!Heads up for Lucy (and others) Bug in Update 810847
Max Burke
Cumulative Patch for Internet Explorer (810847)
05 February 2003
Microsoft Internet Explorer
Allow an attacker to execute commands on a user's system.
Critical
MS03-004
Since installing this update, numerous users, including myself, are
experiencing frequent crashes in Outlook Express with the following
event viewer errors being recorded:
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 8/02/2003
Time: 9:54:23 a.m.
User: N/A
Computer: CRAY1000
Description:
Faulting application msimn.exe, version 6.0.2800.1123, faulting module
shlwapi.dll, version 6.0.2800.1106, fault address 0x00002f17.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6d 73 69 ure msi
0018: 6d 6e 2e 65 78 65 20 36 mn.exe 6
0020: 2e 30 2e 32 38 30 30 2e .0.2800.
0028: 31 31 32 33 20 69 6e 20 1123 in
0030: 73 68 6c 77 61 70 69 2e shlwapi.
0038: 64 6c 6c 20 36 2e 30 2e dll 6.0.
0040: 32 38 30 30 2e 31 31 30 2800.110
0048: 36 20 61 74 20 6f 66 66 6 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 32 66 31 37 0d 0a 2f17..
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 8/02/2003
Time: 9:53:40 a.m.
User: N/A
Computer: CRAY1000
Description:
Faulting application msimn.exe, version 6.0.2800.1123, faulting module
mshtml.dll, version 6.0.2800.1141, fault address 0x0013d8b8.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6d 73 69 ure msi
0018: 6d 6e 2e 65 78 65 20 36 mn.exe 6
0020: 2e 30 2e 32 38 30 30 2e .0.2800.
0028: 31 31 32 33 20 69 6e 20 1123 in
0030: 6d 73 68 74 6d 6c 2e 64 mshtml.d
0038: 6c 6c 20 36 2e 30 2e 32 ll 6.0.2
0040: 38 30 30 2e 31 31 34 31 800.1141
0048: 20 61 74 20 6f 66 66 73 at offs
0050: 65 74 20 30 30 31 33 64 et 0013d
0058: 38 62 38 0d 0a 8b8..
So far the only fix is to roll back to a previous restore point to
prevent these crashes......
--
mlvburke@#%&*.net.nz
Replace the obvious with paradise to email me.
See Found Images at:
http://homepages.paradise.net.nz/~mlvburke
Lucy [MS]
Thank you for posting. We're currently investigating. Is this an XP
machine? Try installing 811630 and let me know if that resolves the
problem.
--
Thanks,
Lucy [MS]
Windows Update
* All advise is offered as-is without warranty of any kind
"Max Burke" <mlvburke@%$%#@.nz> wrote in message
news:eevjm4uzCHA.2368@TK2MSFTNGP12...
Max Burke
> HI Max,
> Thank you for posting. We're currently investigating. Is this an XP
> machine? Try installing 811630 and let me know if that resolves the
> problem.
Thanks for the quick response....
I'm running XP home edition......
WRT 811630 I installed that on the 6th Feb with 810847 and 810577.
I installed 810847 first, then 810577, and 811630 last.
I rebooted after installing all three patches.
Some more info; The crashes only 'appear' to happen when opening or
editing/typing in reply messages (for me and several others as reported
in the OE news group)
Lucy [MS]
Thanks for update. Are you replying using HTML? Can you change it to plain
text and see if we get the same thing.
--
Thanks,
Lucy [MS]
Windows Update
* All advise is offered as-is without warranty of any kind
"Max Burke" <mlvburke@%$%#@.nz> wrote in message
news:OeareivzCHA.2232@TK2MSFTNGP09...
Lucy [MS]
Also after reboot did you go back to Windows Update? Where you able to view
the list of updates?
--
Thanks,
Lucy [MS]
Windows Update
* All advise is offered as-is without warranty of any kind
"Lucy [MS]" <a-l...@online.microsoft.com> wrote in message
news:#B6$1uvzCHA.2868@TK2MSFTNGP12...
Max Burke
> Hi Max,
> Thanks for update. Are you replying using HTML? Can you change it
> to plain text and see if we get the same thing.
I have OE set to read AND reply in plain text.
Max Burke
> Max,
> Also after reboot did you go back to Windows Update? Where you able
> to view the list of updates?
Yes to both questions, to double check the updates had installed (to see
that they weren't being listed for install again) , and to check the
install history had been updated.
Madsen
> Faulting application msimn.exe, version 6.0.2800.1123, faulting
> module mshtml.dll, version 6.0.2800.1141, fault address
> 0x0013d8b8.
Same error here.
Error described in: <news:Xns931B1BDC...@madsen.tdcadsl.dk>
--
Regards
Madsen.
Lucy [MS]
--
Thanks,
Lucy [MS]
Windows Update
* All advise is offered as-is without warranty of any kind
"Max Burke" <mlvburke@%$%#@.nz> wrote in message
news:OY3wx6vzCHA.616@TK2MSFTNGP11...
Lucy [MS]
Can I please get more info? I need to find out what is the version of
mshtml.dll before (after restore)and after installing 810847. We are
currently in the process of trying to reproduce the problem.
Also can you please send me the System Information File to
a-l...@microsoft.com
Start > Run
Type "Msinfo32" (without quotes)
Press Ok
The System Information file will open.
Save the file to the desktop, name it Max.NFO
--
Thanks,
Lucy [MS]
Windows Update
* All advise is offered as-is without warranty of any kind
"Max Burke" <mlvburke@%$%#@.nz> wrote in message
news:OY3wx6vzCHA.616@TK2MSFTNGP11...
Madsen
> I need to find out what is the version of mshtml.dll before (after
> restore)and after installing 810847. We are currently in the
> process of trying to reproduce the problem.
Before applying the February 2003 Cumulative Patch, my version
number of mshtml.dll is 6.0.2800.1126. After it's 6.0.2800.1141.
(On WinXP Pro SP1 and Win2000 SP3 where the same error occur both
places here).
--
Regards
Madsen.
Robert Aldwinckle
> shlwapi.dll, version 6.0.2800.1106, fault address 0x00002f17.
I have had a crash in that module since OE6sp1.
The conditions are: Troubleshooting logging for Mail is active
and connection drops or is dropped (e.g. using Work Offline
hangup prompt). Fix is to turn off Troubleshooting logging
before hanging up the connection.
This is the top entry in the Stack Back Trace:
0006f6bc 70a72db3 0006f6f4 000000ff 0006f808 SHLWAPI!wvnsprintfA+0x163
This is the crash address (which appears to be a kind of entry point):
FAULT ->70a72f17 8a10 mov dl,[eax] ds:0023:00002745=??
This is the module map entry for that module:
(0000000070a70000 - 0000000070ad4000: D:\WINDOWS\system32\SHLWAPI.dll
Therefore, my crash has also been at offset +2f17
The apparent entrypoint name wvnsprintfA is consistent with
the idea that a log file could be involved with the crash.
---
"Max Burke" <mlvburke@%$%#@.nz> wrote in message
news:eevjm4uzCHA.2368@TK2MSFTNGP12...
Lucy [MS]
Thank you so much for your help. I'm wondering if replacing 6.0.2800.1141
with 6.0.2800.1126 will solve the problem? Has anyone tried this?
Sorry for the inconvenience, we're currently investigating the problem.
--
Thanks,
Lucy [MS]
Windows Update
* All advise is offered as-is without warranty of any kind
"Madsen" <nos...@madsen.tdcadsl.dk> wrote in message
news:Xns931C144A...@madsen.tdcadsl.dk...
Madsen
> I'm wondering if replacing 6.0.2800.1141 with 6.0.2800.1126 will
> solve the problem?
It does here.
--
Regards
Madsen.
Max Burke
> Max,
> Can I please get more info? I need to find out what is the version of
> mshtml.dll before (after restore)and after installing 810847. We are
> currently in the process of trying to reproduce the problem.
V1126 before, v1141 after.....
I will try replacing v1141 with v1126 to see if that helps.
MSinfo32 file emailed.....
Ray
Feb)
The crashbox reports:
MSIMN caused an invalid page fault in module MSHTML.DLL at 0167:636bd8b8
This happens only in OE6 and usually on the second attempt to "Create Mail"
or an attempt to forward an email.
Basically it only allows the sending of one email per crash. The crash only
pulls down the application not the OS.
Everything was fine prior to this update.
Running Win98 SE, IE 6 and OE 6 both version 6.00.2800.1106
MSHTML.dll is now 6.00.2800.1141
Regsvr32 is no help nor SFC
..Ray
================================================================
"Robert Aldwinckle" <rob...@techemail.com> wrote in message
news:#Dar#mxzCHA.2584@TK2MSFTNGP11...
Max Burke
> Having the same problems since updates installed. (The cumulative
> patch for Feb)
> The crashbox reports:
> MSIMN caused an invalid page fault in module MSHTML.DLL at
> 0167:636bd8b8
> This happens only in OE6 and usually on the second attempt to "Create
> Mail" or an attempt to forward an email.
> Basically it only allows the sending of one email per crash. The
> crash only pulls down the application not the OS.
> Everything was fine prior to this update.
> Running Win98 SE, IE 6 and OE 6 both version 6.00.2800.1106
> MSHTML.dll is now 6.00.2800.1141
> Regsvr32 is no help nor SFC
A temporary workaround (until it's fixed) appears to be restore or
revert back to MSHTML.dll v1126.
I did this earlier today and haven't had any crashes since then.
Ray
It is no longer on my machine and it is not located on my win CD.
..Ray
"Max Burke" <mlvburke@%$%#@.nz> wrote in message
news:Zu31a.1087$324.1...@news02.tsnz.net...
Max Burke
>> "Max Burke" <mlvburke@%$%#@.nz> wrote in message
>> news:Zu31a.1087$324.1...@news02.tsnz.net...
>> A temporary workaround (until it's fixed) appears to be restore or
>> revert back to MSHTML.dll v1126.
>> I did this earlier today and haven't had any crashes since then.
> Now, the question is where do I get version 1126?
> It is no longer on my machine and it is not located on my win CD.
> ..Ray
From your last full backup?
What OS?
If it's XP or Win2K there will be several copies of MSHTML.dll v1126 on
your computer provided you have been keeping up to date with all the
patches.
Ray
the previous files are GONE!
Wish I was running Win2K but that hasn't happened. I'm trying to ignore that
XP exists, tried the beta and that was enough.
..Ray
Madsen
> A temporary workaround (until it's fixed) appears to be restore or
> revert back to MSHTML.dll v1126.
>
> I did this earlier today and haven't had any crashes since then.
I did too and haven't seen the error since on WinXP Pro (US) SP1.
Later today I will try the same thing on Win2000 Pro (DK) SP3.
--
Regards
Madsen.
Madsen
> Later today I will try the same thing on Win2000 Pro (DK) SP3.
And OE 6.00.2800.1123 on Win2000 SP3 is also working fine if I
replace Mshtml.dll 6.0.2800.1141 with Mshtml.dll 6.0.2800.1126
after the February 2003, Cumulative Patch for Internet Explorer
is installed.
If it's not replaced, OE crashes constantly.
--
Regards
Madsen.
Lucy [MS]
If you replace the MSHTML.dll with previous version does that solve the
problem?
--
Thanks,
Lucy [MS]
Windows Update
* All advise is offered as-is without warranty of any kind
"Ray" <cycl...@excite.com> wrote in message
news:e3rTmwzzCHA.2232@TK2MSFTNGP11...
Lucy [MS]
address? cycl...@excite.com
I'll try again
--
Thanks,
Lucy [MS]
Windows Update
* All advise is offered as-is without warranty of any kind
"Ray" <cycl...@excite.com> wrote in message
news:ug4l6x1zCHA.1628@TK2MSFTNGP10...
Phillip Remaker
>
> Thanks for update. Are you replying using HTML? Can you change it to plain
> text and see if we get the same thing.
I have the same problem, and it happens with HTML or Plain Text. I
always use plain text, but switched to HTML when I saw the error was
in MSHTML.DLL. It will still randomly crash during compose,
regardless of what format is used.
Seems to me more common when doing a reply as opposed to a straight
compose, if that helps. There seems to need to be a bunch of text
before it happens. I cannot reproduce on demand, though. Yet.
Madsen
> It will still randomly crash during compose, regardless of what
> format is used.
Doesn't matter which format I use either.
> Seems to me more common when doing a reply as opposed to a straight
> compose, if that helps. There seems to need to be a bunch of text
> before it happens.
Same here. It often happens if I place the cursor behind the last
word in a sentence and press the enter key. Maybe not the first time
I press Enter but sooner or later it will.
--
Regards
Madsen.
Ray
Yes, cycl...@excite.com is a valid address. Matter of fact I just received
some mail over there a few minutes ago.
You can also use cycl...@pacbell.net, it's more direct but it goes through
OE.
As soon as I receive the 1126 dll I will let you know if it works for me.
Thanks,
..Ray
"Lucy [MS]" <a-l...@online.microsoft.com> wrote in message
news:ekSKjr4zCHA.2308@TK2MSFTNGP09...
Madsen
> As soon as I receive the 1126 dll I will let you know if it works
> for me.
I wonder what happens if you install the newest OE after the
Cumulative Patch for Internet Explorer (810847) is installed.
<http://www.microsoft.com/windows/ie/downloads/recommended/q331923/default.asp>
This version of OE has Mshtml.dll 6.0.2800.1126 AFAIK.
--
Regards
Madsen.
Ray
I renamed mshtml.dll and installed the patch that's linked below this
message.
It doesn't install a replacement for mshtml.dll and if you don't rename the
file it remains at v 1141.
Thanks for the idea, though.
..Ray
"Madsen" <nos...@madsen.tdcadsl.dk> wrote in message
news:Xns931CDCA6...@madsen.tdcadsl.dk...
Madsen
> I just tried this but it didn't work.
Damn.
> Thanks for the idea, though.
Your welcome.
--
Regards
Madsen.
Max Burke
>> Max Burke wrote:
>> A temporary workaround (until it's fixed) appears to be restore or
>> revert back to MSHTML.dll v1126.
>> I did this earlier today and haven't had any crashes since then.
> I did too and haven't seen the error since on WinXP Pro (US) SP1.
Yeah but I did that because you did it first.....
So I should be crediting you with providing the fix.... Thanks.
> Later today I will try the same thing on Win2000 Pro (DK) SP3.
--
Madsen
> Yeah but I did that because you did it first.....
Ohhh, okay. :)
--
Regards
Madsen.
Ray
previous dll
..Ray
"Lucy [MS]" <a-l...@online.microsoft.com> wrote in message
news:eazLYn4zCHA.1736@TK2MSFTNGP10...
Lucy [MS]
--
Thanks,
Lucy [MS]
Windows Update
* All advise is offered as-is without warranty of any kind
"Ray" <cycl...@excite.com> wrote in message
news:OjKV6p8zCHA.2916@TK2MSFTNGP09...
Max Burke
> Ray,
> If you replace the MSHTML.dll with previous version does that solve
> the problem?
What does replacing v1141 with v1126 do to update 810847?
Does it 'break' the fixes in the patch?
Ray
You are an angel from heaven!
Didn't get home till' 11:30 pm and went straight to the computer and found
that I received your file.
Installed it and everything is functioning PERFECTLY !!!!!!!!!!!!!!!!!!!!!!!
Thank you very much !!!
You're a doll !!!!
..Ray
"Lucy [MS]" <a-l...@online.microsoft.com> wrote in message
news:OxW5kS#zCHA.2696@TK2MSFTNGP09...
Madsen
> What does replacing v1141 with v1126 do to update 810847?
>
> Does it 'break' the fixes in the patch?
Good question.
Windows Update says that all updates are installed although I have
replaced v1141 with v1126, but there must be some side effects in
doing that.
--
Regards
Madsen.
Vivienne
Because of problems writing emails with Outlook Express, I have rolled back
my computer to pre February update time and I now have no problems.
However Windows Update would now like to install the same three updates.
Which ones do I agree to? I would like to be as up-to-date as possible but
not have problems either.
Thanks!
Vivienne
Gerry Cornell
The bug in IE update 810847 it would seem is rectified by the latest Hotfix IE update 813951 issued on 12 February 2003 by Microsoft. The documentation does not refer to problem described in this thread but it has so far worked for me.
--
~~~~~~
Hope this helps.
Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA
gc...@yesit.co.uk
Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.
http://dts-l.org/goodpost.htm
~~~~~~~~~~~~~~~~~~~~~~~~
"Vivienne" <vivi...@rogers.com> wrote in message news:uHC9im30CHA.1620@TK2MSFTNGP11...
Gerry Cornell
Try here:
http://www.microsoft.com/windows/ie/downloads/critical/813951/default.asp
--
~~~~~~
Hope this helps.
Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA
gc...@yesit.co.uk
Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.
http://dts-l.org/goodpost.htm
~~~~~~~~~~~~~~~~~~~~~~~~
"Vivienne" <vivi...@rogers.com> wrote in message news:uHC9im30CHA.1620@TK2MSFTNGP11...
Max Burke
> Sorry wrong link for update!
> Try here:
>
http://www.microsoft.com/windows/ie/downloads/critical/813951/default.asp
<quote>
The 810847 revision does not include the fix for this issue. We're
still working on this solution and will be posted as soon as possible.
--
Thanks,
Lucy [MS]
Windows Update
* All advise is offered as-is without warranty of any kind
<end quote>
No I dont know why it works for some and not for others like me......
Gerry Cornell
It seemed to work for me but after a days respite I lost a long message. That's life I suppose.
--
~~~~~~
Regards.
Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA
gc...@yesit.co.uk
Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
"Max Burke" <mlvburke@%$%#@.nz> wrote in message news:Ixj3a.3071$324.4...@news02.tsnz.net...
Max Burke
>> Max Burke wrote:
> Max
> It seemed to work for me but after a days respite I lost a long
> message. That's life I suppose.
I have tried installing hotfix 813951 twice now and both times the
crashes have continued......
Ben Hogland
news on this?
TIA
Ben
"Max Burke" <mlvburke@%$%#@.nz> wrote in message
news:cqy3a.3161$324.5...@news02.tsnz.net...
Max Burke
> It's now the 26th and still crashes using the current version..
> What's the news on this?
Zip, zero, nothing, .........
IOW.....
I'm not holding my breathe waiting for them to fix it though, as the
impression I get from a few MS employees and some MSMVP's that have
commented on this problem is that they have no idea why it's happening,
let alone how to fix it, even though I have posted several detailed logs
of the OE crashes to Microsoft as requested by them when I first
reported the problem......
Then there's the fact that OE is freeware, so MS dont really have any
incentive to provide a fix for OE, when update 810847 has fixed the
security vulnerabilities it was supposed to fix.....
Gerry Cornell
Freeware? The recent legal difficulties were over the combination / integration of Windows and Internet Explorer! It is part of Windows 98 / Windows XP, which most of us pay / paid for so it's hardly freeware!
--
~~~~~~
Regards.
Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA
gc...@yesit.co.uk
Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
"Max Burke" <mlvburke@%$%#@.nz> wrote in message news:9_h7a.548$8b.9...@news02.tsnz.net...
Robert Aldwinckle
...
> I have tried installing hotfix 813951 twice now and both times the
> crashes have continued......
Why have you had to install it twice?
As I understand it that fix has nothing to do with the
mshtml.dll problem. It only repatches the urlmon.dll
which 810847 also hit incorrectly/incompletely.
BTW I think that Working Offline significantly reduces the
frequency of the crashes. Unfortunately I only ever work
online on a completely different account so my basis for
saying that can't be tested on the account where I do most
of my work. Suffice it to say that I have had most of my
crashes when I was Working Online and least when Working
Offline.
Also I have finally managed to get my own drwtsn32.log working
again and done a rough survey of the crash details from all the
ones I have seen. With only a few exceptions the crash seems
to occur with a junk pointer value of ESI=00000008 or ESI=0000010.
The highest value I saw was ESI=000000e8. (IOW no real pointers
so at the very least they should be able to add some validation if they
can't figure out how the bogus values occur.)
---
Max Burke
>> I have tried installing hotfix 813951 twice now and both times the
>> crashes have continued......
> Why have you had to install it twice?
Just prove it did NOT fix this problem by testing the theory that it
did.......
I first installed it from the Windows Update website and tried it, the
crashes continued.
I then ran a system restore back....
I then downloaded the hotfix, and installed it manually off line. The
crashes continued.
I then ran a system restore back, satisfied that the hot fix does NOT
stop Outlook Express crashing.....
I had no real need to install the hotfix as I dont use MSN mail, nor
have I had any problems with logging on to subscription sites, as I am
not subscribed to any such web sites.
> As I understand it that fix has nothing to do with the
> mshtml.dll problem. It only repatches the urlmon.dll
> which 810847 also hit incorrectly/incompletely.
That is why I tested it, because a few people posted saying that
installing the hot fix did stop the crashes.
> BTW I think that Working Offline significantly reduces the
> frequency of the crashes.
That may well be, but then it's a crippling 'workaround' to the problem
isn't it, just like pressing cntrl s is to avoid the crashes. Cntrl s
has it's place sure, but as a way to avoid a bug that needs fixing? I
dont think so.
The best 'work around' so far is to roll back to mshtml.dll v1126 until
MS release a proper fix for it.....
That also may have it's risks, as it may cause the fix, or future
updates to fail, or may even undo the security fix that update 810847
was supposed to fix.
I have asked if replacing mshtml v1141 with mshtml v1126 will break the
security fixes that 810847 installs but have yet to have an answer;
Others have asked if it will break future updates that expect mshtml.dll
v1141 to be present, and they haven't received any answer either....
The *silence* from MS about this bug and if they're going to fix it is
very 'telling'.....
> Unfortunately I only ever work
> online on a completely different account so my basis for
> saying that can't be tested on the account where I do most
> of my work. Suffice it to say that I have had most of my
> crashes when I was Working Online and least when Working
> Offline.
> Also I have finally managed to get my own drwtsn32.log working
> again and done a rough survey of the crash details from all the
> ones I have seen. With only a few exceptions the crash seems
> to occur with a junk pointer value of ESI=00000008 or ESI=0000010.
> The highest value I saw was ESI=000000e8. (IOW no real pointers
> so at the very least they should be able to add some validation if
> they can't figure out how the bogus values occur.)
--
Robert Aldwinckle
...
> The *silence* from MS about this bug and if they're going to fix it is
> very 'telling'.....
Yes. I think what it shows is that there is a huge flaw in their policy
about fixes. They refuse to make changes unless they can
"reproduce" a problem. But there are cases where problems
are caused by asynchronous or random factors which make it
impossible to say: Here are the steps required to cause this
crash. Nobody seems capable of just doing a post-mortem
analysis of a dump anymore and make changes based solely
on logic.
We saw it before with the "Signature bug" which fortunately
didn't affect so many but was just as frustrating when
it happened. That went on for about two and half years.
Hopefully this time we won't have to wait quite so long.
Robert
---