Microsoft Security Bulletin Re-Release

[BobArch2]

I received the following message from Microsoft last night... 2014.08.15 10:24PM
-----------------------------------------------------------------
Summary
=======
The following bulletins have undergone a major revision increment.
Please see the appropriate bulletin for more details.

* MS14-045 - Important

Bulletin Information:
=====================

MS14-045 - Important

- https://technet.microsoft.com/library/security/ms14-045
- Reason for Revision: V2.0 (August 15, 2014): Bulletin revised
to remove Download Center links for Microsoft security update
2982791. Microsoft recommends that customers uninstall this
update. See the Update FAQ for details.
- Originally posted: August 12, 2014
- Updated: August 15, 2014
- Bulletin Severity Rating: Important
- Version: 2.0

----------------------------------------------------------------

It affects several versions of Windows.

Here is the link for the Update FAQ

Proceed as you see fit...

[HansV]

Thanks, I do have the update but I haven't noticed any problems yet.

[BobArch2]

Thanks, I do have the update but I haven't noticed any problems yet.

I also have the update, and like you, have not noticed any problems. So, I am tempted to leave it installed and see what happens.

And I do have backups in case it burps and causes an issue.

[BobArch2]

OK, I have decided to uninstall the quoted KB. I made the decision after reading this.

What was not in the Bulletin Re-Release was a reference to an additional 3 KBs that should be uninstalled due to "known issues". The above link mentions all 4 KBs that MS is recommending to be uninstalled. In fact, they have removed all 4 of them from the update site.

And what is very interesting is that one of the KBs (KB2975719) is the Win8.1 Update 2 package. I also uninstalled that one.

My main reason for uninstalling, beyond the MS recommendation, is...

"Known issue 3
Microsoft is investigating behavior in which systems may crash with a 0x50 Stop error message (bugcheck) "

The tasks required to correct the situation if the crash does happen does not, IMHO, warrant leaving the KB installed.

Again, proceed as you see fit.

[PaulB]

I've also installed this update without any apparent consequences. I will leave it as is unless otherwise affected.

I received the following message from Microsoft last night... 2014.08.15 10:24PM

Just curious, Bob. How/why were you notified? Your post was the first I heard of this potential problem.

Update:

Oops, posted this before seeing your latest post. I will revisit my decision in light of this.

[BobH]

Color me confused

I went to the MS page and looked at MS 14-045. It has a different bulletin number (KB2984615 vs KB2982791). Further reading says that users who have automatic updates turned on need do nothing else. I fall into that group who uses automatic updates.

When I look at Windows Updates I see that the most recently applied update to Windows is KB2982971 with no mention of the KB2984615 update.

What am I missing here?

[BobArch2]

Just curious, Bob. How/why were you notified? Your post was the first I heard of this potential problem.

Many moons ago I signed up to get Security Bulletin notifications.

[BobArch2]

Color me confused

I went to the MS page and looked at MS 14-045. It has a different bulletin number (KB2984615 vs KB2982791). Further reading says that users who have automatic updates turned on need do nothing else. I fall into that group who uses automatic updates.

When I look at Windows Updates I see that the most recently applied update to Windows is KB2982971 with no mention of the KB2984615 update.

What am I missing here?

On that site, scroll down to Update FAQ or click here and you will see the reference to KB2982791.

On the other hand, ensure you read an update I posted a few messages back about the 4 KBs and known issues.

MS have removed the 4 KB install patches from their web site.

If you do decide to uninstall in the prescribed manner, do not be surprised when you do a final check and see that the KB is still listed in the main installed updates list.

As an added note KB2990532 is also part of the Win8.1 Update 2 package.

Confusing eh?

[PaulB]

Thanks, Bob. I don't know if I want to subscribe. Maybe I should just remain blissfully unaware.

[BobArch2]

Thanks, Bob. I don't know if I want to subscribe. Maybe I should just remain blissfully unaware.

Then fear not. I shall post any future dire warnings should they appear on my doorstep.
[And this will undertaken as a service for the next 12 months... to be revisited in a years time for a possible price increase. ]

[BobH]

Then fear not. I shall post any future dire warnings should they appear on my doorstep.[And this will undertaken as a service for the next 12 months... to be revisited in a years time for a possible price increase. ]

It would still be a bargain at TWICE the price!


OK! I went back to the FAQ page and found 4 KBs that MS recommended to remove:
KB2982791
KB2970228
KB2975719
KB2975331

I found and removed the first 2 but could not find the other 2. Perhaps I'm looking in the wrong place - Control_Panel > All_Control_Panel_Items > Programs_and_Features > Installed_Updates then scrolled down to the group of KBs for Microsoft Windows.

I found this list to be a bit difficult to scan because the update numbers are not listed sequentially. Should I look at other updates for Office, et al? Is there a more sure-fire method for searching or a better place to look?

[HansV]

You only need to uninstall the updates if you have problems when you restart your PC.

[BobH]

I had no problems with a restart, but I had uninstalled the first 2 of the KBs in my list above.

I noticed something strange a couple of days ago when I powered up my system. During the start up, I got a message about Windows Updates and it proceeded to run 45506 tasks. When it finished, the system ran as it usually does. Normally I don't power down but let the system hibernate. This was the first cold start I've run in some time; so I didn't really think much about it assuming that those tasks were waiting for a cold start to occur.

[PaulB]

BobA: Thanks for the offer. You are a prince among men!

BobH: Was that 45 THOUSAND tasks? Do you know what they were?

[HansV]

I think that was the Update to Microsoft Update client discussed in Windows 7 Update On Boot Up.

[BobArch2]

OK! I went back to the FAQ page and found 4 KBs that MS recommended to remove:
KB2982791
KB2970228
KB2975719
KB2975331

I found and removed the first 2 but could not find the other 2. Perhaps I'm looking in the wrong place - Control_Panel > All_Control_Panel_Items > Programs_and_Features > Installed_Updates then scrolled down to the group of KBs for Microsoft Windows.

I found this list to be a bit difficult to scan because the update numbers are not listed sequentially. Should I look at other updates for Office, et al? Is there a more sure-fire method for searching or a better place to look?

Initially, I found 2. Namely KB2982791 and KB2975719. Neither really caused me any concern. Until I dug deeper and read about "known issue 3" which could cause a crash. When I read the procedure to be followed in the event of a crash and the number of recovery steps needed to get back to normal, I decided that it might be easier all around to just uninstall the KB updates.

In my environment (Win8.1 Pro) I did not find any evidence of KB2970228 or KB2975331 in the "View update history" screen, which as you know, KBs are sequenced by date. I was only looking for the updates dated 2014.08.12.

I performed the monthly updates over two days. The first install on 2014.08.12 / 14 updates which showed the KB2982791 item.

I delayed the optional update KB2975719 (Win8 Update 2) until 2014.08.14. When I went looking for that update, I found that it had spawned KB2990532 which is also associated with the Win8 Update 2 package. So I uninstalled that one as well.

I did notice that Hans had said that an uninstall would only be needed if you had problems restarting your PC. And that is a fair comment. But I decided I do not like crashes nor the steps needed to get back to square one. Namely:
-------------------------------------------------------------------------------------
Mitigations
1.Restart the computer in safe mode: Windows 7

Windows 8 and Windows 8.1: a.If you have installation media for Windows 8.1 (such as a DVD or USB), start your computer by using the installation media. Insert the DVD or USB flash drive, and restart the computer. If you see a message that asks you to "Press any key to boot from DVD," do this. If you do not receive the message, you may have to change the restart order in your computer's BIOS settings so that the computer first starts to the DVD or USB. When you reach the Install Windows page, you should click Repair your computer to start the Windows Recovery Environment.
b.If you do not have media, you should use the power button to restart your computer during the startup process three times. This should start the Windows Recovery Environment.
c.As soon as your computer starts in the Windows Recovery Environment, tap or click Troubleshoot on the Choose an option screen. If you do not see the Startup Settings option, tap or click Advanced options.
d.Tap or click Startup Settings., and then tap or click Restart.
e.On the Startup Settings screen, select the startup setting that you want. (Press 4 for safe mode.)
f.Sign in to your computer by using a user account that has administrator rights.

2.Delete the fntcache.dat file. To do this, type the following command at command prompt

, and then press Enter:

del %windir%\system32\fntcache.dat

3.After you delete fntcache.dat, restart the computer. The computer should now start successfully.
4.Click Start, click Run, type regedit in the Open box, and then click OK.
5.Locate and then click the following subkey in the registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Fonts\

6.Right-click the Fonts registry subkey, and then click Export.
7.Type a name for the exported reg file, and select a location to store the file. You will use this file later to restore the font registration that you will remove in the following steps.
8.After you save the reg file, find any registry values under the Fonts registry subkey for which the data field meets the following criteria: Contains a full file path (not just a file name)
The full file path ends in an ".otf" extension. (This indicates an OpenType font file.)

Expand this image
OpenType font file

9. Delete the fntcache.dat file again. (It will have been re-created.) To do this, type the following command at command prompt, and then press Enter:

del %windir%\system32\fntcache.dat

10.Open the Programs and Features item in Control Panel, and then click View installed updates. Find and then uninstall any of the following update that are currently installed: KB2982791
KB2970228
KB2975719
KB2975331

11.Restart the computer.
12.Find the reg file that you saved earlier, right-click the file, and then click Merge to restore the font registry values that you previously removed.

Note It’s safe to re-add these registry values now that the offending updates have been removed.
-----------------------------------------------------------------------------------------------------------------
Anyhow, as I stated previously "Proceed as you see fit"

[Claude]

Thanks Bob. I've added a link in the Securities and Backup forum to this post.

[BobArch2]

Microsoft has released an update to the problems of August 12th monthly updates.

Refer to this for further information.

I would also highly recommended reading the Update FAQ that is reflected in the above link.

[HansV]

Thanks!

[RonH]

Cheers Bob.
I have removed the faulty KB and installed the Update ... all seems OK.
Interestingly, there is no information with the Update from Microsoft about removing KB2982791 and it is clearly not part of the update automatic action. Can't be that important given the millions who do not 'investigate' but just 'do'.
Ron