Critical Problem with Recent Win2000 Security Update 4

[carrslem]

Several people have reported very serious problems following installation of this recent Win2000 update (KB841356, KB840987, KB841533). Although expression of the defect MAY depend upon a combination of circumstances which does not occur often - there have been only a few reports of the problem so far - when it does occur, the problem can be very serious. One person reported that some system files become corrupted, requiring reinstallation of Win2000, which he has had to do numerous times over the past two weeks.

I do not know if Microsoft is yet aware of this problem. The last time I checked their site I could find nothing about it. So be careful with respect to this update.

 

[Davetoo]

It would help immensely if you actually described the problem instead of simply eluding to one.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[carrslem]

The exact circumstances of the problems seem to differ and others reporting problems don't describe in detail what they were doing or the detailed results. What all have in common is (1) installation of the subject security update with immediate appearance of the problem expression, and (2) either a BSOD or a system freeze. For some the problem appears during boot up with the desktop appearing pixilated and the system subsequently unresponsive.

In another case, I believe some application freezes and attempts to terminate it eventually lead to a BSOD. A subsequent reboot attempt fails because of some file corruption, necessitating, he reports, reinstallation of Win2000.

In my case, a simple COPY of a large number of files to a CD successfully copies roughly 40 files then freezes. The copy task (process) becomes unresponsive and Task Manager cannot terminate it. Also, because this process cannot be terminated, system shutdown fails. A shutdown attempt using START / Shut Down causes the desktop to become pixilated, but clicking on some window restores desktop's normal appearance. It is necessary to do a hard power-down. Usually the system then comes back up ok, but on one occasion a CHKDSK /F was required.

 

[satoriguru]

I dutifully applied KB40987, 841356, and 841533 in one go, only doing the required restart after all three had been executed. (Maybe that's just *asking* for it!)

The problem that has now arisen is that any right click applied to the Windows Explorer pane now results in an immediate shutdown of Explorer. Oddly, this only applies to the right hand pane using "Classic Folders" view. Not useful.

I'm now looking up an old DOS manual see how to copy and replace "explorer.exe" in safe mode.

I'll post if this works.

http://www.animation-backgrounds.com

 

[jlockley]

I had a serious problem after an automatic update. Microsoft will give full support on issues caused by the automatic update process. In my particular case, which preceded the most recent secutity patches, the update process corrupted the permissions files and the processes. After three days of support I ended up reinstalling all software on a large hard drive (I had wanted to do this, so it wasn't as hard a decision) and using the original as a usb external drive for a boot in case it happens again.

The advice I have received since this issue (January) is that you should never use automatic update but go to the site and update from there.

 

[wlfpackr]

satoriguru,

I'd be interested on hearing what you find out. I've got an end-user here that all heck broke loose after SP4 was installed. I've gotten everything straightened out except that every other time we try to open up Windows Explorer (and I'm serious when I say EVER OTHER time, it's the weirdest thing) it will crash with an Explorer.EXE - Application Error.

It's very annoying, but something we can live with until a fix is found.


=================
There are 10 kinds of people in this world, those that understand binary and those that do not.

 

[bcastner]

It is not Automatic Updates at issue per se but your connection, if you have a choice create a SUS (now WUS) server to handle patches. See:

http://www.susserver.com/

For large service packs, such as SP4 for Win2k (or SP2 for XP) it is better to download the full "Network" install image and use that. Particularly on dial-up, these are tool large to be reliable.

Any issue with service packs or hotfixes is without charge from Microsoft to resolve. In jlockley's case, a reinstall could have been avoided in most cases. There can be problems with NTFS filestore security, or registry security. This can be dealt with in most cases without reinstalling. If you ask here again with the details, I think your chances of resolving the issue without a reinstall approach 100%.

 

[jlockley]

I worked with MS support - it was free and excellent - for three days nearly solid. In the end we came to the conclusion that time spent tweaking would still be more than time spent on a clean wipe and reinstallation. Since all data is kept a separate drive and all programs on a separate partition, it was a bit easier.

 

[bcastner]

Thank you for the feedback. I have had good results with Microsoft tech support for any Service Pack or Hotfix issue. And they have never charged me.

 

[satoriguru]

wlfpackr,

Please note that I had not applied a full service pack, only the latest batch of "Critical" security patches for Win2KPro

My earlier post said:

"I'm now looking up an old DOS manual see how to copy and replace "explorer.exe" in safe mode.

I'll post if this works."

I've now found a Resource Kit utility called "inuse.exe" at

http://support.microsoft.com/default.aspx?scid=kb;en-us;228930

(Or search for :Article 228930)
This is an unsupported utility used at your own risk, and it allows you to replace files that are currently in use by the OS. It requires a reboot.

I'll post any success / failure.

Meanwhile, I'm collecting all the necessary info for a clean install on a new 160Gb disk that's been waiting for an occasion like this for months.

http://www.animation-backgrounds.com

 

[satoriguru]

Failure.

I started in Safe mode with command prompt, entered the inuse.exe syntax correctly, minimised the prompt window and restarted via Ctrl-Alt-Del Restart.

Win2K fires up, and Windows Explorer misbehaves in the same way:- Right clicking in the right hand pane (but not the left) makes Explorer terminate after a 1 second display of the hourglass. This behaviour also happens if I right click on the Quick Launch bar, which disappears but quickly returns. All the icons in the System tray get jumbled out of their loading order, too.
There is no error message with these events.

I have a lot of productive work to get on with, so I'm going ahead with a fresh install on my new HD, and try and catch up with the time I've lost dealing with this exasperating issue.

http://www.animation-backgrounds.com

 

[carrslem]

With respect to the original issue on this thread (serious problems with the recent Win2000 security update, KB841356, KB840987, & KB841533), this afternoon I uninstalled these three items and the problem disappeared. Therefore, it is now certain that there is, in fact, a very serious bug in this update.

For anyone experiencing freezes, BSODs, etc. since installing this security update, I recommend uninstalling it and seeing if your problems disappear. I uninstalled them in the above order. The order may or may not make any difference, but the above order worked. Before removing each of the first two, Windows warns that the removal may render the system unstable because of the interrelationship with the remaining one(s). I was careful to do absolutely NOTHING other than the removal process until all three had been removed.

I will attempt to contact MS on Monday.

 

[satoriguru]

carrslem,

I have to say a big thank you for this tip!

I uninstalled the three patches as you described, and lo, Windows Explorer is now functioning normally.

I'm doing a registry backup now.

As to which patch caused the problem, I might wait until you get a reply from MS.

Thanks again.

http://www.animation-backgrounds.com

 

[DanielUK]

I think I've been affected by this. See thread: thread616-941850

I had KB841356 installed which I removed but I still have problems. Unfortunately, I'm going to have to reinstall Win2k as I've spent enough time on this.

Dan

 

[neilcorbett]

We have had the same problems here, 3 Win 2k machines fully Service packed and updated. Worked fine prior to the Oct updates.

Once we applied the Oct updates we were getting blue screens when the PCs booted, uninstall of KB840987 solved the problem. All other patches are on the PCs and working fine.

Going down the same route as people here and an OS reload seems quicker solution than contacting MS.

Neil

 

[carrslem]

Yes, KB840987 seems to be the offending patch. See my thread entitled "Status Update ... " posted 10/26.

(Sorry, but I don't know where to find the thread number. The URL at that thread contains "9419478".)

 

[jlockley]

A question to people who probably know more than I do...have you tried booting with last good registry or in safe mode?

Before replacing the os you might try what has become my standard and generally successful last resort when things go wrong and removal doesn't work. Use any registry fixit program to purge the registry for remnants of unwanted programs. There are apparently some deinite downsides to these, although I have experienced none, but the small cost of the programs is worth not having to reinstall, and if your're reinstalling anyway, you've got little to lose.

My second absolutely last and less successful resort in such situations is to do a repair from the installation cd. Again, as long as you are going to strip and replace, what could it harm?

 

[neilcorbett]

I didn't much fancy 3 rebuilds so searched around and found a fix

Have a look here:

http://service1.symantec.com/SUPPORT/ent-security.nsf/pfdocs/2002071208532048

What I did was:

Download the MS update and the Intel update save them to disk, dont install them yet.

Disable Net access - see next step for why!

Disable all Anti Virus software

Install the IntelATA drivers as per symantecs link.

reboot ensure AV and internet access does not start.

install the update

Reboot and retstart all AV services. Final reboot and job done update installed.

Hope this helps a few of you