Tip: Run a free scan for common Windows errors ad

re: kb891711 in tasklist ??? Saturday, March 12, 2005 at 8:09 pm Posted by Ms. Eagle (33640 messages posted) What's this update for? I don't want to take time to look it up, but hopefully, it's something that pertains to ME and "applies" to you. Did you reboot after installing? Dealing with Unwanted Spyware and Parasites [Reply or follow-up to this message] re: kb891711 in tasklist ??? - YES Sunday, March 13, 2005 at 12:11 am Posted by Jack Gulley (5917 messages posted) Sorry about the delay, but this has taken most of the evening to research. Short answer, YES - believe it! Microsoft had announce last week that there would be no new Security Updates released this month. So most people were not looking for any updates this week (including me). However, they said nothing about not releasing some of the old MWA (Missing Without Action) Security Updates that they had published, with workarounds, and that patches for selected systems (XP SP2) had already been released. They just updated the prior notices to include Windows 98/ME and provided the MWA Security Updates for these systems. Looking into the details of the problems being fixed, I can understand what it might take to fix them, and the delay in getting the fix out. The notice MS05-002 - Vulnerability in Cursor and Icon Format Handling Could Allow Remote Code Execution (891711) was just updated to include additional details about the exposures and fix releases for Windows 98/ME. The problems being fixed also apply to a number of older versions of OutLook based e-mail program and other MS applications which are not supported with updates, and that could be installed on many systems. The fix also would require an update to the Windows 98/ME kernel module, something difficult to do and control. It would be almost impossible for them to provide the fixes for all of the effected programs. The solution is to install a new module that checks for the different exploits and blocks them. This requires a new Startup entry to start the code on Windows 98/ME systems, and the module showing up in Task Manager. Sort of like an Anti-Virus/Firewall program, except for HTML code processors (IE, e-mail, and Cursor handlers). The fix creates a new folder in the C:\Windows\System folder to contain the patch and from where it is loaded during startup. A real pain for us, but necessary to fix all of the known exposures. (Also allows them a simple way to put out additional fixes for new problems, by updating this programs DLL module, instead of patches to other large modules.) The alternative to using this "critical" fix, is to view all e-mail only in text format (no images or icons) for all Microsoft e-mail viewing programs and never click on any included link. And in IE to block displaying all images and never clicking on icons or using action cursors provided by web sites. Having the older Security fixes installed helps avoid some of the problems, but this fix is required to deal with a very real security exposure. Take the time to read through the above MS05-002 notice and expand all details of it. And from now on, consider it normal to see KB891711 (or its replacement) in the Windows 98/ME startup list and in HijackThis logs. In fact, consider it a security risk (and possible infection) not to see it in these lists. [Reply or follow-up to this message] re: kb891711 in tasklist ??? - YES Sunday, March 13, 2005 at 1:12 pm Posted by hugo defreyne (2 messages posted) This KB891711 is causing "blue screen" error when you try to start an internet connection thru ADSL enternet 300 software On Sunday, March 13, 2005 at 12:11 am, Jack Gulley wrote: > Sorry about the delay, but this has taken most of the evening to research. Short >answer, YES - believe it! > Microsoft had announce last week that there would be no new Security Updates >released this month. So most people were not looking for any updates this week (including >me). However, they said nothing about not releasing some of the old MWA >(Missing Without Action) Security Updates that they had published, with workarounds, >and that patches for selected systems (XP SP2) had already been released. > They just updated the prior notices to include Windows 98/ME and provided the >MWA Security Updates for these systems. > Looking into the details of the problems being fixed, I can understand what it >might take to fix them, and the delay in getting the fix out. > The notice MS05-002 >- Vulnerability in Cursor and Icon Format Handling Could Allow Remote Code Execution >(891711) was just updated to include additional details about the exposures and >fix releases for Windows 98/ME. > The problems being fixed also apply to a number of older versions of OutLook based >e-mail program and other MS applications which are not supported with updates, and >that could be installed on many systems. The fix also would require an update to >the Windows 98/ME kernel module, something difficult to do and control. It would >be almost impossible for them to provide the fixes for all of the effected programs. >The solution is to install a new module that checks for the different exploits and >blocks them. > This requires a new Startup entry to start the code on Windows 98/ME systems, >and the module showing up in Task Manager. Sort of like an Anti-Virus/Firewall program, >except for HTML code processors (IE, e-mail, and Cursor handlers). The fix creates >a new folder in the C:\Windows\System folder to contain the patch and from where >it is loaded during startup. A real pain for us, but necessary to fix all of the >known exposures. (Also allows them a simple way to put out additional fixes >for new problems, by updating this programs DLL module, instead of patches to other >large modules.) > The alternative to using this "critical" fix, is to view all e-mail only in >text format (no images or icons) for all Microsoft e-mail viewing programs and >never click on any included link. And in IE to block displaying all images and never >clicking on icons or using action cursors provided by web sites. Having the older >Security fixes installed helps avoid some of the problems, but this fix is required >to deal with a very real security exposure. > Take the time to read through the above MS05-002 >notice and expand all details of it. > And from now on, consider it normal to see KB891711 (or its replacement) >in the Windows 98/ME startup list and in HijackThis logs. In fact, consider it a >security risk (and possible infection) not to see it in these >lists. [Reply or follow-up to this message] re: kb891711 in tasklist ? - BSOD Sunday, March 13, 2005 at 4:00 pm Posted by Alex (5 messages posted) KB891711 causes "blue screen" on my PC when I use explore.exe and some other programs are running including Enternet 300, Zonealarm 4.5 On Sunday, March 13, 2005 at 12:11 am, Jack Gulley wrote: > Sorry about the delay, but this has taken most of the evening to research. Short >answer, YES - believe it! > Microsoft had announce last week that there would be no new Security Updates >released this month. So most people were not looking for any updates this week (including >me). However, they said nothing about not releasing some of the old MWA >(Missing Without Action) Security Updates that they had published, with workarounds, >and that patches for selected systems (XP SP2) had already been released. > They just updated the prior notices to include Windows 98/ME and provided the >MWA Security Updates for these systems. > Looking into the details of the problems being fixed, I can understand what it >might take to fix them, and the delay in getting the fix out. > The notice MS05-002 >- Vulnerability in Cursor and Icon Format Handling Could Allow Remote Code Execution >(891711) was just updated to include additional details about the exposures and >fix releases for Windows 98/ME. > The problems being fixed also apply to a number of older versions of OutLook based >e-mail program and other MS applications which are not supported with updates, and >that could be installed on many systems. The fix also would require an update to >the Windows 98/ME kernel module, something difficult to do and control. It would >be almost impossible for them to provide the fixes for all of the effected programs. >The solution is to install a new module that checks for the different exploits and >blocks them. > This requires a new Startup entry to start the code on Windows 98/ME systems, >and the module showing up in Task Manager. Sort of like an Anti-Virus/Firewall program, >except for HTML code processors (IE, e-mail, and Cursor handlers). The fix creates >a new folder in the C:\Windows\System folder to contain the patch and from where >it is loaded during startup. A real pain for us, but necessary to fix all of the >known exposures. (Also allows them a simple way to put out additional fixes >for new problems, by updating this programs DLL module, instead of patches to other >large modules.) > The alternative to using this "critical" fix, is to view all e-mail only in >text format (no images or icons) for all Microsoft e-mail viewing programs and >never click on any included link. And in IE to block displaying all images and never >clicking on icons or using action cursors provided by web sites. Having the older >Security fixes installed helps avoid some of the problems, but this fix is required >to deal with a very real security exposure. > Take the time to read through the above MS05-002 >notice and expand all details of it. > And from now on, consider it normal to see KB891711 (or its replacement) >in the Windows 98/ME startup list and in HijackThis logs. In fact, consider it a >security risk (and possible infection) not to see it in these >lists. [Reply or follow-up to this message] re: kb891711 problems Sunday, March 13, 2005 at 5:50 pm Posted by Jack Gulley (5917 messages posted) That is now a vote of two having problems with this new security fix. I have only found one other reference to a known software compatibility problem using it. I have not seen any problems with it, but then I don't use ASDL connection software or ZoneAlarm. But I am sure that Microsoft tested with those software combinations before releasing this fix (they took two extra months). The concern, is that there are now a number reports of large companies that provide shared hosting web servers, who have been compromised and their customers web pages modified to attack visitors using the exploits that this fix blocks. In other words, the hackers are starting to attack users who do not have the fix installed and have found ways to do it on a large scale. There is also a report of one known hacker site using this exploit (MS05-002) to infect visitors with two files, that only the Kaspersky AV is currently detecting. I would recommend both search their systems for any hidden reference to "mhh.exe" or "sr.exe" files. You may already be infected before you installed the KB891711 update. Open a MS-DOS window and search with the following command: ATTRIB /S \sr.exe ATTRIB /S \mhh.exe I suspect your system may be infected with something that is not currently being detected. Update your AV and run full scans. Then verify that you only have problems when this update is enabled in the MSCONFIG Startup tab. I would also recommend an on line scan with HouseCall_AV as they tend to update their definitions frequently. Next get the current copy of HijackThis and run its output through the on line web pages for checking the results. If you are unable to resolve the issue with this "fix", then post your HijackThis log to your prior thread so everyone can look at it. There may be some common element or problem. See: page [Reply or follow-up to this message] re: kb891711 problems 98/ME Sunday, March 13, 2005 at 9:38 pm Posted by Jack Gulley (5917 messages posted) Well it seems there are a lot of random problems starting to show up on Windows 98 systems and some Windows ME systems after installing this fix. Most seem to be interaction with ZoneAlarm or other programs such as browsers. Most people are not having a problem, some are and it is clear they only occur with KB89711 installed on 98/ME systems. It is not clear if this is a problem with the fix or a problem with other hidden Malware on these systems. So checking and taking a look with HijackThis is a must. It might also be worth at least sending a report of your problem to Microsoft so they get an idea of how many people are having a problem. [Reply or follow-up to this message] re: kb891711 in tasklist ? - BSOD Sunday, March 13, 2005 at 11:31 pm Posted by Alex (5 messages posted) I forgot to mention that was IE 5.5SP2. Uninstalled (really!) KB891711 and updated IE to 6SP1 than went to MS WinUpdate - downloaded and installed all what MS recomended - KB891711 wasn't there! Now MS says "no more updates". Looks like KB891711 is no longer with us. On Sunday, March 13, 2005 at 4:00 pm, Alex wrote: >KB891711 causes "blue screen" on my PC when I use explore.exe and some other programs >are running including Enternet 300, Zonealarm 4.5 > > [Reply or follow-up to this message] re: kb891711 in tasklist ? - BSOD Monday, March 14, 2005 at 12:56 am Posted by Jack Gulley (5917 messages posted) It's still with us, I just checked with a machine that has not been updated yet. That fix is an independent fix and switching from IE 5.5 to 6.0 sp1 or installing other updates should not have any effect on it. However the uninstall process must have left the files (or traces of them) on your system, so it does not try to install it again. But looking at the uninstall procedure, it looks like it would have removed all traces of it. Not sure why it is not trying to install it again unless it is seeing it in the Windows Update log file. I would still like to see a HijackThis log of the system, to see if there is anything that might have been causing a conflict with the KB891711 fix. [Reply or follow-up to this message] re: kb891711 in tasklist ? - BSOD Monday, March 14, 2005 at 7:18 am Posted by Alex (5 messages posted) You are right - MS uninstall left references to KB891711 in Windows Update.log and iuhist_catalogAdmin.xml but not in the registry. I deleted those manually and reapplied KB891711 - can't reproduce "blue screen" so far. Thank You Jack! On Monday, March 14, 2005 at 12:56 am, Jack Gulley wrote: > It's still with us, I just checked with a machine that has not been updated yet. >That fix is an independent fix and switching from IE 5.5 to 6.0 sp1 or installing >other updates should not have any effect on it. However the uninstall process must >have left the files (or traces of them) on your system, so it does not try to install >it again. But looking at the uninstall procedure, it looks like it would have removed >all traces of it. Not sure why it is not trying to install it again unless it is >seeing it in the Windows Update log file. > I would still like to see a HijackThis log of the system, to see if there is anything >that might have been causing a conflict with the KB891711 fix. [Reply or follow-up to this message] re: kb891711 problems 98/ME Monday, March 14, 2005 at 12:04 pm Posted by Rick F (1 messages posted) I use Win98 SE; ZoneAlarm Pro (4.5.594); VirusScan 7.01. I'm still using IE 5.5 SP2; and OE-5.5 SP2. I updated my Win98 on Mar 12th to KB888113; KB891781; and the one being discussed here... KB891711. Everything seems to be working fine. I only noticed KB891711 running in my WinTask list when I went to shut down background running programs before installing TaxCut software. I just never heard of an update running in the background. If this is necessary for 'safe computing' then I guess it has to be. I was about to uninstall it -- untick it from startup list until I read your description here about needing to run in the background. Rick F On Sunday, March 13, 2005 at 9:38 pm, Jack Gulley wrote: > Well it seems there are a lot of random problems starting to show up on Windows >98 systems and some Windows ME systems after installing this fix. Most seem to be >interaction with ZoneAlarm or other programs such as browsers. Most people are not >having a problem, some are and it is clear they only occur with KB89711 installed >on 98/ME systems. > It is not clear if this is a problem with the fix or a problem with other hidden >Malware on these systems. So checking and taking a look with HijackThis is a must. > It might also be worth at least sending a report of your problem to Microsoft >so they get an idea of how many people are having a problem. [Reply or follow-up to this message] re: kb891711 in tasklist ? - BSOD Monday, March 14, 2005 at 2:29 pm Posted by Alex (5 messages posted) I just got BSOD saying error 06:0200:0000082E, but this one was recoverable - I hit Enter and could continue as if nothing happened. Logfile of HijackThis v1.99.1 Scan saved at 1:53:05 PM, on 3/14/2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\INTERNAT.EXE C:\PROGRAMS\ZONEALARM\ZLCLIENT.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\PROGRAMS\ENTERNET\APP\ENTERNET.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\WINDOWS\EXPLORER.EXE C:\@\1\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.netcenter.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = IE_5.5 O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [internat.exe] internat.exe O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRAMS\ZONEALARM\ZLCLIENT.EXE O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O14 - IERESET.INF: START_PAGE_URL=http://www.e4me.com/start.html O15 - Trusted Zone: *.ecs.com.tw O15 - Trusted Zone: *.intel.com O15 - Trusted Zone: www.cdspeed2000.com O15 - Trusted Zone: *.travelocity.com O15 - Trusted Zone: *.cheaptickets.com O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - file://D:\controls\sdkinst.cab O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O19 - User stylesheet: C:\WINDOWS\DL_Win\IE_Cust\my.css On Monday, March 14, 2005 at 7:18 am, Alex wrote: >You are right - MS uninstall left references to KB891711 in Windows Update.log and >iuhist_catalogAdmin.xml but not in the registry. I deleted those manually and reapplied >KB891711 - can't reproduce "blue screen" so far. >Thank You Jack! > > [Reply or follow-up to this message] re: kb891711 in tasklist ? - BSOD Monday, March 14, 2005 at 7:29 pm Posted by Jack Gulley (5917 messages posted) Looks reasonably clean. No sign of Spyware or conflicts. I suspect your BSOD's might be a memory failure showing up due to the software configuration change. Try running the standalone boot diskette program MemTest86_v3.2 for several hours or over night to see if it shows up a memory problem. (If its any consolation, I had to buy a DDR PC3200 512MB CL=2.5 memory module and its on the way, to replace one I bought two months ago that went bad with a single bit random error. The "local" vendor and manufacture are no where to be found to honor the warranty, so far.) [Reply or follow-up to this message] re: kb891711 in tasklist ? - BSOD Tuesday, March 15, 2005 at 2:03 pm Posted by Alex (5 messages posted) I found a suspicious setting in the BIOS DRAM Timing by SPD=disabled (Serial Presence Detect electrical), changed this to "enabled" and than ran MemTest86 4 hours/14 passes with no error. Looks like the problem is gone. You were right, Jack - as always. On Monday, March 14, 2005 at 7:29 pm, Jack Gulley wrote: > Looks reasonably clean. No sign of Spyware or conflicts. I suspect your BSOD's >might be a memory failure showing up due to the software configuration change. Try >running the standalone boot diskette program >color=#FF4500> MemTest86_v3.2 for several hours or over night to see if >it shows up a memory problem. (If its any consolation, I had to buy a DDR >PC3200 512MB CL=2.5 memory module and its on the way, to replace one I bought two >months ago that went bad with a single bit random error. The "local" vendor and manufacture >are no where to be found to honor the warranty, so far.) [Reply or follow-up to this message] re: kb891711 in tasklist ? - BSOD Sunday, March 20, 2005 at 4:27 pm Posted by Robert Fortner (1 messages posted) Just a little more info...... I Have found on my Windoze 98 Machine that The KB891711 update has a problem with Zone alarm. If I close ZA then The update does not freeze my computer. Can't have that though! Interesting side note...If I wait till Zone Alarm is FULLY loaded and manually click on the KB891711 program I have no problems.. Thought it might help the more technically advanced than me. [Reply or follow-up to this message] My Outlook Express keeps stalling since I downloaded kb891711 Wednesday, April 6, 2005 at 9:45 am Posted by Kevin M (1 messages posted) I have had the fix downloaded for about 1.5 weeks and everything was fine until today. My Outlook version 6 keeps stalling after it begins to download my messages. Can anyone tell me whether I can remove the fix or will that leave me vulnerable? I have windows 98SE I believe. On Sunday, March 13, 2005 at 1:12 pm, hugo defreyne wrote: >This KB891711 is causing "blue screen" error when you try to start an internet connection >thru ADSL enternet 300 software > > > [Reply or follow-up to this message] Tip: Use one of the [Reply or follow-up to this message] links above to add a message to this thread Search this forum Start a new thread on a different subject Report abuse of the forum Return to the Windows Me Discussion Forum