Author Topic: Reports Of Unbootable Machines After 2/09/10 Ms Updates  (Read 3179 times)

0 Members and 1 Guest are viewing this topic.

Offline quietman7

  • Microsoft® MVP
  • Malware Removal Mentors
  • Silver Member
  • Posts: 1092
Reports Of Unbootable Machines After 2/09/10 Ms Updates
« on: February 12, 2010, 05:03:14 pm »
MS update gives some XP boxes the Blue Screen
New Patches Cause BSoD for Some Windows XP Users

Blue Screen, Unable to Boot after Windows XP Update
Quote
IMPORTANT: If you are able to uninstall the patch and get back into Windows, in order to stay protected you can use the following automated solution which secures your PC against the vulnerabilities that are resolved with KB977165 until you can successfully get the update installed without the blue screens.

Please see the link below for the article describing the vulnerability that is fixed with KB977165 and how you can get protected without installing the actual KB update:

http://support.microsoft.com/kb/979682

Microsoft halts Windows Update distribution of security fix after blue-screen reports
Quote
Microsoft advised users who decide not to install the update to implement a workaround outlined in one of its security bulletins (CVE-2010-0232)  in the interim. There are more details about this workaround in Microsoft’s blog post.

Microsoft security experts say that some of the problems may be due to prior malware infestations on Windows users’ machines,


Microsoft MVP - Consumer Security 2007-2014
Member of UNITE

Offline K27

  • Malware Removal Staff
  • Gold Member
  • Posts: 2342
    • Go Good IT Solutions
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #1 on: February 13, 2010, 03:34:57 pm »
Thanks for that Quiteman7, Good Articles.

As stated in one of the above links, most if not all PC/Laptop manufactures now seem to think that it is OK to not ship a genuine Windows disc with thier machines and that a recovery partition and prompt to create a backup disc is adequate protection to save a system when it goes south.

I was wondering, if the user had no disc's and did not want to Factory Reset via the Recovery partition would a Linux disc give enough access to the system to be able to to get to "View Last Updates" and uninstall the problematic patch hence saving the system as a uninstall of KB977165 seems to do this.

Regards
K27.
SpywareHammer - Knowledgebase

The internet is the new age battle of the old age clash between good and evil

Offline PCBruiser

  • Malware Removal Mentors
  • Administrator
  • Diamond Member
  • Posts: 8037
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #2 on: February 13, 2010, 04:08:38 pm »
No, the uninstaller wouldn't run in a Linux environment.  It is a good thought and question, but it won't work.  What you can do is install the Recovery Console from within the Linux environment, and then do the fix from that.

It won't work in an external Windows environment, such as UBCD, either because the Windows environment is independent of the information contained in the uninstaller.  For example, the registry entries are all contained in the system's internal Windows environment, not the UBCD environment.  What you can do is manually reverse the update install by manually reverting files to their pre-update versions, reversing registry entries, etc.  Having said that, it would not be a job for the faint of heart or anyone other than an real expert with complete knowledge of exactly what changes any particular update made to the system.

I think this lesson is one where backups, backups and more backups are essential in today's real world computing.
Don't Read?  Can't learn!

Offline quietman7

  • Microsoft® MVP
  • Malware Removal Mentors
  • Silver Member
  • Posts: 1092
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #3 on: February 13, 2010, 04:17:32 pm »
Microsoft Security Response Center writes:
Quote
I am writing to let you know that we are aware that after installing the February security updates a limited number of users are experiencing issues restarting their computers. Our initial analysis suggests that the issue occurs after installing MS10-015  (KB977165). However, we have not confirmed that the issue is specific to MS10-015 or if it is an interoperability problem with another component or third-party software. Our teams are working to resolve this as quickly as possible. We also stopped offering this update through Windows Update as soon as we discovered the restart issues. However, those using enterprise deployment systems such as SMS or WSUS will still see and be able to deploy these packages.

While we work to address this issue, customers who choose not to install the update can implement the workaround outlined in the bulletin. CVE-2010-0232 was publicly disclosed and we previously issued Security Advisory 979682 in response. Customers can disable the NTVDM subsystem as a workaround and we have provided an automated method of doing that with a Microsoft Fix It that you can find here: http://support.microsoft.com/kb/979682.

Customers who are experiencing issues after installing any of our security updates can get help resolving the issues by either going to https://consumersecuritysupport.microsoft.com or by calling 1-866-PCSafety (1-866-727-2338). International customers can find local support contact numbers here: http://support.microsoft.com/common/international.aspx.
Restart issues after installing MS10-015
Microsoft MVP - Consumer Security 2007-2014
Member of UNITE

Offline Hoov

  • Malware Removal Mentors
  • Global Moderator
  • Diamond Member
  • Posts: 25706
  • Unwilling part owner of Gov't. Motors and Chrysler
    • Hoov's Personal Site
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #4 on: February 13, 2010, 05:52:38 pm »
This is just another reason to make the manufacturers send you all the OEM disks when you buy a system.

Consumer Security

If I am helping you and you don't hear from me for 24Hrs, send me a PM Please!

Offline K27

  • Malware Removal Staff
  • Gold Member
  • Posts: 2342
    • Go Good IT Solutions
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #5 on: February 14, 2010, 12:19:51 pm »
This is just another reason to make the manufacturers send you all the OEM disks when you buy a system.

That would be nice but I dont see it happening any time soon, I tried to get a Vista disc with my last machine purchase and was told by the retailer that it was down to the manufacture, and then was told by the manufacture that it was down to the retailer and was then told by a rather rude employee that if I want one I would have to pay for it.

@PCB

Thanks for the info on that, it also answers my next question which was going to be "would removing the HDD and connecting it to another machine be a viable option" but then the same restrictions would apply and installing the RC via Linux would be a much quicker, not to say easier option for some one to follow.
But like you said, with adequate backup's a Factory Reset would be simple enough.

SpywareHammer - Knowledgebase

The internet is the new age battle of the old age clash between good and evil

Offline Mister2

  • Global Moderator
  • Gold Member
  • Posts: 2380
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #6 on: February 14, 2010, 01:43:31 pm »
Dumb question:

Why don't the manufacturers of machines that don't ship with a full Windows disk automatically shift the My Documents folder to a separate partition?
It would be no extra work for them, and restoring to factory settings would (should) affect the boot partition only.
Never stop learning - visit the SpywareHammer Knowledgebase

Offline Hoov

  • Malware Removal Mentors
  • Global Moderator
  • Diamond Member
  • Posts: 25706
  • Unwilling part owner of Gov't. Motors and Chrysler
    • Hoov's Personal Site
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #7 on: February 14, 2010, 02:06:44 pm »
I have been trying to get people to use multiple partitions since the first time I had to reinstall windows and lost everything. I keep all my data files on the second partition. I just reinstalled Vista on my laptop, and reinstalling cleanly, updating, and installing all my other software took around 3 hrs. An image of the C: drive would do it faster, but 3 hrs isn't bad. And after installing everything, I spent about 15 minutes configuring everything to work with the data, and all was done. All my addons in Firefox and thunderbird, every single thing I did to customize it, all was there.

Consumer Security

If I am helping you and you don't hear from me for 24Hrs, send me a PM Please!

Offline K27

  • Malware Removal Staff
  • Gold Member
  • Posts: 2342
    • Go Good IT Solutions
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #8 on: February 14, 2010, 02:23:23 pm »
Since my first ever trip up, losing a system and having to reinstall every thing (about 3 days  :D1) I now keep nothing on my boot partition, every thing is on a "d" partition that is backed to a external and that is backed up to another external which is kept upstairs locked away and gets updated daily.

And I mean everything, all my program/tool installers, cann's(also on a thumb), logs, pics, music, FF bookmarks, iTunes library, the lot.

I learnt the hard way what its like to lose a system and have hardly any backups, and now it would take three simultaneous HDD failures, which without a natural disarster I hoping will never happen.  ;)1
SpywareHammer - Knowledgebase

The internet is the new age battle of the old age clash between good and evil

Offline Mister2

  • Global Moderator
  • Gold Member
  • Posts: 2380
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #9 on: February 14, 2010, 11:41:38 pm »
If you lost all three at once, I think restoring your data might be a secondary concern.
Getting down off the top of the mushroom cloud may be a little more important ...
Never stop learning - visit the SpywareHammer Knowledgebase

Offline K27

  • Malware Removal Staff
  • Gold Member
  • Posts: 2342
    • Go Good IT Solutions
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #10 on: February 15, 2010, 02:30:04 am »
 :a fingers crossed that never happens, I dont fancy re-writing my CR's even for a nuclear disaster.
SpywareHammer - Knowledgebase

The internet is the new age battle of the old age clash between good and evil

Offline Mister2

  • Global Moderator
  • Gold Member
  • Posts: 2380
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #11 on: February 15, 2010, 06:56:49 am »
... I dont fancy re-writing my CR's even for a nuclear disaster.
Spoken like a true Malware Fighter!!
Never stop learning - visit the SpywareHammer Knowledgebase

Offline K27

  • Malware Removal Staff
  • Gold Member
  • Posts: 2342
    • Go Good IT Solutions
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #12 on: February 15, 2010, 08:58:24 am »
Spoken like a true Malware Fighter!!

LOL,  :ty
SpywareHammer - Knowledgebase

The internet is the new age battle of the old age clash between good and evil

Offline faith_michele

  • Anti - Phishing Staff
  • Gold Member
  • Posts: 1947
    • A Beacon of Light
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #13 on: February 15, 2010, 07:31:23 pm »
:a fingers crossed that never happens, I dont fancy re-writing my CR's even for a nuclear disaster.

Knock on wood.......where is the smiley for that one?

Its bad enough having to reinstall all of the addons for me.   :)1

Microsoft Consumer Security MVP, July 2007-June 2010

"Fight your fights, find the grace in all the things that you can't change and help somebody, if you can." Van Zant

A Beacon of Light

Offline K27

  • Malware Removal Staff
  • Gold Member
  • Posts: 2342
    • Go Good IT Solutions
Re: Reports Of Unbootable Machines After 2/09/10 Ms Updates
« Reply #14 on: February 15, 2010, 09:15:53 pm »
Knock on wood.......where is the smiley for that one?


The closest I could find would be this one  :m  ;d
SpywareHammer - Knowledgebase

The internet is the new age battle of the old age clash between good and evil