Tech: Microsoft system 3.0 problems

Subject: Tech: Microsoft system 3.0 problems
From: Barbara Shaw
Date: 09 Jul 08 - 10:43 AM

I'm having problems accessing the internet after the latest Microsoft system update (for Windows XP) today. By doing a system restore to a previous day, all works fine, but I cannot access the server with this update. Any ideas?

Subject: RE: Tech: Microsoft system 3.0 problems
From: JohnInKansas
Date: 09 Jul 08 - 02:39 PM

I haven't seen any reports of your kind of problems with WinXP SP3, but there are some things that rumors say probably are in the update that could cause something(s) like what you describe.

Microsoft claims to provide free support for problems with security patches. The problem is that there is no way to contact them without giving them a credit card number (a required entry to get into the direct support connection) and they decide after you've given them your bank account and posted your question there whether it's free. In the very few instances when I've been desperate enough to log in for direct support, "arguing vigorously" has avoided paying them my money, but in at least one instance resulted in a refusal to provide support for what was (IMO) a critical problem.

Your internet service provider (ISP) may be able to help. Depending on who provides your connection, they may have advice on their website. Some, but not all, ISPs actually provide support phone numbers. Settings may have failed to migrate correctly or were "upset" by the SP3 installation, and just need to be reset; but you may need ISP support to get the correct settings for your service. There is a remote possibility that the settings needed might be different with SP3, but I've seen no reports of this happening.

A fairly recent Microsoft Knowledge Base article may be of some help, and gives the "official" how-to-get-support tale:

Information about Windows XP Service Pack 3 (article 936929).

More to follow for general info (if I don't doze off), although I can't really offer anything specific to your problem.

John

Subject: RE: Tech: Microsoft system 3.0 problems
From: 8_Pints
Date: 09 Jul 08 - 02:54 PM

There have been reports that the latest Microsoft Updates have caused a clash with Zone Alarm firewall. A work around has been suggested where the Internet security is downgraded to medium and then Internet access should be possible.

Bob

Subject: RE: Tech: Microsoft system 3.0 problems
From: JohnInKansas
Date: 09 Jul 08 - 03:03 PM

The MAJOR problems that have been reported for WinXP SP3 have been:

1. An early release caused a failure to open Windows and put the computer into a constant/perpetual reboot cycle. This happened only with computers using AMD processors from only some OEM computer builders. The update website was "fixed" to detect computers with the problem CPUs and block download of SP3 to anyone affected. A real fix, to allow SP3 installation on those computers was promised; but I haven't seen a notice that it's in place.

2. Some antivirus programs allowed the SP3 installation to create temporary registry entries but blocked the cleanup deletion of the temporary entries. This resulted in "major bloat" (many thousand useless entries) in the Registry and crippled the machines. Microsoft blames the AV makers, but it appears that Microsoft presented the required "security certificate" when it opened the Registry to create the temps, but failed/forgot to show a valid cert when it re-opened the Registry (after reboot?) for the cleanup.

Invisible (mostly unreported changes) include:

SP3 includes updates to IE. If you have IE7 installed (or have the beta IE8 installed) when you run SP3 installation, you cannot uninstall IE7 after SP3 is installed. In Windows generally, you can uninstall an update to IE, but once you get back to the version that was originally part of Windows at your original Windows installation, the "first version" cannot be removed. SP3 makes IE7 the "first version" for computers that have it in place when SP3 is installed.

Since all Windows versions include IE, all IE separate installation downloads or disks are "updates." Running an IE6 installation disk/download can't "downdate" back to a version earlier than the one on the machine, and if IE7 is the "first version" (after SP3) there is no known way to revert back to an earlier version short of a complete reinstall of Windows from original installation disks.

If you have to reinstall from original disks that are not SP1 or SP2 versions, you'll have to reinstall from original disks, then download and install either of these before SP3 can be installed. SP2 includes all prior patches, so it would be preferred, but it can be an 800+ MB download. Even if you don't install SP3, critical patches since SP2 will be several hundred MB of download and install.

One Microsoft website implies that WinXP SP2 will not be supported after April 2009, which could mean that the SP2 download will not be available if you have to reinstall XP from disks that don't include SP2.

If your original WinXP installation/recovery disks don't include SP2, I would strongly urge that you download the SP2 update program and burn it to a CD. Put the CD with your original disk(s) so you'll have it if disaster strikes. Making the CD of the SP2 download "bootable" is recommended (for IT administrators) by Microsoft, but as long as you have an original OS installation disk that is bootable you can run the SP2 installation manually, so suit yourself about whether to make it run itself.

John

Subject: RE: Tech: Microsoft system 3.0 problems
From: The Fooles Troupe
Date: 09 Jul 08 - 07:47 PM

JiK

I seem to remember that very early IE versions (2,3, oe so) ran as standalone programs, and didn't "eat" the OS - you were able run them individually if you kept the exe files, and could check how pages looked under them.

Of course MS killed that idea, and that was when I started to 'lose the MS religion' ... :-)

Subject: RE: Tech: Microsoft system 3.0 problems
From: JohnInKansas
Date: 09 Jul 08 - 08:47 PM

Foolestroupe -

IE may have appeared in Windows 2.0 or about then as a separable program, but since Windows 3.11WG at least, IE and Windows Explorer were merged, and the "first version IE" in the original Windows installation could NOT BE REMOVED.

Internet Connection Sharing (ICS) became (sort of) workable with Win 3.11WG, but didn't get really useful until Win95. A problem that came up was that ICS installed on more than one "host" in a Workgroup crashed the entire workgroup.

Turning on ICS made changes to IE and Windows Explorer that could not be reset by "turning off ICS," in both Win 3.11WG and Win95, so it was necessary to manually delete a rather large group of files modified by ICS, then do a "repair reinstall" of Windows to restore IE so that Win Explorer would work without totalling the OS.

I had a Workgroup setup under Win 3.11, and since the "problem" was unknown when I got a Win95 machine and tried to make Win95 the "host" machine, I found it quite early. It was about a year before the "fix" procedure was published, and I had to run it on Win 3.11WG because IE could not be removed (or repaired) by any other method.

Later patches let Win98 or Win98SE turn ICS on/off without manually patching IE/Explorer, but I don't know when they appeared. It was some time after the first Win98 releases.

IE and (Windows) Explorer were/are the same program, and NOT UNINSTALLABLE past the original version that came with your OS, at least since "Workgroups" first appeared.

You can, and always could, add another browser, but the one that was part of the original OS had to remain in place. Since IE is "mozilla based" it might have been released as a standalone for other operating systems. It's not the addition of "another browser" that's the problem. It's that the IE that's "locked into" the Windows OS can't be removed.

John

Subject: RE: Tech: Microsoft system 3.0 problems
From: Barbara Shaw
Date: 10 Jul 08 - 05:15 PM

Here I am back after the fight with my desktop and laptop. After trying various things, it turns out that Zone Alarm was the culprit. Somehow, the Microsoft update moved my ZA internet security up to HIGH, rather than the MED where I had set it. Somehow it did NOT do this on my laptop! Go figure...

In the middle of all this bedlam, there was a large scale DSL outage in my area involving fiber or some dang thing - which helped to confuse the issue considerably.

Anyway, thanks for the help. 8 Pints was exactly right.

Subject: RE: Tech: Microsoft system 3.0 problems
From: JohnInKansas
Date: 10 Jul 08 - 10:58 PM

It may well be that others will be seeing new things in the next few days.

A publicity release from Microsoft a few days ago said that SP3 will begin automatic downloads and installation to all WinXP users signed up for Automatic Updates. The downloads were to begin with Australia, 10 July 2008.

SP3 previously was an "optional" installation. This will make it automatic for everyone.

For IT Administrators who don't want it installed automatically, there is a download of an "SP3 blocker" that can be used to delay installation; but Microsoft says that it will only work until ???? (current cutoff for the blocker is April 2009, but that could change).

The other option is to turn of automatic installation of updates and then check each of them before installing; but downloads often are identified only by changeable security bulletin or KB article numbers so it would be easy to miss what one is and install accidentally anyway.

It probably will be best for most people to let it install, and respond appropriately if there's a problem. Checking to be sure that System Restore is turned on - pending successfule update at least - probably would be a good thing to do.

John

Subject: RE: Tech: Microsoft system 3.0 problems
From: olddude
Date: 10 Jul 08 - 11:23 PM

Are you using the security product ZoneAlarm. If you are disable it and try. If it works then use something like Mcafee. With the new patch zone alarm block the connection. My service provider and I just went through it. I had to remove zone alarm from my PC due to the patch

Subject: RE: Tech: Microsoft system 3.0 problems
From: Malcolm Douglas
Date: 11 Jul 08 - 01:47 AM

That shouldn't be necessary. Read '8 Pints' and Barbara's posts. Reducing the security level to medium also worked for me, though had Microsoft not screwed up again, no action would have been needed. I should steer clear of Mcafee if I were you.

The latest XP update (SP3 itself gave me no problems that I noticed) is also disabling my Wacom tablet drivers every time I boot up, but they can be turned back on again easily enough. Again, though, a properly written patch would have been checked for things like that.

Subject: RE: Tech: Microsoft system 3.0 problems
From: Newport Boy
Date: 11 Jul 08 - 05:30 AM

If you want to continue with Zone Alarm, there's a new release on the Check Point website. The Pro version sorted almost all my problems, although WinXP Security Center now doesn't think Zone Alarm is running. This is no big deal - I know it's running!

Phil

Subject: RE: Tech: Microsoft system 3.0 problems
From: Barbara Shaw
Date: 11 Jul 08 - 07:10 AM

One more thing about automatic updates: I have the Microsoft updates download automatically but it asks if I want to apply the updates. When I turn off the computer, there's a link to turn off without installing any pending updates. During this latest trouble, I had done a system restore and kept turning off without updating. Then, somehow it went ahead and updated anyway, without my permission.

Subject: RE: Tech: Microsoft system 3.0 problems
From: Andrez
Date: 11 Jul 08 - 08:59 AM

Being wary of anything remotely looking like a gift from Microsoft, I never run automatic updates. I only do manual updates and look closely at what I am being offered before downloading. I decline the offer of anything I don't understand or don't see as necessary to improve my "user experience". If I cant research the anomalous item I leave it be and look at the forums to see what the "early adopters" are reporting.

I would really recommend not allowing Microsoft to just install updates when it "feels" like doing so. This would forestall experiencing issues like the continuous reboot cycle cited by JIK and other SP3 issues reported by other users. There is just something that just gets up my nose about Microsoft not giving me a choice about what software gets installed on my computer and when! While I'm on that theme, I wont even begin to talk about Office 2007 or Vista.

In this vein of caution, today I just bought a RAID disk array to back up my entire XP installation, before running the SP3 update. I run Trend Micro security and will use Acronis True- Image to do the back up before running the SP3 update. I can think of better things to do like playing my 1928 Vega banjo as opposed to spending inordinate amounts of time trying to troubleshoot yet another problematic Microsoft installation let alone doing another reintall!

Curiously enough, I have noticed that accessing the Windows update server has been intermittently flaky of late even before doing SP3. The symptoms have been IE trying to logon, getting the options for Express or Custom updates and then the browser hanging with the usual animation not running and the word "Done" in the bottom left hand corner of the browser. Restarting the browser sometimes helped but more usually a complete reboot and then going straight to the update site before running anything else after startup seems to get me in. I was hoping SP3 might fix that small annoyance.

The moral of the story is don't be an early adopter of any thing Microsoft and dont give them a blank check to install any kind of shite on your systems.

Cheers,

Andrez

Subject: RE: Tech: Microsoft system 3.0 problems
From: oggie
Date: 11 Jul 08 - 01:26 PM

It seems that ZoneAlarm may be to blame for having used non-standard functions in their software. For once it isn't really Windows's fault. SP3 closes a loophole which the hackers hadn't found but ZoneAlarm decided to exploit.

Steve

Subject: RE: Tech: Microsoft system 3.0 problems
From: JohnInKansas
Date: 11 Jul 08 - 06:11 PM

I decline the offer of anything I don't understand or don't see as necessary to improve my "user experience".

While this would be an excellent claim to include in your application to participate on the "Dick Cheney Science Advisors" committe (but omit everything after the first "or" if applying to be an evangelical creationist) it seems questionable with respect to Microsoft Automatic Updates.

Automatic Update will automatically install only Critical Updates. To be a Critical Update both Microsoft and essentially the entire community of anti-malware professionals must agree that a vulnerability has been confirmed, that it is known - or likely very soon to be known - to malware distributors, and that a significant population of users are at risk if the vulnerability is not removed.

When/if you decline to install a Critical Update except for specifically known and confirmed reasons that apply to your unique hardware/software environment, you are asserting that you are smarter than the entire community of anti-malware professionals.

When you decline to install a Critical Update, you also are making the more dangerous assertion that you are "too smart" to be affected by anyone with malicious intent who might attempt to exploit that vulnerability. There is some contention that "anyone" may include at least a couple of National Government Agencies/Agents, not all of whom are as ignorant of computers as "official agencies" in the US.

While that certainly may be true in your individual case, it's unlikely to be the case for the majority of people who assert (without authenticating) your same credentials; and advocating this as a policy that most others should follow probably overestimates their ability to be as smart as you are.

Most of those other users won't know how to check for White Papers at Microsoft and at reputable Anti-Malware distributors (like you do), won't know how to check with the Microsoft Tech Net (like you do) for details, or won't bother to do so. They' just look at some random blog where some SPGWK will babble about the evils of Microsoft.

When you opt for Custom Install, you will also see "Optional Updates." There will be many of these that will not be useful to the majority of users, and most people don't need to be as smart as you to know which ones are not necessary. "Reasonable user competence" may be required to make all of the optimal choices there, but there should be none that will make a critical difference. NONE OF the Optional Updates will be installed by Automatic Update or by Express Install, so if these are what you're declining you might as well just turn on Autmatic Update in Automatic Install mode.

John

Subject: RE: Tech: Microsoft system 3.0 problems
From: Barbara Shaw
Date: 11 Jul 08 - 07:19 PM

Just got this from Zone Alarm:

Workaround to Sudden Loss of Internet Access Problem

Date Published : 8 July 2008

Date Last Revised : 9 July 2008

Overview : Microsoft Update KB951748 is known to cause loss of internet access for ZoneAlarm users on Windows XP/2000. Windows Vista users are not affected.

Impact : Sudden loss of internet access

Platforms Affected : ZoneAlarm Free, ZoneAlarm Pro, ZoneAlarm AntiVirus, ZoneAlarm Anti-Spyware, and ZoneAlarm Security Suite

Recommended Actions -

Download and install the latest versions which solve the loss of internet access problem here (English only):

ZoneAlarm Internet Security Suite
ZoneAlarm Pro
ZoneAlarm Antivirus
ZoneAlarm Anti-Spyware
ZoneAlarm Basic Firewall
- or follow the directions below.

Option 1: Move Internet Zone slider to Medium

Navigate to the "ZoneAlarm Firewall" panel
Click on the "Firewall" tab
Move the "Internet Zone" slider to medium
Option 2: Uninstall the hotfix

Click the "Start Menu"
Click "Control Panel", or click "Settings" then "Control Panel"
Click on "Add or Remove Programs"
On the top of the add/remove programs dialog box, you should see a checkbox that says "show updates". Select this checkbox
Scroll down until you see "Security update for Windows (KB951748)"
Click "Remove" to uninstall the hotfix