I downloaded this update last week and it is in the program list. It also shows in the close program box and in the startup list.I have never seen any security update do this before is there something fishy here? Comments please. Thanks

I don't think it's fishy but probably buggy.

Kb891711 is a valid MS update (I've checked).

If you put it in Google you'll find there are several hits mainly about problems it has caused. This is one example:
CLICK HERE

Keep an eye open for new versions.

Derek.W

Yes, but... seems as if it's an update for Win2K - most of the Google hits indicate that as well

Give me ambiguity or give me something else

Report Offensive Follow Up For Removal

jboy, in the fine print of the MS KB article for this it states it applies to 98, 98SE, & ME as well. I read it yesterday or today.

It's a good day when you learn something

Windows Service Packs > KB891711 leads to Microsoft Security Bulletin MS05-002

Ok - I stand corrected - I'm more of the "I don't need no steenking updates" persuasion, so this is pretty deep water

Give me ambiguity or give me something else

Report Offensive Follow Up For Removal

I agree with Jboy. If a home user has an anti virus program and a firewall running, they should be pretty safe.

Actually, I've uninstalled a couple of hotfixes on boxes I've inherited.

Yeah, I don't know - don't use IE(5.5 only) much, don't do many 'secure transactions' - - nothing's gotten broken in quite some time, so - so far so good

Give me ambiguity or give me something else

Report Offensive Follow Up For Removal

Looks like you found it exactly as I did. Except I had the terms wrong. MS KB instead of Serv. PK & Sec. Bul.

It's a good day when you learn something

Note that this update was issued on 11th Jan 2005 and then revised on 8th March 2005.

If yours was installed before 8th March then the newer one might be worth trying.

Derek.W

The only reason I aked this question is because I have never seen a security update listed in the startup group(msconfig)or in the close program list.So this is a valid update and I should keep it in my startup group in msconfig?

As said in #1, I checked and this is definitely a valid update.

As you say, it is quite wrong for it to appear in msconfig or close program list. It appears to be a buggy update, so there is no standard answer about to how to proceed now. It may not have even properly installed, so to my mind it probably server no useful purpose.

See if it appears in Control Panel/Add-Remove. If so try uninstalling it from there. If not you can simply untick it in msconfig. There are ways to remove the msconfig entry (from the registry) which I can supply if necessary.

Whether you wish to try the later version of this update is up to you. If you do decide to go this way I would be interested to know if the results are any better.

Derek.W

... typo. "serves" no useful purpose (not server).

Derek.W

I read in another forum today that in the "Exec Notes or something or other" that it should be installed while running in safe mode. (I haven't been anywhere else yet, so when I run across it again I'll gather more detailed info in case it's required.)

It's a good day when you learn something

Thanks Dan.

Hope you manage to uncover it - could help a lot of folk.

Derek.W

I un-installed it from add/remove programs then went to windows update to download it again and it is in my history that I downloaded it and doesn't show up as a needed critical update.How can I download it again?

It's a little bit of a ritual but quite easy (just takes a lot of words to explain).

First make up an empty folder to put it into (anywhere, any name, as long as you will be able to find it later).

You then go to this website:
Windows "Coporate" Update

This looks exactly like normal Windows Update but it isn't. You go through the ritual of selecting your system and critical updates. Eventually you will find a long list poked into a fairly small box bottom right of screen.

Scroll down and you will find the number about two thirds of the way down. Put it in the shopping basket and download it. You will need to browse to the empty folder you made previously before it will download.

Once you've done all that come off line and go to the folder you made. You will then find it has made a stack of sub-folders. Just work your way through that lot until you find the file (it's called Windows98-KB891711-ENU.EXE).

I would normally say just double click it and away you go. In this instance it is sensible to heed Dan's warning in #12. It certainly won't do any harm to install it from Safe Mode.

You probably know this, but to get to Safe Mode you either hold Ctrl key down while booting or if this doesn't work keep tapping F8 key while booting. From the startup menu that appears select Safe Mode. It will be like normal Windows but with large icons and rotten graphics. Just find the file and double click it. Re-boot afterwards.

Derek.W

Let us know how you got on.

Derek.W

I had my info all mixed up in my #12 above. Sorry. The first reply posted to the topic here

contains a link to here.

It's a good day when you learn something

I had exactly the same problem with KB891711 on Win Me.
I found your page through Google and I would like to thank you all for trying to help on this matter.
I would be interested to know if somebody solved this problem by unstalling KB891711 and re-installing it in safe mode...
because I tried this but the program KB891711.EXE is still running, appearing in my close list (Ctrl Alt Del) and also in the msconfig startup list.
The program is located in C:\Windows\system\KB891711\KB891711.EXE,
and this is the only KB folder in in the windows system direcrory.

Matchi.

Matchi
This query is still current and I expect gserve will report back when he gets a chance to try it.

Was your download of this Update before or after the 8th March version?

Derek.W

Well I found the update and re-installed it in safe mode with the same results .It still shows up in add/remove programs and close program box and startup in msconfig. Should I keep this installed and wait for a fix? opinions please

I ended up un-installing the update again.Ater I would get off the net and try explorer and I would just see the hour glass and then it would lock up.Also I notice 4 other security updates in add/remove programs but they are not listed in the close program or startup in msconfig.

hi all....dont even know how i got here but glad i did...i'm having same problems but little worse i think....my icons have been changing in computer. I understand this update was to PREVENT this from happening..guess it got downloaded TOO LATE for me? Anyone that can help me i would appreciate it..how to locate the but that is changing my icons...or am i going to have to GRRRRRRR RESTORE my computer again? pllllllease help me

I'm beginning to think that a restore step might be the best move. Especially since this is so recent. Minimal impacts. (Going back to the day before the update was installed on machines.)

Then just waiting it out until M$ generates something. This issue is spreading across the net.

It's a good day when you learn something

Yep, I got exactly the same prob (close prog box and start up etc) on W98SE AND I critical updated on 11th March. Searching on MS I found sometimes it is mentioned for W98 and other times not. So I dunno........... is it needed for W98 or not?
I got ZoneAlarm and Spysweeper.

gserve

It is not unusual to see updates in CP/Add-Remove.

As for this thing it seems we are now totally stuck until MS get their finger out (if they ever do). I have an uneasy feeling they are not too intersted in anything but XP.

The only thing I can suggest is that you uninstall the thing again. I know various people have written to MS about it but they have been deaf ears on many issues in the past.

Sorry about all the doom and gloom with no results. This post can be added to for about a month so if anyone picks up anything useful please post. I will also keep my eyes open.

Derek.W

I installed the Update about 3-4 days ago and yet to experiance any issues with it yet ?? Maybe soon to come,???
I am running Win ME
The only thing that puzzles me is why it is in my add & remove list??
I guess MS expected it to be buggy

" IF IT AINT BROKE - LEAVE IT ALONE "

Nothing to worry about BigBob (see other post).

gserve
There is just the vague possibility that this is some problem that only arises with a particular software mix (that MS never thought of). Can be very tricky to track down if it is. Let's see if anyone made it with W98.

I've trawled for more info and ideas on via this new post:
W9x Forum 164570

Derek.W

Hi again Derek
I just updated my sons Win98SE box with this update and so far it seems ok but time will tell?

" IF IT AINT BROKE - LEAVE IT ALONE "

OK, well that has proved that it will install on some machines. Makes me feel even more convinced that it is unhappy with the software mix on particular machines. Not easy to sort out.

Thx BigBob

Derek.W

gserve & all

It transpires that I was decieved by the unusal nature of this update. According to this websites and others I have seen it is intended to start on each boot. This accounts
of-course for the .exe file.

KB891711

Never seen an update work like this before. As long as it causes no other ill effects (and I note that it has in some cases) then you should just install it and live with its peculiarities.

Sorry if I've helped add to the confusion. It seems I was one of many who fell for the trick question.

Derek.W

I run win/98
installed kb8971711 have had no problems at all is listed at startup and in add/remove

COSMO

I got this windows 98 kb891711 update last week too and it shows up on the list when I hit ctrl+alt+delete. It has been locking up my computer just about every time I try to open a browser. I keep having to restart my computer without shutting it down normally. Is it something I can chunk? I use Mozilla most of the time. I am also using Norton SystemWorks 2005. My firewall and anti-virus are kept current. I only have 256 KB of memory. What is this thing for anyway?

Please see #30.

The purpose of the update is given in the red link at #4.

The way the update works including its appearance in Ctrl-Alt-Del is correct (although very unusual). It loads on boot.

The fact that this update is causing problems on some machines (not all) does support the idea that either there is still some sort of bug, or at least there was a bug in the earlier update.

Make sure you have the 8th March Update. If you got the update before then, uninstall it from Control Panel/Add-Remove then install it again by downloading the file using the link in #15.

If you still have a problem with your machine then the only thing you can do is uninstall it. If I get any other information I will advise, although it seems likey that only MS can sort this out.

Derek.W

This is a shame ....as usual a BIG INSECURE ISSUE :

Microsoft Security Bulletin MS05-002
Vulnerability in Cursor and Icon Format Handling Could Allow Remote Code Execution (891711)

Issued: January 11, 2005
Updated: March 8, 2005
Version: 1.2
Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (Me) – Review the FAQ section of this bulletin for details about these operating systems.

later than :

What updates does this release replace?
This security update replaces a prior security bulletin. The security bulletin ID and operating systems that are affected are listed in the following table.
Bulletin ID Windows 98, 98 SE, ME
MS03-045
Not Applicable

Windows NT 4.0 Windows 2000 Windows XP Windows Server 2003

Replaced

Replaced

Replaced

Replaced

...How does the extended support for Windows 98, Windows 98 Second Edition, and Windows Millennium Edition affect the release of security updates for these operating systems?
Microsoft will only release security updates for critical security issues. Non-critical security issues are not offered during this support period. For more information about the Microsoft Support Lifecycle policies for these operating systems...

i've trace it after i've got it with auto-update for w98 AFTER 3/8/2005 so you've got a virus called ICONs ... just like DCOM with open ports reactived...... just kill the whole thing !

or jump to 2000 without IE !
http://www.vorck.com/remove-ie.html

and do a clear install !

JoseBillBR

This bit "so you've got a virus called ICONs ... just like DCOM with open ports reactived...... just kill the whole thing !
"

Are you saying that folk having trouble with this update have some sort of virus? Would like more info please.

Derek.W

"so you've got a virus called ICONs ... just like DCOM with open ports reactived."

Sure - if you can provide a reference link, that'd be helpful - otherwise, tends to sound like wild rambling and should be dismissed as such

Give me ambiguity or give me something else

Report Offensive Follow Up For Removal

"so you've got a virus called ICONs ... just like DCOM with open ports reactived."

That's the headline on today's "National Enquirer".

Seriously though, I concur. If you have some viable reference for this statement please provide it.

It's a good day when you learn something

I GOT HIT WITH this issue AFTER Restarting my pc THE DAY FOLLOWING THE WINDOWS 98SE CRITICAL UPDATES DOWNLOAD.
I sent a message to microsoft
and was told ----to First do this
IN Safe Mode only.... Uncheck KB891711
and test the issue.
if it still occurrs go back to safe mode and Remove windows 98 KB891711 UPDATE and
windows 98 Q888113 UPDATE.
AND WAS FURTHER TOLD IF ABOVE DID NOT WORK CREATE THE NEW BOOTLOG.TXT AND BOOTLOG.PRV FILES AND SEND THEM THE MY MICROSOFT CONTACT.

I GOT HIT WITH this issue AFTER Restarting my pc THE DAY FOLLOWING THE WINDOWS 98SE CRITICAL UPDATES DOWNLOAD.
I sent a message to microsoft
and was told ----to First do this
IN Safe Mode only.... run MSCONFIG
AND Uncheck KB891711
and test the issue.
if it still occurrs go back to safe mode and Remove windows 98 KB891711 UPDATE and
windows 98 Q888113 UPDATE.
AND WAS FURTHER TOLD IF ABOVE DID NOT WORK CREATE THE NEW BOOTLOG.TXT AND BOOTLOG.PRV FILES AND SEND THEM THE MY MICROSOFT CONTACT.

oops I forgot to type
Run msconfig
in the reply prior to this reply
sorry

Just for the record, what were the symptoms of your problem, what happened when you tried what they said, how was the situation left?

Derek.W

I downloaded windows critical updates on March 8 2005
KB891711 and KB888113
and the next day when I started up my computer is was very slow loading web sites to my screen and it would Hang and freeze if I clicked into a link within all web sites.

I was forced to do the double Ctrl/Alt/Delete to force my Computer into a restart and out of the Freeze ever time.

But when I did one the above Ctrl/Alt/Deletes
I noticed
a process KB891711 was running.(strange)
So
I then went to msconfig to uncheck it from the startup (but I was not in safe mode)
And that created another problem causing explorer to die (HANG)

So I put KB891711 back into MSCONFIG.
And sent an email to Microsoft asking for help.

I hope I answed you question ok
If not ask me more--

and I should say this------------------
I ran Lavasoft ad-aware SE
and the scan log told me
KB891711 was owned my Microsoft
and that had me look at my Windows Update History log and there it was big as light
KB891711
Then
I sent a email thru the link for help from the microsoft Windows Update web page to ask for Help.

OK thanks.

As said before, the presence of KB891711 as a background task is OK, just the weird way this update works. Only MS can say why there are other problems, possibly a bad reaction with some other software.

Since this post I've installed the Update and it has not caused any problems.

You can uninstall update in Control Panel/Add-Remove and if you wish to get it again later see my #15. You need this because you will be shown as having the update already if you go to normal Windows Update.

I'm kinda repeating myself but there is nothing more to add. If someone finds the reason for the problems then that will sure be interesting. You could, I suppose disable other programs in msconfig to see if you can find something that this update is reacts with.

Derek.W

I have been studying the problems the fix tries to address. It sort of acts like an AV or firewall, but looks at all of the image, icon, action cursors and links being loaded by programs, looking for hostile files that might be used to try to take control of a system.

They have to do it this way, because there are too many programs that would have to be fixed. All old browsers, all old versions of OutLook based e-mail programs and even any HTML viewers. Many of these old Office programs are not longer supported, yet they pose an open risk if used to view even saved icons and images.

To make matters worse, the past few days, there have been a number of reports of large companies that provide shared hosting web servers, who have been compromised and their customers web pages modified to attack visitors using the exploits that this fix blocks. In other words, the hackers are starting to attack users who do not have the fix installed and have found ways to do it on a large scale. There is also a report of one known hacker site using this exploit (MS05-002) to infect visitors with two files, that only the Kaspersky AV is currently detecting.

So it is a real threat now and there is no other way to protect your system short of only allowing viewing in text format and never clicking on a image, icon or hyperlink.

Have heard of problems with this fix when trying to connect with ASDL Ethernet 300 software. BSOD.

It would be interesting to find out if these are really conflicts with other programs, or problems with machines that are already infected with something.

Overview:
eEye Digital Security has discovered a vulnerability in USER32.DLL's handling of Windows animated cursor (.ani) files that will allow a remote attacker to reliably overwrite the stack with arbitrary data and execute arbitrary code.

Because Windows animated cursors can be supplied for use by Internet Explorer, this vulnerability affects any applications that use the Internet Explorer component internally, such as Internet Explorer itself, Word, Excel, PowerPoint, Outlook, Outlook Express, and so on, as well as the Windows shell.

In the case of Internet Explorer, the user's system will be compromised when the user views a website that shows a malformed ANI file referenced via a style sheet in the HTML file. Likewise, a system may be compromised through Outlook and Outlook Express when the user tries to read an HTML e-mail containing a MIME-encoded malformed ANI file and a style sheet referencing the encoded ANI file, invoked using HTML such as < BODY style="CURSOR: url('/contents/007/951/519.mime7')" >. In the case of the Windows shell (explorer.exe), exploitation occurs when the user opens a folder containing a malformed ANI file.

This vulnerability also exists in all obsolete versions of the Windows operating system (Windows 95/98/NT4).

Technical Details:
The buffer overflow bug exists in a part of USER32.DLL involved in handling ANI animated cursor files. A partial ANI file format is given below:

"RIFF" {(DWORD)Length_of_file}
"ACON"
"LIST" {(DWORD)Length_of_list}
"INFO"
"INAM" {(DWORD)Length_of_title} {szTitle}
"IART" {(DWORD)Length_of_author} {szAuthor}
"anih" {(DWORD)Length_of_AnimationHeader} {AnimationHeaderBlock}

Generally, the length of AnimationHeaderBlock shoule be 36 bytes (0x00000024). The vulnerability is in the handling of the Length_of_AnimationHeader field. This value will be passed as the length argument of memcpy(), in order to copy the contents of AnimationHeaderBlock, but the value is not checked appropriately. The buffer intended to hold the AnimationHeaderBlock is located on the stack, so we can overwrite the return address and exception handler on the stack and jump into the buffer containing our code.

This vulnerability is a separate vulnerability from the ones discovered by Xfocus.

-------

unzip patch to find how it works ;-)

the patched dll creates a hook to user kernel but conflicts with many progs like others browsers ... firefox or proxies like proxomitron resulting in system hangs and BSOD.

see : http://www.broadbandreports.com/forum/remark,12875676~mode=flat~days=9999

the patch for W98 seems really 'weak'(<200ko)
compare to the w2k one ( > 2 Mo )

- WIN98 Files in KB91711UP.EXE----------
qfecheck.exe
qfecheck.hlp
csetup.exe
Windows98-KB891711-FRA.EXE
891711UP.INF<--install script ( see below )
891711UN.INF<-- uninstall script
KB891711.EXE
Q891711.DLL
ADVPACK.DLL
W95INF32.DLL
W95INF16.DLL

--------WIN98 Install Inf-----------
; 891711up.INF
; This is the Setup information file to install the Windows 98 KB891711 update.

[VERSION]
AdvancedINF=2.5, %AdvPackWarn%
signature=$CHICAGO$

[DefaultInstall]
CopyFiles = WinUPD.Copy.qfe,WinUPD.Copy.Hlp,WinUPD.Copy.SYS,WinUpd.Copy.INF
AddReg = WinUPD.AddReg

[DestinationDirs]
; 10=Windows, 11=SYSTEM, 12=IOSUBSYS, 13=COMMAND, 14=Control Panel, 15=Printers, 16=Workgroup
; 17=INF, 18=Help, 19=Administration, 20=Fonts, 21=Viewers, 22=VMM32, 23=Color, 25=Shared
; 26=Winboot, 27=Machine, 28=Host Winboot, 30=Boot drv root, 31=Root of Boot drv Host
; 00=Null (new) LDID, 01=Source drv:\path, 02=Temp Setup, 03=Uninstall, 04=Backup

WinUPD.Copy.qfe = 10
WinUPD.Copy.Hlp = 18
WinUPD.Copy.SYS = 11,KB891711
WinUpd.Copy.INF = 17,QFE\%SPKey%

[WinUPD.Copy.qfe]
QFECheck.exe,,,32

[WinUPD.Copy.Hlp]
QFECheck.hlp,,,16

[WinUPD.Copy.SYS]
KB891711.EXE,,,32
Q891711.DLL,,,32

[WinUPD.Copy.INF]
891711UN.INF,,,16

[WinUPD.AddReg]
;msinfo32
HKLM,"Software\Microsoft\Active Setup\Installed Components\%GUID%",,,"%UpdName%"
HKLM,"Software\Microsoft\Active Setup\Installed Components\%GUID%","IsInstalled",0x10001,01,00,00,00
HKLM,"Software\Microsoft\Active Setup\Installed Components\%GUID%","Locale",,"%LANG%"
HKLM,"Software\Microsoft\Active Setup\Installed Components\%GUID%","Version",,"%VERSION%"

;runservices
HKLM,"Software\Microsoft\Windows\CurrentVersion\RunServices","KB891711",,%11%\KB891711\KB891711.EXE"

;qfecheck
HKLM,%UpdateKey%\%SPKey%\%LocaleID%%UpdID%\,,,"%UpdName%"
HKLM,%UpdateKey%\%SPKey%\%LocaleID%%UpdID%,%11%\KB891711\KB891711.EXE,,
HKLM,%UpdateKey%\%SPKey%\%LocaleID%%UpdID%,%11%\KB891711\Q891711.DLL,,

;uninstall
HKLM,"Software\Microsoft\Windows\CurrentVersion\Uninstall\%UpdID%",,,
HKLM,"Software\Microsoft\Windows\CurrentVersion\Uninstall\%UpdID%",DisplayName,,"%UpdName%"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Uninstall\%UpdID%",UninstallString,,"RunDll32 advpack.dll,LaunchINFSection %17%\QFE\%SPKey%\891711UN.INF"

-WIN2K
*Windows2000-KB891711-x86-ENU.EXE
*Windows2000-KB891711-x86-ENU\_sfx_manifest_ ( see below )
*Windows2000-KB891711-x86-ENU\_sfx_.dll
*Windows2000-KB891711-x86-ENU\_sfx_0015._p
*Windows2000-KB891711-x86-ENU\_sfx_0016._p
*Windows2000-KB891711-x86-ENU\_sfx_0009._p
*Windows2000-KB891711-x86-ENU\_sfx_0011._p
*Windows2000-KB891711-x86-ENU\_sfx_0006._p
*Windows2000-KB891711-x86-ENU\_sfx_0023._p
*Windows2000-KB891711-x86-ENU\_sfx_0022._p
*Windows2000-KB891711-x86-ENU\_sfx_0019._p
*Windows2000-KB891711-x86-ENU\_sfx_0014._p
*Windows2000-KB891711-x86-ENU\_sfx_0007._p

--W2K INSTALLPROCEDURE-------------
[Options]

Run = "update\UPDATE.EXE"
PatchDLL = "_sfx_.dll"

[Deltas]

"update\update.exe" = "_sfx_0000._p", "_sfx_.dll"
"update\update.ver" = "_sfx_0001._p", "update\update.exe"
"spmsg.dll" = "_sfx_0002._p", "update\update.exe"
"update\update.inf" = "_sfx_0003._p", "update\update.exe"
"update\spcustom.dll" = "_sfx_0004._p", "update\update.exe"
"win32k.sys" = "_sfx_0005._p", "update\update.exe"
"kernel32.dll" = "_sfx_0006._p", "win32k.sys"
"sp3res.dll" = "_sfx_0007._p", "kernel32.dll"
"update\KB891711.CAT" = "_sfx_0008._p", "update\update.exe"
"empty.cat" = "_sfx_0009._p", "update\KB891711.CAT"
"update\eula.txt" = "_sfx_0010._p", "empty.cat"
"gdi32.dll" = "_sfx_0011._p", "win32k.sys"
"userenv.dll" = "_sfx_0012._p", "kernel32.dll"
"winlogon.exe" = "_sfx_0013._p", "userenv.dll"
"rdpwd.sys" = "_sfx_0014._p", "winlogon.exe"
"basesrv.dll" = "_sfx_0015._p", "kernel32.dll"
"cmd.exe" = "_sfx_0016._p", "kernel32.dll"
"uniproc\kernel32.dll" = "_sfx_0017._p", "kernel32.dll"
"user32.dll" = "_sfx_0018._p", "win32k.sys"
"msgina.dll" = "_sfx_0019._p", "winlogon.exe"
"winsrv.dll" = "_sfx_0020._p", "win32k.sys"
"spuninst.exe" = "_sfx_0021._p", "update\update.exe"
"mpr.dll" = "_sfx_0022._p", "win32k.sys"
"mf3216.dll" = "_sfx_0023._p", "gdi32.dll"

[Copy]

"uniproc\win32k.sys" = "win32k.sys"
"uniproc\winsrv.dll" = "winsrv.dll"
----------------------

more info about 'bugs' here http://outpostfirewall.com/forum/printthread.php?t=13276

I just wanted to thank all of you for helping me get my computer up and running again after installing those critical updates that killed my computer. I did just what you said ..in safe mode went to msconfig and unchecked it, then in safe mode went to add/remove programs and removed the troublesome update. I restarted and my computer was up and running again. Thanks again.

Monday, March 14, 2005.
Starting Friday 3/11/05 I have had customers that installed "Critical Update" KB891711 on Win 98 SE PC's get GPF's shortly between network login and all of the icons populating. Not all Win 98 SE's have the problem. Uninstalling KB891711 gets the problem PC's back in business. I have tried to get any information from Microsoft but their Win 98 support people seem to be overwhelmed.

I've heard a roumer about a registry fix from MS for this Update. No idea whether it is true, or whether it is just another way of disabling the update. I will try to find out what this is about.

It appears that the bad boys are already exploiting machines via the hole that the Update is supposed to prevent, so obviously it is important to find out what is happening.

Shout back if you hear anything before I do.

Derek.W

Yvonne

Thx for posting but keep an eye on here - see my #49.

Derek.W

Sounds like that registry tweak was just to cure problem if your machine still plays up after removing the update in CP/Add-Remove.

Pity, thought it might make the Update work AND cure the hassle it has been giving us.

The registry tweak may still be of value tho so if I can get hold of it I'll post it here.

Derek.W

Yes, from what I can make of it the registry entry deletion was for if you were still in trouble after removing KB891711 using CP/Add-Remove

The easiest way, if necessary despite reboot, is to just run regedit and search for KB891711, then remove all entries mentioning it (on right hand side).

For W95/98 it is in:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

I'm not sure about NT/W2k/XP but I imagine Windows ME is the same as W95/98.

Derek.W

hi all and thanks for all the help. i haven't noticed any ill effects on my win 98 system so i have left it running for now. just one thing to add. i noticed another process running that has the exact same 6 modules in it. the other process is called mmtask.tsk. just wondering if anyone else was having the same effect? Bill.

Heres a thought.
What if MS says "It's by design" well then what would stop a hacker from making a program to "End Task" the KB891711.

Oh. well haven't tryed to call MS on this # yet.

from MS site......

Support:

• Technical support is available from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls associated with security patches.

ALSO: Will IE7.0 fix this, or will MS still not do it for 98,98se?

mmtask is the multi-media task manager. Hence it's association with this patch.

It's a good day when you learn something

Iv'e been away for 2 weeks up until friday..
Came home checked my emails with the 1st of
the 4 PM8 managed partitions on an 80gig H/D
,, windows 2000pro legitimately owned by me,
windows update notification balloon notice
in the taskbar said updates where available
for my system so I let it install, on the
reboot the system halted with a blue-screen
& a bunch of error messages.
I tried to start it in safe-mode but got the
same error message..
I figured i'd boot to the 4th partition
which is XP-Pro again legitimately owned by
me & got an error message stating that I had
to reinstall ntoskrnl.exe & this system
would'nt load either normally or in safe
mode..
Now the damn systems were fine until I let
windows update install the latest patches.
Each time I try to reboot the system more
errors show, to the point where even PM8
boot-loader has become corrupt & ceases to
load.
The drive is a 4 month old Samsung 80gig..
I have since totally erased the drive clean
& ran tests on the drive only to find it's
as good as the day I bought it..
It's the 1st time windows update has trashed
an install for me.
All 4 systems had A/V + the latest AdAware.
I'm currently postng from my trusty old
98se machine which has also been updated
with all patches up to this point & has no
problems at all.
In fact this machine has that much installed
on it i'm amazed at how good it runs.
Total size used on C: drive with progs in
total is 4.8 gig.

test

Interesting thought about hackers ending task. The problem is that we don't understand the mechanism for this update.

It could, for all I know, be that the .exe fires on boot then does whatever is necessary to safeguard your machine for that session. If this should be the case, ending task on the .exe would have no affect.

Dunno really.

Derek.W

W98SE 'Quick View' shows the .dll file to be a 'hook' type. Now I'm no expert but the patch is surely designed to catch something going on which is bad for your computer (apart from Windows that is LOL). So, I presume that is why it has to run in the background. I would welcome anybody who wants to shoot me down on this! As I said, I'm just guessing here.

Just found this link to cnet forum.

http://reviews.cnet.com/5208-6132-0.html?forumID=32&threadID=91523&messageID=1034555.

Guy there says he spoke to MS Security Support and THEY say it's NOT needed for W98 and to delete it.

Hope somebody makes sense of all this SOON!

Hello everyone,

I have contacted Microsoft after seeing the problem on several of my clients computers, reading through this thread, several others on Computing.net and on other forums.

I shall try and keep this as brief as possible.

I called the 1-866-PCSAFETY number and first spoke with a person in customer service. After telling them of the problems with the update, I was told that they could not assist me because they could not access the "tools" on their computer. I couldn't resist and asked if they possibly installed the KB891711 Critical Update, as it might be the problem. :-)

I just got a chuckle and was told to call back in a few minutes and talk with another someone else that could access the "tools".

I called back and gave all the information again, including the problem, my zip-code, my full name, and my telephone number.

They said they would have to transfer me to a technician and asked if I could hold while they created a case#. I responded "certainly". After about 5 minutes they said, " There is a problem with the system and I cannot give you a case number". "I will transfer you to a technician and you need to ask them to create one". Maybe they installed the update also. :-)

I said sure and waited about 30 minutes on hold for a technician. Finally, Kevin responded and asked for all of the information again.

Here is how I described the problem to Kevin, a representative of Microsoft. The italics below is my comments and Kevins' are not in italics.

"I have several clients that are experiencing problems after install the KB891711 Critical Update. The issue they are having is, the computer locks up after trying to browse the internet. Other computers running Win98SE are having no problems with the update. One of the computers recieves GPF's between logging the Network Login and the desktop icons loading. After disabling the update, everthing appears normal".

You need to uninstall the update and the computer will be fine.

I understand that removing the Critical Update will allow the computers to run, but how do I correct the vunarability that Win98SE has and allow the computer to run without error

That update was not intended for Win9x or WinME.

Really, why does your website indicate that it is intended for Win9x and WinME? Also, why does the autoupdate for Win98 detect that I need to install the update?

If you are getting errors or having a problem with the update you just need to remove the update.

OK, so let me quote you on this, remove the Critical Update, so my computer will run. Then leave myself vunerable because your update doesn't work on some of the machines?

No, I did not say that. Very long pause.

Hello, are you still there?

Yes, I'm here.

So, what is the solution?

You need to remove the update.

OK, I remove the update and my computer runs fine, but it is still vunerable

If you have an update anti-virus program then your system is not vuneralbe.

So, if I have an updated anti-virus program, I don't need Critical Updates?

No, you just need to remove the KB891711.

Which makes the computers possibly vunerable. Are you saying that anytime I have a problem with a Critical Update I should just remove it and carry on?

No, that's not what I'm saying.

So, what's the solution?

Remove the update.

Your website recommends how to secure your computer. The first recommendation is to get the latest Critical Updates. So, I should just ignore the updates if they don't work"?

If the computer is having a problem with the update you need to remove it.

Doctor, when I raise my hand like this, it hurts. Doctor; Don't do that. That is not an acceptable answer.

I understand.

So what is the solution.

That update is not intended for Win9x, WinMe. You need to remove it.

Again, why does your website show that it is a Win9x update and the automatic updates detect it?

Another very long pause.
Hello, are you still there?

Yes, I'm still here.

Kevin can I get your employee I.D. or your last name?

What do you need that for?

Future reference.

Hello

I'm still here.
You can just tell them you spoke with Kevin.

I highly doubt you are the only Kevin working at Microsoft.

I don't know how many people named Kevin are working here.

OK, either your last name or your employee number will be fine, whatever you are most comfortable with.

Hold please.

Sir, you need to remove the update.

OK, I just want to quote that you said to remove the update and leave my computers vunerable.

We then went back to the updated virus thing and the computer shouldn't be vunerable.

I would like to quote you on the fix for this problem. I have many computers with problem in the update. Hundreds, if not more can be found performing a search on the internet.

Can I have your employee I.D. number, along with a case number that could not be given by customer support?

He gave me both of them.

Is Microsoft aware of this issue and what are their recommendations at this time?

This is a quote from Kevin, a Microsoft Technical Representive;

"Microsoft is aware of the problem, and is resolving the issue". Remove the Critical Update from the computer to resolve any issues. We are also in the process of removing it from the updates page for Win9x.

Best Regards,
Mesich

Report Offensive Follow Up For Removal

So if the update doesn't cause a problem leave it?...and if it does remove it?...or just remove it no matter weather it works or not??? on Win 98SE machine.

Thanks for that info mesich. I haven't participated in this thread much as I haven't installed this update. I'm glad I haven't installed ~any~ updates. I did about two years ago and my machine acted up. Had to do a fresh, clean install. (Well, I downloaded the updated fdisk and windows installer, but THATS it.)

I haven't had a virus, trojan, hijack, anything. My life is boring. I have to come here for my excitement. ;>)

It's a good day when you learn something

Nice one mesich (it would have been an expensive call from here in UK LOL).

gserve
Leave it in if it is not causing any problems. Mine is working fine on W98SE. If it gives a problem then uninstall it and hope MS sort this out. The fact that this update runs in the background is apparently normal.

Derek.W

I downloaded the KB891711 on 3-14-05 and now my scandisc doesn't work. I use 98SE and have never had a problem with it. Could this update cause this problem?
Kender

Kender

It depends what you mean by "doesn't work". If it doesn't start at all I'd be surprised if it was this update. If it keeps restarting or only gets half way then it's possible that because the update runs as a background program it is interefering with it.

Best thing to try is type msconfig in the Run box, go to the startup tab and temporarily untick the KB891711 entry. Reboot and see if scandisk runs.

There are many reasons why scandisk can play up but they usually boil down to background programs running (not necessarilly this one). Some folk run scandisk in Safe Mode because of this, although it is possible to tame background programs.

Derek.W

I think we are having the kb891711 problem at our house too, but the symptoms are quite different. We get no cursor, and cannot access start menu (to run msconfig or do add/remove), or "My Computer." This is the case in Safe Mode as well as Normal mode. We also could not get scan disk to run until we went into Safe Mode (the scan completed fine). This is WinME, which I have limited experience with. My main computer runs XP, where it seems like there are more startup options. Any advice on uninstalling without using Add/Remove? Can ME be booted to a command prompt?

problem here booting pc after installing critical update 891711, interesting story so far about this fix, I now have unticked the startup in msconfig so my system will boot, will remove it later on, Al

Jen

Yours sounds much different and I suspect is not due to this update. Best start a new thread on yours, go to Windows ME top left. I'm none to familiar with ME but they will be able to help.

Derek.W

Thanks, Derek. I will do that.

I had other problems with KB891711. On one machine Win98 (Toshiba portege), it caused the display to freeze or to get balnk when starting a CISCO VPN client. ON a WinMe (Acer Travelmate), it caused thge machine to get a blue screen after trying to re-install Netscape 7.2 (which did not owrk properly after dosnloading the update). In both cases, everything returned to normal when unchecking KB891711 from the "start" menu with msconfig

Paul

I spent a full week trying to recover from "fatal exception 06 at 0000:0000152F..." errors that rendered my Windows 98SE home LAN useless starting about 03/08/2005. I reinstalled my OS, IE, and Juno e-mail, checked hardware,scanned for viruses and spyware, optimized hard drive--all to no avail-- then finally found this forum on Google. Sure enough, I found the KB891711.exe in my startup group and then in my history of updates from MS on 03/08/2005 (so this is the SECOND version.)

The bizarre behaviors of my computers ranged from "blue screens of death" with almost any operations between e-mail and IE to somehow triggering my FAX printer to spit out endless blank pages (and countless other unexpected, random, spooky events)!

Unchecking KB891711 in msconfig startup restored all 4 PCs on my LAN to normal, so I then deleted KB891711.exe from the registry and have had no further problems even though I have NOT uninstalled any files except the KB891711.exe in the startup group.

I conclude from this that--at least on my computers--KB891711.exe acted like a rogue TSR much more like a virus than a fix for anything! I don't know how many of us Windows 98SE users are still around, but it must be enough to deserve a more responsive and quicker solution from Microsoft. And I'm even more thankful that my offspring got me an Apple iBook for Christmas to help me cut the umbilical cord to Windows!

I couldn't get this KB801711 to work w/o looping until I installed the current version of ZoneAlarm, ver 5.5.062.011. Now, KB801711 and Z.A. seem to be co-existing nicely.

For additional details see my responses 17, 18, & 19 to message number 164570 in this thread.

My computer was working fine. I did the
update. My compute was barely
functional. Conclusion: must have been
the update. I had similar problems as Jen
did (response 66): couldn't do the start
menu, couldn't open "my computer",
couldn't open explorer, couldn't do much
of anything.

Luckily, I found this site! I went to safe
mode, removed the update via
add/remove, and restarted in normal
mode. All the problems went away.

Conclusions:

1. The problem was the update.
2. Jen was right.
3. This is a great web site - great
information presented in a fashion that
nonPC folks can understand.

Thanks!

Steve

There appears to be a conflict in windows98 with older versions of zone alarm and KB891711 from MS. Conflict does not occur in Windows 2000. Both Zone alarm and KB891711 run in runservices in windows 98. With the latest update from Zone Alarm, they seem to co-exist OK. Download Msconfig for Windows 98, Startup in safe mode, run Msconig & temporarily uncheck KB891711 in the startup, then restart, & update zone alarm to 5.5.062.011(or later), after next reboot, run msconfig again and set it back to normal. It will force another reboot, & both will co-exist.
Ed

I use Win98SE
Because, I'm a "Gamer" -I run minimal amount of programs to keep resources free and run Norton virus scan and SpyBot and AD-Aware manually to keep my system clean.
My applications runnig on after boot are only Explorer and Systray. When I saw KB891711 running, I thought it was a trojan my nephew downloaded -until I checked Microsoft update history ("KB's" are the name format Ms uses for updates).
I unchecked with MSConfig and searched the internet to find if this was esential. I NEVER saw Microsoft install a background program like this before. I'm glad I checked...I guess it WAS a trojan, a MS trojan ;^)

I have two machines running 98se. I have a Compaq Presario desktop that I successfully installed the offending update on, and there seems to be no problems. It is currently running as a TSR.

However, my Presario laptop barfed and died after DLing and installing in on 3/22. I figured out before finding this website that the update must have caused the problems, so I uninstalled it and everything is now fine. Both machines run McAfee 8.0. My laptop symptoms were a freez-up and lost cursor right before sevices for my wireless lan card would load up and connect to the network. I restarted in safe mode and finally removed the update and everything is OK with the laptop. I wonder if I should go ahead and remove it from the desktop to avoid any future problems? I run a router with NAT and hardware firewall anyway. This is not the first buggy update I have recieved from MS. Anyone remember when they sent the update that caused your 32 bit IDE driver to go into 16 bit mode? That was fun!

Thanks,

Steve

eastexsteve

If it's running OK on you desktop I would leave it in place. Many folk have had no trouble with this update and it is about security.

Derek.W

Ah, I too have suffered from this update. I do not have Zone Alarm, so maybe the conflict (if that's what it is) is with something else. Thanks for the advice on how to get back to normal!

See this too folks (FROM MS):

W95/98 forum 164793

Derek.W

The Update is a DISASTER.

Recently I have had lots of "Fatal Exception" Blue-Screen crashes. And my son got this every time he tried to play Final-Fantasy XI online.
After trying LOADS of things I noticed this in the Startup list and it "clicked"... that the problems had begun around the update time.

I UNCHECKED IT AND HAVE NOT HAD A BLUE-SCREEN SINCE!

Len

I am also having problem's with this update.
The computer would lock up when clicking
links, shortcuts, or opening more than one
Window. So I ran Dr.Watson and it pointed me
to "kb891711"
I am running WinMe on a HP868 Pavilion with
an AMD Athlon CPU. And use WinPatrol, Ad-Aware abd ZoneAlarm. Also for System Info I have Everest Home Edition and Belarc Advisor.
There is alot of talk and Posts on the Web
concerning this "Update"
I too, had it listed in "add/remove". Found it running using "ctrl+alt=delete" I tried to kill the task with WinPatrol as soon as I did the System locked-up going to a Black Screen. I did a hard shut down and rebooted in Safe Mode and removed the update in "add/remove programs"
I know this is Win 98 Forum, but this one of the best links I found concerning "KB891711"
Terry

Okay, I am not computer savvy at all and I feel completely lost. I am running on Window's Me and lately I've realized when I'm on my computer, it has times when it freezes. I usually resolve the problem by going CTRL+ALT+DEL, and close off KB891711, and my computer is fine. I had no idea what this application, so I googled "KB891711", and came to this site. Why is it that this application freezes my computer, and my computer is fine when I close it. What is this application and should I remove it?

Nobody know why this update causes a problem on some machines. I gather MS are working on it but who knows if they will really bother unless it upsets XP.

It is a security update, so it's worth having if it doesn't give you hassle. Otherwise you can uninstall it in Control Panel/Add-Remove. It's your decision I'm afraid.

You can read what it's for right here:
KB891711 UPDATE INFO

See the "Executive Summary" on there if nothing else.

Derek.W

Current status for KB891711:

http://news.zdnet.com/2100-1009_22-5648595.html

'Microsoft has acknowledged that a security patch issued in January for its Windows 98 and Windows ME operating systems may cause performance issues for customers who have downloaded the update.'

After installing this patch my sys booted and sid my registry was damaged and to rerun Win 98 setup. Did that, sys boots but cannot access internet. Modem dials and goes online but cannot connect to server. I have deleted KB891711 from my sys and registry and this made NO difference. Installed modem in this machine and am online. Have Installed a new modem in the machine that won't connect and it still has the problem. Been thru all the settings disabled firewall ect. Don't know what else to try other than a clean install.Anyone have any other suggestions? Thanks Chuck

I wish I had read all this before installing the update on my Win 98 SE.....I have uninstalled the update, but a residual annoyance remains. I can no longer get rid of the little shortcut arrows on desktop icons. All of the old tricks no longer seem to work. I've tried letting Microangelo do it by disabling the icon overlays, I've tried Regedit and deleting all references to IsShortcut, and substituting a blank icon (actually, when I got to the registry entry, I found that Microangelo beat me to it)
So is truly a byproduct of the Kb891711 update, and is there any work-around?

I've been away. Windows 95/98 users in severe difficulties after applying this patch could try this (after uninstalling patch if possible):

Go to the startup menu by tapping F8 during bootup. Select one of the two command prompts. Type c:\windows\command\scanreg.exe /restore (hit Return key). Select a registry dated just before the update was installed.

Derek.W

I downloaded this revised windows update today....no problem )yet).
"Why was this security bulletin updated on April 12, 2005?
After the release of the MS05-002 security bulletin, Microsoft became aware of an issue affecting customers deploying the Windows 98, 98SE and ME security update. In most cases, the issue caused machines to unexpectedly restart.
Microsoft has investigated this issue and has made available revised security updates for these platforms. These revised security updates are available from Windows Update and the Microsoft Download Center. Customers who have not yet applied the original version of these updates should visit Windows Update to receive the revised updates.
Customers who have already applied the original Windows 98, 98SE and ME security update are advised to install the current revision of the update from Windows Update.
What updates does this release replace?
This security update replaces a prior security bulletin. The security bulletin ID and operating systems that are affected are listed in the following table."
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Mike
Windows 98 SE and Current
512 RAM
NortonInterneSecurity2005

Nice one Mike.

Let's hope these problems are now solved.

Derek.W