April 11 patch re-released with fixesThe original version of security bulletin MS06-015 causes problems with Microsoft Office and other apps when you try to open or save files in the My Documents folder; with Internet Explorer when you type Web addresses into the Address Bar; and with an untold number of other programs.
The Redmond company says the problems are being caused by older versions of HP Share-to-Web software, nVidia graphics drivers, and Kerio Personal Firewall. But I believe there may be other conflicts at work, as I discuss below.
In addition, Microsoft released a surprising number of other hotfixes and notices on Apr. 25. These include:
• In Outlook Express, some Address Books now won’t work after you install MS06-016;
• Hotfix 900485, which was originally issued by Microsoft in December 2005 to correct a rare XP crash, started being pushed out to users as a “security patch,” apparently in error;
• Windows Genuine Advantage, which previously checked for pirated versions of Windows only when a user downloaded free programs from Microsoft’s site, started being installed on every machine that has Automatic Updates turned on in the U.S., U.K., Australia, New Zealand, and Malaysia.
I’ll give you help for these and other April surprises below. First, let’s look at the worst problems, which affected people who installed MS06-015.
Workarounds for MS06-015 problems
The problems caused in Microsoft Office and other apps after installing MS06-015 has to be one of Microsoft’s biggest blunders. Fortunately, these issues seem fairly easy to correct, now that the Redmond company has re-released its bulletin.
If you’re affected by any of the problems related to MS06-015, they’re most likely to be resolved by running Windows Update or the improved Microsoft Update. If the update routine detects that you have drivers that conflict with MS06-015, entries will be written into the Registry, after which things should function normally. According to Microsoft, there’s no new version of the patch binaries themselves, just these new, more-forgiving Registry entries.
If that doesn’t solve your problems, the update routine may not be detecting anything that suggests the changes are needed. In such a case, you may need to uninstall MS06-015 and then run Microsoft Update to get the 2.0 behavior. To do this:
Step 1. Reboot to remove any programs that may be in memory;
Step 2. Run the Add/Remove Programs control panel and uninstall update 908531 (security patch MS06-015);
Step 3. Run Windows Update or Microsoft Update, which should offer you MS06-015 as a critical security patch. Install the patch.
If you can’t get the bad behavior fixed using Microsoft Update for some reason, reader Andy Suarez has a description of a manual workaround (which was developed before the re-released bulletin became available):
- “I’m sure you have already been alerted to it, but there seems to be a problem circulating on Windows machines… Symptoms are:
• Cannot type a Web site into the Address Bar in IE — causes a indefinite wait time. It never goes anywhere. Typing www.website.com does not work. Typing website.com does not work. The only way for IE to bring you anywhere is to type http://www.website.com.
• Going to a Favorite, clicking on a link in a Web page, or typing the Web site in as a Run command brings you to the Web site. It seems to only affect the Address Bar.
• Trying to do a “save as” in a MS Office document leaves you with an hourglass that never goes away and never brings you to a folder listing. The same thing applies to trying to add an attachment to an e-mail in Outlook. This leads me to believe that it affects any program that brings up a box to navigate through Windows folders to save/open a file. …
“The solution:
1. Close any open windows.
2. Go into Task Manager and kill any processes called verclsid.exe.
3. Go into the c:windowssystem32 folder (on a WinXP machine, where c:windows is the drive where windows is installed).
4. Make sure that file extensions can be seen (Tools, Folder Options, View tab, Hide extensions for known file types off, click OK).
5. Scroll down to the file named verclsid.exe and rename it to verclsid.old.
6. Change the option back for file extensions to not be shown (if you want).
7. Voilà, everything works again.
“I guess you could have just have deleted the verclsid.exe file, but I don’t know if we will need to change it back eventually when whatever is wrong is fixed."
• You can’t access files in My Pictures or other “special” folders;
• Right-clicking a file in Windows Explorer or on the Desktop, and then clicking Send To, doesn’t do anything;
• Trying to expand a folder in Windows Explorer has no effect.
For more information on the patch and the workarounds for the conflicts it causes, see Knowledge Base article 918165 and security bulletin MS06-015.
Coping with other April Fools’ issues
Since some of the newly released material just appeared yesterday, information is still a bit sketchy. Here are the best resources I’ve found on these topics:
• Address Books won’t open in Outlook Express. This apparently affects only Address Books that were created with older versions of Outlook Express and developed minor file corruption at some point. OE won’t load such Address Books after you install MS06-016. Microsoft has published an official workaround, which involves copying the affected file to a new name, manually deleting the old file, and then importing the renamed file. See KB 917288.
• Hotfix 900485 for XP SP2 being pushed out automatically. This patch is described by Microsoft in KB 900485. That article doesn’t explain why this 2005 hotfix is being deployed to everyone now. It’s probably just a Microsoft error. The situation is unclear even to MVPs (Most Valuable Professionals), as evidenced by a cryptic exchange in the Windows Update forum.
• FrontPage 2002 Server Extensions require special installation. If you use Microsoft’s Systems Management Server (SMS), you may need to avoid problems installing the FrontPage 2002 Server Extensions in security bulletin MS06-017 by using "interactive mode." See KB 917627.
• Outlook Web Access doesn’t work in IE 6 or Vista. After you install the so-called Eolas patent downgrade to IE, which has been released in various forms over the past several weeks, OWA won’t work in IE 6. It doesn’t work in the beta of Windows Vista, either, which is a separate problem. Both issues can be corrected with a hotfix to Microsoft Exchange Server. See KB 911829.
• Genuine Advantage automatically being installed in many countries. With no notice, Microsoft began installing Genuine Advantage to users in English-speaking countries and Malaysia on Apr. 25. This software had previously checked for pirated versions of Windows only when users tried to download free software from Microsoft’s site. Now it runs immediately, displaying warning messages if it feels that something is amiss.
It’s natural for Microsoft to want every copy of its software to be licensed. But many companies would rather not find out about this suddenly when they’re in the midst of some mission-critical process.
For more information, read the analysis by the Washington Post’s Brian Krebs and Microsoft’s Knowledge Base article 905474. The KB explains a way to disable the notifications that emit from Genuine Advantage. The change is said to work until the next time Microsoft decides to release a GA update. The article states that Genuine Advantage cannot be uninstalled once it is in place.
More fixes for Windows users
The problems with this month’s patches, especially the quiet mass installations of Genuine Advantage, are stimulating a healthy debate among the contributing editors of Windows Secrets. I’m personally considering whether to reverse the recommendation in our Security Baseline section that home users should leave Automatic Updates turned on. Microsoft is destroying the credibility of Automatic Updates by using it to force the installation of nonsecurity hacks, such as Genuine Advantage.
If you’re willing to actually pay attention when new critical updates are released, use the Automatic Updates control panel to switch its behavior to Notify me but don’t automatically download or install them. Then, when notified, select the most critical updates for installation — after you’ve read the paid version of that week’s Windows Secrets Newsletter.
Each month, we publish an issue that appears only 2 days after Patch Tuesday. We grill our sources to find and reveal to you all the negative side-effects involving every Microsoft patch that’s just been released. We follow this up 16 days after Patch Tuesday in our next issue, with further details we’ve learned.
The paid version of today’s newsletter is where we have the best information about problems and fixes related to the April patches.
As I said above, I believe more software is having problems with MS06-015 than Microsoft has explained. In today’s paid newsletter, I include a description of problems with DUN connections and possibly other software that clearly seems to be April Fools’ patch-related.
Also, Susan Bradley’s column explains the ins and outs of the Patch Tuesday problems and other issues you may run into.
Any reader may upgrade and immediately receive today’s paid version — and our next 12 months of secrets — by making a voluntary financial contribution — whatever amount it’s worth to you. Check it out. How to upgrade
To send us more information about the April patches, or to send us a tip on any other subject, visit WindowsSecrets.com/contact. You’ll receive a gift certificate for a book, CD, or DVD of your choice if you send us a comment that we print.
Brian Livingston is editor of the Windows Secrets Newsletter and the coauthor of Windows 2000 Secrets, Windows Me Secrets, and eight other books.
Here I was, looking for fallout from Microsoft’s Eolas/Internet Explorer patch — but most of the issues came instead from other patches.
I don’t gush over new software very often. Most of what I see looks like same-old, same-old, maybe with a burnished bell here or a twisted whistle there.
For as long as people have been finding security vulnerabilities, software vendors have been trying to "slipstream" security fixes. What’s surprised me in the past few weeks is that a couple of big vendors have admitted to it and are trying to justify the practice.
As you’ve seen in the top story in this issue, the patches Microsoft released via its regular Patch Tuesday schedule on April 11 caused serious grief for many people. Unfortunately, I believe there are still other software conflicts that Microsoft hasn’t yet confirmed.