DonationCoder.com Forum
Main Area and Open Discussion => General Software Discussion => Topic started by: 40hz on April 12, 2013, 09:54 AM
-
Posting this as an FYI.
Got my first call from a client about this problem yesterday. She had a laptop that wouldn't restart following the installation of a security update from Microsoft's WSUS that was included in a group of updates made available on 9-APR-2013.
Microsoft is aware of the problem and has posted instructions on how to fix it here (http://support.microsoft.com/kb/2839011). The symptoms, as described by Microsoft, are as follows:
You receive an Event ID 55 or a 0xc000021a Stop error in Windows 7 after you install security update 2823324
Article ID: 2839011
Symptoms
Microsoft is investigating behavior where systems may not recover from a restart, or applications cannot load, after security update 2823324 is applied. We recommend that customers uninstall this update. As an added precaution, Microsoft has removed the download links to the 2823324 update while we investigate.
Only got one call so far. Fingers crossed. :-\
-
I think that may be the wrong link to the instructions. :-\
-
I think that may be the wrong link to the instructions. :-\
-app103
Thx April. Apologies. Fixed now. :-[
-
Thanks for the warning 40 :up:
Luckily they worked fine here (Win.7 64bit)
-
^Yeah. All of mine were ok, and I only got one call so far so I'm optimistic it's an oddball problem.
Microsoft also pulled the patch until they figure out what the problem is. My client had her machine set to "download and notify" but not install. Unfortunately, she downloaded the patch before it got pulled - but then installed it yesterday - after the fact. That was the part that threw me.
So it goes. (And it's all billable time!) ;)
-
So it goes. (And it's all billable time!) ;)
-40hz
Gettin' paid by the hour and older by the minute... :)
-
And hence my tag-line:
((((TINMAN))))
----------------------------------------------------------
(Duck! It's another MicroSoft Patch!)
-
This is the first big-bad patch warning from MS I've seen in a while. Usually I take my time installing them, but more from a hassle point, not so much of distrusting MS. That honor goes more towards Adobe :P
-
I have long thought that the biggest threat to a Windows computer is not malware but MS Updates.
About a month ago I went through my three computers sorting out updates that had refused to install, in total there was well over thirty of them, two thirds on the same computer and nearly all relating to the NET Framework.
It took me seven hours altogether, much of that looking up solutions on the internet, and for the first time since the first update on my first PC there are no updates outstanding although each computer has several hidden that are not relevant for one reason or another.
My pet hate is that you keep getting notified about an update but when you go to install it you are informed that the relevant program is not installed!
Then why the ******* hell do you keep getting told you need it?
Actually in rare cases it can be therapeutic, I heard of a doctor who advised his patients with low blood pressure to buy a Windows computer.
-
I have long thought that the biggest threat to a Windows computer is not malware but MS Updates.
-pilgrim
Speaking from the perspective of somebody who is responsible for the health and safety of a large number of Windows PCs and servers, I'd have to politely agree to disagree with you on that point. From my experience, about 50% of all serious Windows problems can be directly attributed to the failure on the part of the owner to be current with Microsoft's critical updates.
If the automatic updates are not installing, it's a very clear indication that there's another critical issue on a machine that needs to be addressed. This can range from an unsuccessful previous installation attempt, a corrupted system file, or the presence (or residual/collateral damage) from some unusually nasty malware.
That said - it would be nice if Microsoft's updater was a little more verbose. And also if it could be more helpful in notifying the user that there has been a problem. Because I have seen the same problem you had (although only on XP machines). Usually right after I receive a call from someone who got referred to me because their system was seriously infected with malware.b Something that came as a complete shock to the owner because they had a quality antivirus utility installed on their machine. They usually learn that their realtime scanner - and the security center notification - had also been disabled without their knowledge.
Updates...they're like oatmeal. You may not like it - but make it a regular part of your diet anyway. ;D
-
It seems that we are more forgiving until its us. I just reinstalled on my son's laptop... and decided to enable automatic updates. He came to me this morning saying that his computer kept going to this 'black screen'. And yeah... since it's an old Sony that they only include "Recovery DVDs" instead of the OS, it's been a pain. And all of their recovery steps have... you guessed it... not included Windows XP.
-
The worst lesson one could get out of these situations is to distrust updates, MS or otherwise. I am not a pro like 40hz but speaking from some experience I would say he is very right.
-
I think you have to take a more measured approach. What I usually do is disable *automatic* updates. Then, a week (or more) after update Tuesday and all of the furor has died down, I download and install the updates manually. I just don't want to trust anyone to automatically do anything to my computer. Because if it borks up, are they going to take responsibility for it?
I'll evaluate and decide whether to take the risks, and take the responsibility for my choices. I've been bitten once about 15 years ago... and to a large extent, that was my fault, as I was hosting my own web site when code red came out and wasn't keeping up to date. It hurt, but at least it was my fault.
In this case, it hurts... but it's nothing that I did. And that's a hard pill to swallow, especially since it seems I'm now looking at several hours to restore his computer. Thankfully, nothing is lost, but it's still a pain, and a drain.
-
@Wraith - That's a bloody nuisance for sure!
BTW is it just me, or does it seem like Sony loves to make things just a little more complicated that they need to be with their products? I have had more weird issues with Sony desktops (Vaio) and laptops than just about any other brand. To me they were like that "little girl who had a little curl." Because when a Vaio is good, it's very very good - but when it's not...forget it!
:-\
-
^ Yes but then you are weighing the 'pros and cons' of being affected by something like a 0 day exploit vs BSOD from bad updates.
EDIT: Vaio laptops ... have been disappointing in my limited experience
-
Oh no... I totally agree. I was onboard with Sony until their complications started making my life complicated. They were trying to be Apple for a while... with much worse results. I think they're better now. But I'm not taking any more chances, and have been slowly migrating them out the door in regards to computers.
^ Yes but then you are weighing the 'pros and cons' of being affected by something like a 0 day exploit vs BSOD from bad updates.
EDIT: Vaio laptops ... have been disappointing in my limited experience
-rgdot
And pros and cons considering that I've been hit once in over 25 years by exploits, vs being hit 3 times by automatic patching (and missing being hit a few other times from the articles I've seen).
It might not work for others, but a week is acceptable risk for me.
-
I think you have to take a more measured approach. What I usually do is disable *automatic* updates. Then, a week (or more) after update Tuesday and all of the furor has died down, I download and install the updates manually.
-wraith808
+1! That's what I personally do and recommend doing. The real problem is in getting the clients to allow the installations, and not just tell WSUS to "remind me later" that there's a downloaded update waiting to be installed.
I love sitting down in front of a machine and seeing that little reminder pop up. Especially when I tell it to run and it shows it has something like 50 updates totaling around 200Mb that go back six months which are still sitting in the queue. :huh:
-
I wish I knew or had the time to create a script for the computers on my network to automagically do it a week after the update notification. I know its possible... but I just haven't had the time to look into how to do it.
-
^ Yes but then you are weighing the 'pros and cons' of being affected by something like a 0 day exploit vs BSOD from bad updates.
-rgdot
And pros and cons considering that I've been hit once in over 25 years by exploits, vs being hit 3 times by automatic patching (and missing being hit a few other times from the articles I've seen).
It might not work for others, but a week is acceptable risk for me.
-wraith808
I'm 1 for 1. Had one bad update in 25+ years crowbar a machine. And that was a hardware driver in the optional list. Took a safe boot and a rollback to fix it.
The hit came out of the blue while surfing. It was a few years back. Went to something (a suposed tech info article) off a link at one site and got slammed by something that romped over every piece of security software I had installed like it didn't exist. Whatever it intended to do didn't get to happen because I immediately pulled the CAT-5 out the minute I saw the system go completely haywire and the net traffic on the NIC go through the roof. About three minutes later I was looking at a completely borked machine.
Had to pull the drive and sanitize it, first under Linux, and then under Windows to get rid of it. And even then I didn't trust that drive enough to do anything other than recover user data before reformatting.
Never found out what it was I got hit with. But whatever it was, it was one nasty bit of work. After that I stopped being quite so skeptical about all the reports and rumors you hear about "box killer" malware out in the wild. Because it's hard to believe until you actually see an example in action. However, seeing it happen to one of your own machines can sure make you a believer in no time flat. :tellme:
-
In spite of my view of MS Updates (and many other things MS) I would always advise people, especially those who were not particularly computer literate, to have MS Updates set to automatic. Mine are all set to notify only.
Going back to the events I mentioned in my previous post, I had one update that I had tried every method I could think of to install, nothing worked.
MS had not listed it as a problem even though I found several forums where people were having trouble installing it but none of them had found a solution.
Finally, after a lot of time I found a thread on a forum I had never visited before in which it was not the main topic but someone mentioned this particular update and suggested that you should download the installer and manually extract the files, then place one of them in the System32 folder. The minute I did that it installed.
This raises a whole range of questions in my mind which I won't bother to go into as most of them are self evident.
Much of the way we view things is based on our personal experiences, I have read many stories of disasters brought about by malware, the worst thing I've ever found on one of my computers was a tracking cookie, along with my share of false positives.
Going back to the update this thread originally mentioned I found that it had installed on my Windows 7 computer without issue and as it had been there a couple of days without incident I have decided to not tempt fate and leave it there.
-
I don't think anyone has mentioned the weekly Windows Secrets Newsletter (https://windowssecrets.com/newsletter/), but it includes a column called "Patch Watch" where Susan Bradley discusses the Microsoft Updates (and occasionally other updates as well) that have been newly released and talks about which ones she has had no problem with, which ones she or others HAVE had problems with, and offers a judgment: Install, Wait, Skip, Optional. She updates her advice in the coming weeks. I never install updates until I've read Bradley's column. So far, it has served me well. At times, I get Updates that she hasn't mentioned, but mostly she covers the ones I receive. IIRC, the Newsletter is "pay what you wish" for a year's subscription.
There's also a Windows Secrets Forum (http://windowssecrets.com/forums/).
-
http://www.askwoody.com/category/microsoft-windows-patches-security/
This is Woody Leonhard's Patch site. It's been interesting since he joined forces with Susan Bradley and others, since sometimes they don't have the same take on potential patch problems.
I like to let others be the first patchers, read about their experiences, and then patch a few weeks later if it's safe. And I always do a full backup before patching.
-
zdnet.com (http://www.zdnet.com/microsoft-pulls-patch-tuesday-security-fix-7000013942/?s_cid=e550&ttag=e550) article says MS recommend uninstalling this patch.
Microsoft recommends that users uninstall the patch, and warns that another issue with the security update may cause anti-virus programs cease to work correctly. The Redmond giant says that Kaspersky Anti-Virus for Windows Workstations and Kaspersky Anti-Virus for Windows Servers versions 6.0.4.1424 and 6.0.4.1611 may display an error message stating that licenses for the products are not valid, and so the software will cease to function.
But they dont clarify if MS mean everyone should uninstall it - or just those with problems.
They link to this (https://support.microsoft.com/kb/2839011) from MS which talks about *if* you revceive an error.
So I guess I'll leave it in place for the moment (maybe :-\)
Shoddy journalism on the part of zdnet imo.
-
I think I found out another issue with this update : Sandboxie (latest V3) refused to work until after I uninstalled this patch. Found that on Sandboxie user forum.
-
Posting this as an FYI.
Got my first call from a client about this problem yesterday. She had a laptop that wouldn't restart following the installation of a security update from Microsoft's WSUS that was included in a group of updates made available on 9-APR-2013. -40hz
I read on (I think PCWorld) that MS released a notice that anyone having problems with this patch should boot up in safe mode and uninstall the patch, and adding it to the "Ignore" list on Windows Updater.
-
I have long thought that the biggest threat to a Windows computer is not malware but MS Updates.
About a month ago I went through my three computers sorting out updates that had refused to install, in total there was well over thirty of them, two thirds on the same computer and nearly all relating to the NET Framework.
It took me seven hours altogether, much of that looking up solutions on the internet, and for the first time since the first update on my first PC there are no updates outstanding although each computer has several hidden that are not relevant for one reason or another.
My pet hate is that you keep getting notified about an update but when you go to install it you are informed that the relevant program is not installed!
Then why the ******* hell do you keep getting told you need it?
Actually in rare cases it can be therapeutic, I heard of a doctor who advised his patients with low blood pressure to buy a Windows computer.
-pilgrim
And OMG! I could tell you a horror story about my troubleshooting nightmares with MS Tech Support on the .net Framework fiasco. It's been haunting me for years and years, and MS STILL DOESN'T HAVE IT FIXED!!! And of all the crazy things that MS had me do in order to get the problem solved, wasted hours, wasted days of trying to fix it, and the VERY LAST thing they had me do was to remove .net Framework updates from Windows Update after they were updated, because they had no idea on how to fix it.
So every time there's a patch for .net framework, I let it update, reboot, let Windows Update tell me there is an update for it, then uncheck it from the Updater to force it not to look at that particualar update again. MS had me jumping through hoops trying to get it fixed and then resorting to this to make it stop. Simply sad..... :(
-
Tinman,
I never had direct dealings with MS but I tried everything else I could think of over the years including completely uninstalling then reinstalling the whole .net framework, twice!
When I finally sorted it out recently I made a list of all the .net updates that I had hidden and searched online for each one using the KB numbers, as I said it took a long time but I finally tracked down solutions to all of them, much to my surprise.
-
@pilgrim/T-man - um...I think you made a lot more work for yourselves than you needed to.
[ You are not allowed to view attachments ]
Microsoft has tools available to deal with NET Framework installation problems.
[ You are not allowed to view attachments ]
.NET Framework Verification Tool (download here (http://blogs.msdn.com/cfs-file.ashx/__key/CommunityServer-Components-PostAttachments/00-08-99-90-04/netfx_5F00_setupverifier_5F00_new.zip)) :huh:
The .NET Framework setup verification tool is designed to automatically perform a set of steps to verify the installation state of one or more versions of the .NET Framework on a computer. It will verify the presence of files, directories, registry keys and values for the .NET Framework. It will also verify that simple applications that use the .NET Framework can be run correctly.
[ You are not allowed to view attachments ]
.NET Framework Repair Tool (info and download here (http://support.microsoft.com/kb/2698555)) 8)
Overview
The .NET Framework repair tool detects frequently occurring issues with the .NET Framework setup or updates. The tool tries to resolve those issues by applying known fixes or by repairing the installed version of the .NET Framework. The tool can also be used to repair corrupted installations of supported .NET Framework versions. This includes .NET Framework 4 language packs. The tool is wizard-based and is easy to use.
The .NET Framework repair tool follows a four-step process:
- Tries to troubleshoot setup issues.
- Applies the fixes (with user consent).
- Tries to repair the installed versions of the .NET Framework (the .NET Framework 4, the .NET Framework 3.5 SP1, the .NET Framework 3.0 SP2, and the .NET Framework 2.0 SP2).
- Collects logs (with user consent).[
[ You are not allowed to view attachments ]
And if both the above fail, there's always the absolute last resort:
[ You are not allowed to view attachments ]
.NET Framework Cleanup Tool (Download link here (http://blogs.msdn.com/cfs-file.ashx/__key/CommunityServer-Components-PostAttachments/00-08-90-44-93/dotnetfx_5F00_cleanup_5F00_tool.zip)) >:(
This .NET Framework cleanup tool is designed to automatically perform a set of steps to remove selected versions of the .NET Framework from a computer. It will remove files, directories, registry keys and values and Windows Installer product registration information for the .NET Framework. The tool is intended primarily to return your system to a known (relatively clean) state in case you are encountering .NET Framework installation, uninstallation, repair or patching errors so that you can try to install again.
There are a couple of very important caveats that you should review before using this tool to remove any version of the .NET Framework from your system:
- This tool is designed as a last resort for cases where install, uninstall, repair or patch installation did not succeed for unusual reasons. It is not a substitute for the standard uninstall procedure. You should try the steps listed in this blog post before using this cleanup tool.
- This cleanup tool will delete shared files and registry keys used by other versions of the .NET Framework. If you run the cleanup tool, you will need to perform a repair/re-install for all other versions of the .NET Framework that are on your computer or they will not work correctly afterwards.
If you need to run the cleanup tool, I'd recommend you download a copy of the most recent version (currently .NET Framework 4 Client Profile) of the .NET Framework installer before you remove anything. In most cases all you'll need is the most recent version of .NET since there's a good amount of backwards compatibility between versions - although there are some poorly coded programs that will insist on a specific version of .NET. If that's the case, they can always be installed later.
You can find all the .NET redistributable download links here (http://www.microsoft.com/en-us/download/search.aspx?q=.net%20framework&p=0&r=10&t=&s=Relevancy~Descending).
[ You are not allowed to view attachments ]
Hope the above is helpful. :)
-
@pilgrim/T-man - um...I think you made a lot more work for yourselves than you needed to.
Microsoft has tools available to deal with NET Framework installation problems.
-40hz
It's a pity that none of them worked!
I tried everything else I could think of over the years
-pilgrim
I have had all 3 of those tools for a long time, plus the Windows Install Clean Up Utility, I also have all the redistributables from v1 to v4.
My comment which I have quoted again above can, I assure you, be taken literally.
I also came across, what is for me, a .net first the other day, I downloaded a program I wanted to have a look at and when I went to run it I was informed that it required .net 4.5!
Oh joy, there's another one.
-
^What can I say? Your case is unique! ;D
I've probably dealt with a few hundred issues with NET Framework over the years. And with one exception (where Windows was already borked to begin with) one or more of the above three worked the charm.
Like the old song says: YMMV. :Thmbsup:
-
^ I did appreciate the outtakes from The Fifth Element, however. Very nicely staged :)
-
^Thx. I'll use any excuse to put Milla up on a webpage. ;D
She's from Kiev originally too. Makes me happy to see a 'local girl' do well. :Thmbsup:
-
Semi-OT.
With regard to updates, beware of the last update of Malwarebytes Antimalware:
http://www.eteknix.com/thousands-of-computers-attacked-by-malwarebytes-monday
-
@pilgrim/T-man - um...I think you made a lot more work for yourselves than you needed to.
Microsoft has tools available to deal with NET Framework installation problems.
-40hz
It's a pity that none of them worked!
I tried everything else I could think of over the years
-pilgrim
I have had all 3 of those tools for a long time, plus the Windows Install Clean Up Utility, I also have all the redistributables from v1 to v4.
My comment which I have quoted again above can, I assure you, be taken literally.
I also came across, what is for me, a .net first the other day, I downloaded a program I wanted to have a look at and when I went to run it I was informed that it required .net 4.5!
Oh joy, there's another one. -pilgrim
I tried those too, and they didn't work for me either. All it did was cost me a lot of time and effort cleaning and re-installing the .net nightmare. Like I said before, the only thing that works for me is to mark the .net update(s) as ignored after installing them.....
-
Semi-OT.
With regard to updates, beware of the last update of Malwarebytes Antimalware:
http://www.eteknix.com/thousands-of-computers-attacked-by-malwarebytes-monday
-Giampy
Giampy, I think your message is rather misleading. The update in question was a definitions update issued a week ago. As the article you linked to reports, the faulty update was pulled just a few minutes after it was issued. Malwarebytes issues a number of definitions updates every day, so when you say "beware of the latest update of Malwarebytes Antimalware," you're giving a rather misleading warning. There have probably been more than 30 definitions updates issued since the faulty one; it's nowhere close to being the "latest update." And though the faulty update did create some major problems for the thousands of MBAM users who received it, I should also point out that most people who use MBAM never received the faulty update, since it was pulled so quickly after it was released.
-
^ :Thmbsup: Exactly. Thanks for posting this clarification. A bad situation, but only if you got caught immediately. The information is good to have, as it includes a link to a fix, however.
-
Malwarebytes issues a number of definitions updates every day, so when you say "beware of the latest update of Malwarebytes Antimalware," you're giving a rather misleading warning-cyberdiva
I didn't know Malwarebytes issues updates so frequently. Therefore the danger has gone.
Note: lately there has been a bad update from Malwarebytes, a bad update from Windows, a bad update from Comodo Antivirus. It's an epidemic!
-
I didn't know Malwarebytes issues updates so frequently.
-Giampy
In the quoted page that you linked to (in the second paragraph), it states:
On April 15 at approximately 3 P.M. (PDT) Malwarebytes was updated, this update disabled thousands of computers within just a few minutes. Though the issue was caught in the initial few minutes of the release the damage had already been done.
...
Malwarebytes acted swiftly in working to disable the update and removing it from their servers. Unfortunately the damage had already been done. And they have apologised for their mistake, taking the blame.
-
Note: lately there has been a bad update from Malwarebytes, a bad update from Windows, a bad update from Comodo Antivirus. It's an epidemic! -Giampy
Giampy, do you use Comodo Antivirus, and if so, how do you rate it? I use the firewall myself and it's really awesome, but since Avast! has been doing such a good job I never tried Comodo Antivirus.
-
(https://www.donationcoder.com/forum/esmileys/gen3/2Signs/OFFTOPIC.GIF)
Giampy, do you use Comodo Antivirus, and if so, how do you rate it?-Tinman57
I use it for one year but I have never dealt with real viruses, so I haven't sufficient data to judge the efficacy of Comodo Antivirus.
I can only say it sometimes reports false positives. However consider that I set heuristics sensitivity at the maximum and that some false positives are far better than an overlooked virus...
Therefore those few false positives are excusable and even well-accepted.
With regard to cohabitation of Comodo and my system (Windows XP) I report that Comodo sometimes causes slowing down (pauses) to certain operations. This is the bad of Comodo.
However the situation is bearable.
-
some false positives are far better than an overlooked virus...
-Giampy
Tell that to a couple of my customers after AVG decided that the lower filter for the Xen disk subsystem was a virus. No problem there until their boxes were rebooted, which resulted in a nice 7B bsod. (Fortunately for the second customer I remembered tracking down the issue for the first...)
-
I think you have to take a more measured approach. What I usually do is disable *automatic* updates. Then, a week (or more) after update Tuesday and all of the furor has died down, I download and install the updates manually. I just don't want to trust anyone to automatically do anything to my computer. Because if it borks up, are they going to take responsibility for it?
I'll evaluate and decide whether to take the risks, and take the responsibility for my choices. I've been bitten once about 15 years ago... and to a large extent, that was my fault, as I was hosting my own web site when code red came out and wasn't keeping up to date. It hurt, but at least it was my fault.
In this case, it hurts... but it's nothing that I did. And that's a hard pill to swallow, especially since it seems I'm now looking at several hours to restore his computer. Thankfully, nothing is lost, but it's still a pain, and a drain.
-wraith808
Just about what I do. I have the updates set to notify me but don’t download or install automatically. I always take a good look at them when notified, but then I wait a week or more until I can get some decent feedback on any problems encountered. I usually search on the updates but I also look at Woody Leonard's DefCon column, Infoworld's Tech Watch pages, and ComputerWorld's update pages. They usually give a good read on the updates each month plus for the unscheduled updates. There are some I'll probably never install, though most eventually make it onto my machine.
Jim
-
some false positives are far better than an overlooked virus...
-Giampy
Tell that to a couple of my customers after AVG decided that the lower filter for the Xen disk subsystem was a virus. No problem there until their boxes were rebooted, which resulted in a nice 7B bsod. (Fortunately for the second customer I remembered tracking down the issue for the first...)
-x16wda
When an antivirus reports a virus, any user should always verify if that is true or not (false positive) before deleting any files.
This should be taught to new users.
-
some false positives are far better than an overlooked virus...
-Giampy
Tell that to a couple of my customers after AVG decided that the lower filter for the Xen disk subsystem was a virus. No problem there until their boxes were rebooted, which resulted in a nice 7B bsod. (Fortunately for the second customer I remembered tracking down the issue for the first...)
-x16wda
When an antivirus reports a virus, any user should always verify if that is true or not (false positive) before deleting any files.
This should be taught to new users.
-Giampy
That's a presumptive statement. Most AV's default to automatically "cleaning" high risk files... which means deleting them. "New users" wouldn’t yet know to configure it any differently.
Jim
-
That's a presumptive statement. Most AV's default to automatically "cleaning" high risk files... which means deleting them. "New users" wouldn’t yet know to configure it any differently.
-J-Mac
+1.
-
I was always under the impression that the default action of most consumer grade AV programs was "Ask what to do" or "quarantine."
i wasn't aware of any AV that had a default delete setting for anything right out of the box because of possible legal and liability concerns.
-
^In my experience, 'quarantine' without warning or explanation is often the default
-
Well I know that in my first (and last!) experience with Kaspersky it automatically deleted a number of programs it determined to be "high risk" based on its heuristics. I kept Kaspersky around for about three months of the one year subscription I had purchased. It was way to strict and not configurable enough for me. It most definitely did not quarantine the program files.
Jim