Post-Windows Update Black Screen Issue

[mcintoshs]

Can you provide an update on the status of this:

http://www.networkworld.com/news/2009/113009-latest-microsoft-patches-cause-black.html?hpg1=bn&source=NWWNLE_nlt_security_2009-11-30

[PA Bear [MS MVP]]

<pft>

[MowGreen]

Can who provide it ? There is no official MS presence here, only
volunteers.
As far as I'm concerned this "story" is an Urban Myth or this newsgroup
would have been flooded with KSOD posts starting when the updates were
pushed out on November 10th. And, since a sizeable number of Businesses
test updates before applying them, MS would definitely have been aware
of this supposed "KSOD issue" by now.

See if you can find *one post* about KSODs in this newsgroup that was
caused by November's Security updates !

BTW:
> Prevx was alerted to the problem by users of its security software last week, Morris said

It appears that Prevx does not know how to use a *proper* search term
using Google to find out how many of these posts occurred since the
*November updates* were pushed out.
I did a search earlier on Google using their Groups option with the term
november 2009 ksod
In total there were *20 posts on KSODs* made in November !!!!
Now, since the Myth is spreading, there's a grand total of *43*
Yet Prevx stated:

" If you Google Black Screen then you will find a whopping 80Million
plus results, mostly dominated by people searching for a fix to this
problem. "

First off, they never actually *specifically* document November's
Security updates relation to "this problem" and yet state it was caused
by November's updates ? That's pure and utter Hogwash !

The most likely cause of this issue stems from Prevx' software removing
malware from infected systems or a driver conflict caused by the one
*Prevx* installs.

MowGreen
===============
*-343-* FDNY
Never Forgotten
===============

banthecheck.com
"Security updates should *never* have *non-security content* prechecked"

[MowGreen]

And now, it's being claimed that *** October's *** Security updates
caused the KSODs. ( Pick a month already, will ya )
Which would be more likely except that ...

<quote>
Microsoft said it is aware of the issue and sent seattlepi.com
<http://www.seattlepi.com> the following statement:

* Microsoft is investigating reports that its latest release of
security updates is resulting in system issues for some
customers.
* Based on our investigation so far we can say that we're not
seeing this as an issue from our support organization.
* The issues as described also do not match any known issues
that have been documented in the security bulletins or KB
articles.
* As always, we encourage customers to review the security
bulletin and related KB articles and test and deploy security
updates.
* If customers do encounter an issue with security updates, we
encourage them to contact our Customer Service and Support
group for no-charge assistance. Customers can contact CSS
using the information at http://support.microsoft.com/security.
</endquote>

MowGreen
===============
*-343-* FDNY
Never Forgotten
===============

banthecheck.com
"Security updates should *never* have *non-security content* prechecked"

<snurp>

[PA Bear [MS MVP]]

MSRC Blog: Reports of Issues with November Security Updates
http://blogs.technet.com/msrc/archive/2009/12/01/reports-of-issues-with-november-security-updates.aspx

[MowGreen]

And here's an apology from Prevx:

http://www.prevx.com/blog/141/Windows-Black-Screen-Root-Cause.html

" We have always strongly recommended keeping Windows and all other
software up-to-date to reduce the window for exploitation by new
threats. We'll keep you updated with further progress if we find
anything new.

We apologize to Microsoft for any inconvenience our blog may have
caused. This has been a challenging issue to identify. Users who have
the black screen issue referred to can still safely use our free fix
tool to restore their desktop icons and task bar. "

The issue is resolved by adding Explorer.exe to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell=Explorer.exe

IF one ever encounters this so-called KSOD, press ALT+CTRL+DEL 3 times
and choose to open Task Manager.
Click the Applications tab.
Click New Task.
Click the Browse button and navigate to the Windows directory.
Click on explorer.exe, click Open.

Once Windows Explorer has loaded, open the registry editor and ensure
that Explorer.exe is listed for Value Name Shell.
If it's not, add it by right clicking on Shell and choosing Modify.
Enter Explorer.exe in the Value Data field and click OK.

MowGreen
===============
*-343-* FDNY
Never Forgotten
===============

banthecheck.com
"Security updates should *never* have *non-security content* prechecked"

PA Bear [MS MVP] wrote:

[MK]

But people still having issues, doesnt matter if caused by updates or not.
Some of them (like me) can't get any fix.
And couldnt be malware on my case, since it's on a 2008 server.

"MowGreen" wrote:

> .
>

[Shenan Stanley]

MK wrote:
> But people still having issues, doesnt matter if caused by updates
> or not. Some of them (like me) can't get any fix.
> And couldnt be malware on my case, since it's on a 2008 server.

The latter statement makes no sense. ;-)
Just because you are running a server OS does not mean you immune to
anything.

And knowing the cause of something *does* matter. Sometimes (most?) it is
easier to fix if you know why it is happening.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

[PA Bear [MS MVP]]

Yeah, right...

[IJH]

I can tell you for a FACT it is Novembers updates that cause this.

I'v just released Novembers updates via WSUS in our network, after testing,
and immediately after installing on 100 machines i have had 10 so far exhibit
this behaviour. They were running perfectly well before these updates.

Uninstalling the updates doesn't help, so whatever has been modified stays
modified.

So thanks MS, i now have the run up to xmas with all this s*it to sort out!

"PA Bear [MS MVP]" wrote:

> .
>