t1112108074But so far most of the comments were prior to the April 12th patches.But some of the best information on this is on DSLReports here:http://www.dslreports.com/forum/remark,12875676~mode=flat

Re: Problem after MS update KB891711- Solved!Well I figured out what had been causing my system to crash whenever I tried to open Internet Explorer. I have “Proxomitron Ver. Naoka-4.5” installed and running on my PC. It must be in conflict with and be causing KB891771.exe to crash my PC when attempting to access the Internet. I have read that a few people have experienced similar problems with some other browsers and I’m guessing that their web filters maybe also causing similar problems to the one I experienced.MS did get back to me and said they had passed my issue on to their “Support Professionals”. I’ll post any word I hear from them concerning the problem.In the meanwhile I'll stick with Proxomitron.

So it looks like any number of items can cause the problems including, older versions of ZoneAlarm, NetZero ISP, Proxomitron, some ethernet connections, and more. Some folks report BDODs, some black screen and won't boot, others report Explorer and/or IE crashes, some programs like Adobe PDF reader and Firefox excessive CPU usage, it runs the gamut.But in all cases where there were prooblems with the patch was reported, unclicking it in msconfig seems to solve the problem.And this patch does appear to be critical even on Win98SE/ME since there are multiple trojans that have taken advantage of this flaw:Windows "Icon and Cursor Bug" Patch Problems PersistMarch 31, 2005

Microsoft is urging people experiencing trouble with this patch to call the company’s Product Support Services line at 1-866-PCSAFETY.Symantec has catalogued no fewer than seven viruses that try to infect Windows PCs using this flaw. The latest, dubbed "Trojan.Anicmoo.c," surfaced just yesterday, details of which are displayed prominently on Symantec's home page.If you are using one of these Windows versions and are experiencing problems after installing this patch, three factors should influence any decision you make to uninstall the patch:  Are you using a hardware or software firewall? Do you have up-to-date anti-virus software installed? Do you and those who use your computer refrain from clicking on random e-mail attachments? If the answer to all three questions is "yes," then it is probably safe to remove this patch until Microsoft issues a fixed version, which could be as early as April 12, the next time the company is slated to release a batch of security fixes.

http://blogs.washingtonpost.com/securityfi...stute_read.htmlhttp://www.symantec.com/index.htmhttp://securityresponse.symantec.com/avcen....anicmoo.c.htmlAdditional information on exploits on this flaw:March 30, 2005 - Malicious Website / Code Alert: ANI exploit / SDBot http://www.websensesecuritylabs.com/alerts...Section=Detailsin the last page or two of the first DSLReports topic and also in a Second DSLReports topic below indicates that many who were having problems with the old patch, are no longer having problems with the updated patch. And a few others were having some slowness issues, but not outright crashes.CaptnHook sums it up pretty well:

Well look at what Microsoft can do when they really want to!A revised ..rewritten .. re-released patch that works!No longer is it running as a program task in Task Manager.. no long does it conflict with proxies..different browsers or web filters!..and no BSOD at least not on this box.. Well done!

http://www.dslreports.com/forum/remark,13151929I concur...the new patch is in my msconfig but is not listed in the processes and is working well on my Win98SE computer.Hope some of these items will help you all decide how you will proceed. Edited April 15, 2005 by LilBambi

[epp_b]

Ouch. Methinks I'm still going to wait on this one

[Marsden11]

Seriously folks... do the Win9X users of the world feel that MS is going to support their 7+ year old operating system forever? That is just not grounded in reality! Do Win2K or XP users have any of these issues?You have an old OS combined with the possibility of out of date 3rd party programs. Throw in user error (not keeping machine up to date) and cover all that with new code and it spells disaster. Not to mention no data protection with FAT 16/32.High time for Win9X users to bite the proverbial bullet and move forward; at least to Win2K or Open Source and leave the 16/32 bit windows on DOS behind.This may sound harsh to some here but I quit helping friends with 98 around 1 1/2 years ago. I got tired with the constant phone calls for free support. Please move to an OS that you can boot from the CD and throw the floppies away. Shudder, I still remember the 14 floppy disk Win95 installs which took forever. I really believe that Win9X holds people back from their computing potential with the constant barrage of OS issues. I just want to turn my machine on (or wake it up) and do what I want to do and not have to hassle with constant problems. I have never known a Win9X user that has not had at least one major issue per week. And this is not just about the OS but also includes the 3rd party programs that talk big but don't deliver reliability.

Edited April 16, 2005 by Marsden11

[epp_b]

Seriously folks... do the Win9X users of the world feel that MS is going to support their 7+ year old operating system forever? That is just not grounded in reality! Do Win2K or XP users have any of these issues?You have an old OS combined with the possibility of out of date 3rd party programs. Throw in user error (not keeping machine up to date) and cover all that with new code and it spells disaster. Not to mention no data protection with FAT 16/32.High time for Win9X users to bite the proverbial bullet and move forward; at least to Win2K or Open Source and leave the 16/32 bit windows on DOS behind.This may sound harsh to some here but I quit helping friends with 98 around 1 1/2 years ago. I got tired with the constant phone calls for free support. Please move to an OS that you can boot from the CD and throw the floppies away. Shudder, I still remember the 14 floppy disk Win95 installs which took forever. I really believe that Win9X holds people back from their computing potential with the constant barrage of OS issues. I just want to turn my machine on (or wake it up) and do what I want to do and not have to hassle with constant problems. I have never known a Win9X user that has not had at least one major issue per week. And this is not just about the OS but also includes the 3rd party programs that talk big but don't deliver reliability.

<{POST_SNAPBACK}>

Yeah, I know...I'm trying to suck every second of update support I can from M$ I just can't decide how I'm going to upgrade to XP (upgrade desktop, new desktop, new laptop...)

[Marsden11]

I had a client call last week and complain about an error message that keeps popping up and freezing his windows video editing machine.I ask him what the OS is and he replies, "Windows 95..." I laugh and he is not amuzed. I ask if his video editing program can run on a newer platform. He says, "no!" I asked him if he had searched Google. He found no relief there and nothing on MS Technet. His editing program is no longer made.I told him it was time to move on. He got testy and I asked him if the program had any support available. Was there any support available from MS? The answer was no to both. He asked me what to do. I told him to move forward. If you can't fix the issue, what other choice do you have?I was having a hard time imagining how one would edit video on Win95 with only 128 MBs of RAM. 128MBs was pretty expensive back in '95!!!

Edited April 16, 2005 by Marsden11

[epp_b]

Yikes!

[Guitar Man]

I have to agree with Marsden11 :You are using an antiquated OS, are no longer supported, cannot run many of the newer games, applications, etc...It's time to get off the Win9x bandwagon, and move into the new millenium. Besides all this, anyone using Win9x OSes are simply unsafe. Period.And don't just upgrade; do a complete clean install, up to SP2. You'll find you have a very stable system, if done correctly with the proper hardware and sufficient RAM.But this just my opinion.

[epp_b]

By "upgrade", meant upgrading the hardware. Never would I buy an "upgrade" version of software. Ouch.

[Marsden11]

You can do a "clean install" with an upgrade version. Just give it the downgrade OS CD when it prompts you for it.

[epp_b]

Interesting :hmm:I think I'd still get a full-install retail or OEM disc - one less CD to worry about

[Peachy]

Is KB891711 safe yet??

<{POST_SNAPBACK}>

Yes. Apparently, Microsoft now says it is and re-released the patch on Super Tuesday of this past week: http://www.microsoft.com/technet/security/...n/MS05-002.mspx

Frequently asked questions (FAQ) related to this security updateWhy was this security bulletin updated on April 12, 2005?After the release of the MS05-002 security bulletin, Microsoft became aware of an issue affecting customers deploying the Windows 98, 98SE and ME security update. In most cases, the issue caused machines to unexpectedly restart.Microsoft has investigated this issue and has made available revised security updates for these platforms. These revised security updates are available from Windows Update and the Microsoft Download Center. Customers who have not yet applied the original version of these updates should visit Windows Update to receive the revised updates.Customers who have already applied the original Windows 98, 98SE and ME security update are advised to install the current revision of the update from Windows Update.What updates does this release replace?This security update replaces a prior security bulletin. The security bulletin ID and operating systems that are affected are listed in the following table.

[epp_b]

Thanks, Peachy! :)I'll try this patch tomorrow.(Sheesh, doesn't M$ test their patches first? )

Edited April 17, 2005 by epp_b

[epp_b]

Well, I ended up not installing that update (KB891711) the next day afterall...so I finally got around to it today, but...it's not there! And to confirm that I haven't yet installed it, KB891711 is not in the installation history.I have, however, installed KB890923. Since this is a cumulative update for MSIE, could the same thing that KB891711 fixes been "interworked" into KB890923?Has anyone else noticed this? Any other theories? I'd hate to think I'm still vulnerable here.

[Ed_P]

My Win98 systems are showing KB891711 in the MSconfig Startup window. The file date for KB891711.exe is 3/23/05.If you go to Windows Update then the Update Catalog, select Win 98 and Sort by Posted Date it's the 2nd one down.

[epp_b]

Thanks Edp. When I installed KB891711 the first time, I actually restored a physical backup of my system partition so that there was no "history" of it whatsoever.Odd...I just checked Windows Update again, and those two updates are there now! I'll install them and see what happens.

[Peachy]

Okay boys and girls, this month's security update from Microsoft only affects Windows 2000 and Windows 98:http://www.microsoft.com/technet/security/...n/MS05-024.mspxMicrosoft Security Bulletin MS05-024Vulnerability in Web View Could Allow Remote Code Execution (894320)

[epp_b]

Uh...is it not on Windows Update yet?