Author Topic: Feb 9, 2010: Windows Patch Leaves Many XP Users With Blue Screens? (Read 32,871 times)

mouser · « **on:** February 12, 2010, 12:08 AM »

Via Slashdot comes this report that people are experiencing blue screen crashes after applying Windows XP updates on tuesday:

Quote

"Tuesday's security updates from Microsoft have crippled Windows XP PCs with the notorious Blue Screen of Death (BSOD), users have reported on the company's support forum. Complaints began early yesterday, and gained momentum throughout the day."

http://www.computerworld.com/s/article/9155419/Windows_patch_cripples_XP_with_blue_screen_users_claim

from http://tech.slashdot.org/story/10/02/11/2217239/Windows-Patch-Leaves-Many-XP-Users-With-Blue-Screens

cyberdiva · « **Reply #1 on:** February 12, 2010, 12:41 AM »

I'm both puzzled and nervous after reading this article. Both my husband and I have computers running WinXP Pro with SP2, and we both installed all the patches Microsoft issued this Tuesday. Neither of us has experienced the problem described in the article, and yes, we both have rebooted more than once since installing them. It wasn't clear from my hurried reading what percentage of people who installed the patches (esp. the one that has been identified as the probably culprit, KB977165) are encountering this problem. Does anyone have any additional knowledge about this?

Bamse · « **Reply #2 on:** February 12, 2010, 02:03 AM »

I know some people advice to disable auto-update for reasons like this. Usually I think they are paranoid tossers who should know better and rather promote other OS if not even trusting updates. Then again... Hopefully it is a if and if and if limited problem no one could have foreseen.

wraith808 · « **Reply #3 on:** February 12, 2010, 02:55 AM »

I have mine set to notify-- I apply them the next monday if I don't hear anything

Bamse · « **Reply #4 on:** February 12, 2010, 03:09 AM »

Well more like healthy skepticism but you can say SEE???

I was more thinking of little people who will follow such advice, and then not care about updates from that day. Not so many care to research. Pros outweighs cons but probably not easy to tell those in problems right now. Lets hope it is not a major worldwide problem and that details will be revealed.

New flash version out today btw. Look out for toolbars and what else they pre-tick for you

cyberdiva · « **Reply #5 on:** February 12, 2010, 04:24 AM »

I have my updates set to Notify. It was only after waiting a day, having my husband assure me he had encountered no problem, and going to one or two web sites to see whether anyone was reporting problems (and finding none) that I downloaded and installed the updates. So I was taken aback by mouser's message at the start of this thread. At this point, I'm perplexed and am wondering what triggered the widespread problems and yet didn't affect my husband's system or mine (knock on wood

).

CleverCat · « **Reply #6 on:** February 12, 2010, 06:49 AM »

No BSOD here!

f0dder · « **Reply #7 on:** February 12, 2010, 07:42 AM »

Perhaps the people affected by the BSODs already have the malware the patch is trying to prevent, or some problematic antivirus package? Last time security firms went shouting about updates BSODing, it turned not to be MS's fault...

Bamse · « **Reply #8 on:** February 12, 2010, 10:37 AM »

May be https://patrickwbarnes.com/blog/2010/02/microsoft-update-kb977165-triggering-widespread-bsod/

I tried out some of those atapi.sys infections. Have been "popular" last few months. Can only recommend TDSSKiller from Kaspersky http://support.kaspersky.com/viruses/solutions?qid=208280684 Microsoft should bundle it with their removal tool. Does a safe replacement of whatever it finds. Breed like rats, now "third" generation of this rootkit so there could be more new stuff. Also check Hitman Pros changelog http://www.surfright.nl/en/whatsnew "TDL3".

Quote

This rootkit infects the hard disk driver (usually atapi.sys or iaStor.sys) and redirects Google search results.

Think that is what he refer to but there could be more to check than just atapi.sys. I see jraid.sys from Kaspersky page as well. Who knows what happen until they try, heh. Not that many tools can remove this, not when I tried a month ago. Catching up...

cyberdiva · « **Reply #9 on:** February 12, 2010, 01:49 PM »

Many thanks, CleverCat, f0dder, and Bamse, for your helpful and reassuring replies. The explanation about the patch causing havoc only on systems already infected makes some sense and would also explain why not everyone is affected. I hope it turns out to be true.

f0dder · « **Reply #10 on:** February 12, 2010, 01:51 PM »

Quote from: cyberdiva on February 12, 2010, 01:49 PM

Many thanks, CleverCat, f0dder, and Bamse, for your helpful and reassuring replies. The explanation about the patch causing havoc only on systems already infected makes some sense and would also explain why not everyone is affected. I hope it turns out to be true.

Do note that a poster on a blog from one of Bamses links says he got the BSOD even though atapi.sys wasn't infected... so there might be problems on clean systems as well. Or that poster could have some other driver infected, or have pesky antivirus

Bamse · « **Reply #11 on:** February 12, 2010, 02:11 PM »

True but for what it is worth I can reproduce problem in a VM

Evil loop of rebooting. I first installed rootkit, then all updates except 977165. Reboot, everything worked. After 977165 it is game over.

f0dder · « **Reply #12 on:** February 12, 2010, 02:12 PM »

Quote from: Bamse on February 12, 2010, 02:11 PM

True but for what it is worth I can reproduce problem in a VM Evil loop of rebooting.

Hm? What does that screenshot tell? What's the app, and does "suspicious modification" mean rootkit? etc.

Bamse · « **Reply #13 on:** February 12, 2010, 02:15 PM »

It is GMER, one of the best rootkit scanners. Atapi.sys is modified, show no sign of being from MS etc. when looking at properties. All tabs are gone. Generic file now. Startpage in IE was changed as well btw. Porn... I can pm you the link I used for rootkit if you like. There are tons of them but this works on atapi.sys like the blogger hinted was a problem - or one of them. There could be more to this.

f0dder · « **Reply #14 on:** February 12, 2010, 02:19 PM »

Quote from: Bamse on February 12, 2010, 02:15 PM

It is GMER, one of the best rootkit scanners. Atapi.sys is modified, show no sign of being from MS etc. when looking at properties. Startpage in IE was changed as well btw. Porn...

Ah, I thought you could reproduce BSODs without infected driver

Bamse · « **Reply #15 on:** February 12, 2010, 02:21 PM »

No and it would not count anyways since in a VM but for now I think he has a point

Don't feel like testing for real. I am listing to a Linux podcast so lets say it is evil MS scheme to promote Microsoft Security Essentials if not Windows 7 64bit, heh.

Bamse · « **Reply #16 on:** February 12, 2010, 02:28 PM »

Forgot to say I failed at first infection. Ran Dr. Web Cureit and it removed or rather cured problem. Did not select report only. Dr. Web is pretty good with the latest and greatest but perhaps most tools can remove by now.

techidave · « **Reply #17 on:** February 12, 2010, 08:03 PM »

I just ran the windows update on a new install of xpsp3 and didn't see the KB977165 listed. Perhaps MS has pulled it.

cmpm · « **Reply #18 on:** February 12, 2010, 09:55 PM »

Yes they did pull it according to this article-

http://www.ghacks.net/2010/02/12/microsoft-addresses-windows-restart-issues/

Bamse · « **Reply #19 on:** February 13, 2010, 12:01 AM »

They have not really said much yet though http://blogs.technet.com/msrc/archive/2010/02/11/restart-issues-after-installing-ms10-015.aspx

Quote

However, we have not confirmed that the issue is specific to MS10-015 or if it is an interoperability problem with another component or third-party software.

3rd. party software includes rootkits but he did not say that

Would be useful if those with reboot problem would scan with a bootable Dr. Web or whatever.

CleverCat · « **Reply #20 on:** February 13, 2010, 06:43 AM »

Never had a virus! Thanks Kaspersky....

Bamse · « **Reply #21 on:** February 13, 2010, 07:00 AM »

Well good luck with Kaspersky http://www.virustotal.com/analisis/bac03ccb4a9c8bfe484f1328618c715a050ba8b9feae9de1fe2cd20cad77628d-1266031238

Possible failing AVs work much better when exe is fired of. Possible... Expect hit rate to be random regardless of brand.

The file I used was 1-2 weeks old so result is far from impressive. Massive amount of logic in update causing problems or "conflicts" with this type of rootkit.

CleverCat · « **Reply #22 on:** February 13, 2010, 07:13 AM »

It might help if they used the latest version i.e. 9 - 7 is old...

Bamse · « **Reply #23 on:** February 13, 2010, 07:16 AM »

Not necessarily since this is only a dumb filescan. Still a pretty poor result but of course not a problem if resident shields catch everything, heh. Kaspersky is on top of things with their TDSSkiller tool so at least they can remove/fix problem.

I wonder how many AVG users still use version 8.x which did not have any resident protection against rootkits.

CleverCat · « **Reply #24 on:** February 13, 2010, 07:28 AM »

Shields up No.1....