XP SP3 - Hid KB77165 - Other 11 Installed in Groups OK

[Craig S]

I Disabled Malwarebytes and SuperAS Real-time + AV Real-Time, Hid the
advertised Updates Problem in Title, and Downloaded - Installed in Groups of
5, 3, 3 at a time. One in the last Group Failed 1st Download but Did Fine on
the next Re-try.

I suspect KB77165 is the single culprit BUT attempt Updates per your issue
tolerance WITH the Problem Update Un-checked and/or Hidden via Custom Install.

[Shenan Stanley]

What are you saying?

You have Windows XP ______ Edition with Service Pack 3 (32-bit obviously.)

One can assume - and it is really an assumption since later this might not
be as obvious - that the KB77165 you refer to is actually KB977165
(http://support.microsoft.com/kb/977165/) - is that correct?

So you are having trouble - and I really an trying to interpret what you
have said here - installing the other updates? And you believe - somehow -
that not installing the one update (KB977165) is keeping you from doing
this? Or is KB977165 still trying to install even though (and I think I am
reading this correctly) you hid it?

Actually - I cannot be sure of your issue.

I can understand your hiding update KB977165 for now. It has been known to
cause issues on some systems - particulary Windows XP systems infected with
certain things...

Win32/Alureon.A
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Virus%3AWin32%2FAlureon.A

More information on the ongoing investigation can be read here:
http://blogs.technet.com/msrc/archive/2010/02/12/update-restart-issues-after-installing-ms10-015.aspx

Then - what I see if I read your post again is that maybe you have no actual
issue. You downloaded and instaled the updates, hiding KB977165 out of the
FUD being spread and installing the rest and it took two or three (maybe
four) reboots to get them all installed (one 'failed' but successfully
instaled and stuck when attempted later.)

So if you could come back - clear up what you are asking (if anything) or
what you are saying (if not asking anything) - that would be very helpful to
all involved.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

[PA Bear [MS MVP]]

Why did you hide KB977165 (which is no longer being "pushed" via Automatic
Updates)?

Have you run Fix It #50364 in http://support.microsoft.com/kb/979682?
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002

[Craig S]

Hi Shenan and Robear: I thought I was saying (in Title) that I installed 11
out of 12 Updates in groups Successfully vs. all at once and Omitted
KB977165 because it was (advertised) to be the cause of Blue Screens some had
posted about. I suggested trying that if your tolerance for any other
possible issues surfaced. I Disabled Realtime on 3 Security Apps because (2)
different FW users had Fixed Update Problems by Disabling their FWs.

I haven't done Robear's suggestion because I got to it and read "To avoid
these (known) issues, we recommend that you close GPedit.msc before you run
the Fix it solution." I Googled and didn't find an easy "How to" for that so
I thought I'd see if MS came up with a fix of its own. Normally if I have 2
beers in the frig I'll try some things like this without waiting.
Thanks for the Replies!

> .
>

[PA Bear [MS MVP]]

> ...Omitted

> KB977165 because it was (advertised) to be the cause of Blue Screens some
> had posted about.

The vast majority of WinXP users have NOT experienced a BSOD after
installing KB977165. Then again, that vast majority of users don't have
hijackware-infested computers and aren't running lousy AV apps like AVG (or
the freebie McAfee or Norton suite from their ISP) nor have their AV
subscriptions ever expired.

That being said, KB977615 is "merely" an Important update, not a Critical
update. Running the KB979682 Fix It is an acceptable workaround for /one/
of the security vulnerabilities addressed by KB977165 but not for the second
one.

>..."To avoid

> these (known) issues, we recommend that you close GPedit.msc before you
> run
> the Fix it solution."

If it's a home computer, I'd very much doubt there are any Group Policies in
place, Craig.

Should you encounter problems after installing KB977165 manually (it's no
longer being pushed via Automatic Updates)...

For home users, no-charge support is available by calling 1-866-PCSAFETY
(and/or 1-866-234-6020 and/or 1-800-936-5700) in the United States and in
Canada or by contacting your local Microsoft subsidiary. There is no-charge
for support calls that are associated with security updates. When you call,
clearly state that your problem is related to a Security Update and cite the
update's KB number (e.g., KB977165).

If your problem relates to a Cumulative Security Update for IE, call the
above number and ask to be transferred to the "Consumer IE queue" (which is
47830).

Or you can...

Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Consumer Security Support home page & Microsoft Update Solution Center also
offer support options
https://consumersecuritysupport.microsoft.com/
http://support.microsoft.com/ph/6527#tab3

For more information about how to contact your local Microsoft subsidiary
for security update support issues, visit the International Support Web
site: http://support.microsoft.com/common/international.aspx

For enterprise customers, support for security updates is available through
your usual support contacts.

[Craig S]

Thanks, Robear. From your clarification on the types of machines having the
problem I went ahead and tried/Installed Successfully KB977165. It's nice to
get this Update out of the way.

If I may impose, a low-expertise friend has Free AVG which you obviously
dislike. What's your current preference in lieu of AVG Free?

All the best! Craig

> .
>

[PA Bear [MS MVP]]

Attaboy!

Recommendations (since you asked) include Microsoft Security Essentials
(free), Avira AntiVir (free), NOD32 (not the security suite) & Kaspersky
(not the security suite). Steer well clear of Norton, McAfee, and AVG.

Craig S wrote:
> Thanks, Robear. From your clarification on the types of machines having
> the
> problem I went ahead and tried/Installed Successfully KB977165. It's nice
> to
> get this Update out of the way.
>
> If I may impose, a low-expertise friend has Free AVG which you obviously
> dislike. What's your current preference in lieu of AVG Free?
>

[Paul Calcagno]

PA Bear, I've got a question for you about KB977165 and the fix you provided
a link for below.

I noticed on my wife's WinXP laptop (SP3) that she's got the KB977165 WU in
her Update queue (along with a bunch of other WU's). I was thinking that
since this update has caused problems that maybe what I can do is run the
fix and then just ignore the KB977165 update by unchecking it.

But I don't know how to stop Update from offering me KB977165 in the future
after I complete the fix. Is there a way to do that?

Thanks...................Paul C

"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message
news:eiIYp8Nr...@TK2MSFTNGP06.phx.gbl...

[Craig S]

Paul, on the chance Robear may stop checking this post thinking All is
well/Finished, the way I Stop Reappearance of Specific suggested Updates is
......via Custom install Vs. Express.

Clk the (+) by the Update to Hide; There is a box to check saying (ie)
"Don't show this update again". Chk it , close out, and it's gone next time
you Check Updates..........

To retrieve it, the Custom page has a sentence "You've hidden important
updates, Restore them now, with the Restore words in Blue Link form.

Good luck!

"Paul Calcagno" wrote:

> .
>

[PA Bear [MS MVP]]

OT: Thanks to Craig for replying to Paul's post which apparently did NOT
make its way to the NNTP newsserver (though it did make it to Google Groups)
due to the ongoing, 10 month-plus synchronization issues and so wasn't seen
by me.

====================

1. KB977165 was pulled from Automatic Updates on Thursday, 11 Feb-10 (cf.
http://blogs.technet.com/msrc/archive/2010/02/11/restart-issues-after-installing-ms10-015.aspx).

Translation: While Automatic Updates will no longer automatically install
KB977165, even if the installer's been downloaded, KB977165 continues to be
available/offered via Windows Update/Microsoft Update, WSUS, and SMS.

2. Any WinXP user who chooses to hide KB977165 should do it per the
instructions at the end of this post.

3. KB977165 is an Important (not a Critical) update. Those who choose to
hide it should avail themselves of Fix It #50364 in
http://support.microsoft.com/kb/979682. That being said, users should
understand that Fix It #50364 is an approved workaround for only one of the
/two/ security vulnerabilities addressed by KB977165 (MS10-015).

4. It would /appear/ that the vast majority of those who encounter BSODs
after installing KB977165 are seeing the effects of a rootkit hijackware
infection (e.g., Trojan W32/Alureon variants), not a "buggy patch."

5. Will MS re-released KB977165? I have no idea.

====================

HOW TO hide KB977165 (WinXP only):

1. Stop the Automatic Updates service:

Start > Run > (type in) services.msc > [OK]
Double-click Automatic Updates > Click on Stop
(Stopping the service will take a moment)

2. Delete the contents of the Download folder:

Start > Run > (type in) %windir%\SoftwareDistribution > [OK]
Open the Download folder and delete its contents
Close the window.

3. Go to Windows Update website | Select CUSTOM and allow the scan to
complete | Uncheck/deselect KB977165 and hide it ("Don't show me this update
again"). Install any other critical security updates offered. If a Root
Certificates update is listed in the Optional Software updates category on
the left-hand side of the scan results window, install it to take full
advantage of IE7's or IE8's enhanced security.

4. Start the Automatic Updates service:

Start > Run > (type in) services.msc > [OK]
Double-click Automatic Updates > Click on Start
(Starting the service will take a moment)

--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002

Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.