KB891711 trouble seems to be graphic issue

On the one hand, I am reluctant to start a new thread, with so many already
scattered about. On the other hand, I have something concrete that I
discovered, and it seems to warrant a new thread.

As a background, I found that the "Kb891711.exe" patch caused problems on
one of my computers. Poking around the groups I found a scattered list of
possible causes. Broswers. AV programs. Software firewalls. Processors. In
every case, somebody had a counter example to the claim.

My solution to avoid the crashes was to stop the process with the Close
Programs list; the computer running Windows ME. Then use Add/Remove Programs
from the Control Panel to remove it from the system. This deletes four
registry keys, and two system files; leaving only the folder to which the
system files were written. So there is no need to take super drastic steps;
like System Restore rollback, or Format & Reinstall. Worst case is that you
would have to boot in Safe Mode, I should think.

However, I was curious. Because of the counter examples, I decided to
install the patch on a second, identical computer. Both computers are HP
Pavilion 6745Cs. Intel Celeron 700MHz processors. Intel 82810 graphics chip
set. Windows ME. Kb891711 crashes one computer ("Megumi"), but not the other
computer ("Naomi"). Differences? A few programs in startup; but none on
Megumi that are definitively problematic on every computer with crashes; I
can find a counter example for each program on Megumi, which doesn't cause
crashes on some other computer.

When I checked the driver versions, I notice that I hadn't updated the
graphics drivers on Naomi. As things stood, I had the following:

Megumi:
-------

Intel Celeron 700MHZ processor
Intel 82810 graphics chip set (driver version: 4.13.01.3196)
Windows ME

Naomi:
------

Intel Celeron 700MHZ processor
Intel 82810 graphics chip set (driver version: 4.13.01.3004)
Windows ME

Kb891711 causes all browsers to blue screen on Megumi, but causes no
problems on Naomi.

So I just rolled back the driver update on Megumi; it is now, like Naomi, on
Intel driver version 4.13.01.3004. I just reinstalled the Kb891711 "patch".
Tested launch on all browsers which crashed Megumi before. MSIE6 SP1,
Firefox 1.0.1, Mozilla 1.7.5, Netscape 7.2. No crashes.

It looks, to me, like a graphics driver issue. I don't know if the onus
should be on Intel to provide an updated graphics driver for the 82810
graphics chip set, but I suspect not. Kb891711 is a "kludge", not a "patch".
It does not patch system files, it runs resident from the RunServices key.
The vulnerability that it "fixes" is still present. In my opinion, this
"kludge" needs to be fixed with a true patch; one that won't break the OS
when current graphics drivers are installed.

Now to review the MSFT write up on the vulnerability. It may be that I don't
need to run kb891711.exe; if my default browser, Firefox 1.0.1, isn't
vulnerable, I will just restore things. On Megumi, anyway.

--
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint

Looks good to me Norman. I did ask you elsewhere whether the bios version
was the same for both systems (shades of the Prescott XP SP2 debacle last
year) but it would appear that your findings have dispensed with that as
being a possible reason for the problem.
--
http://www.microsoft.com/windowsxp/e...ts/nichol.mspx
In memory of a very dear friend, Windows MVP Alex Nichol

Mike Maltby MS-MVP



N. Miller <> wrote:

> On the one hand, I am reluctant to start a new thread, with so many
> already scattered about. On the other hand, I have something concrete
> that I discovered, and it seems to warrant a new thread.
>
> As a background, I found that the "Kb891711.exe" patch caused
> problems on one of my computers. Poking around the groups I found a
> scattered list of possible causes. Broswers. AV programs. Software
> firewalls. Processors. In every case, somebody had a counter example
> to the claim.
>
> My solution to avoid the crashes was to stop the process with the
> Close Programs list; the computer running Windows ME. Then use
> Add/Remove Programs from the Control Panel to remove it from the
> system. This deletes four registry keys, and two system files;
> leaving only the folder to which the system files were written. So
> there is no need to take super drastic steps; like System Restore
> rollback, or Format & Reinstall. Worst case is that you would have to
> boot in Safe Mode, I should think.
>
> However, I was curious. Because of the counter examples, I decided to
> install the patch on a second, identical computer. Both computers are
> HP Pavilion 6745Cs. Intel Celeron 700MHz processors. Intel 82810
> graphics chip set. Windows ME. Kb891711 crashes one computer
> ("Megumi"), but not the other computer ("Naomi"). Differences? A few
> programs in startup; but none on Megumi that are definitively
> problematic on every computer with crashes; I can find a counter
> example for each program on Megumi, which doesn't cause crashes on
> some other computer.
>
> When I checked the driver versions, I notice that I hadn't updated the
> graphics drivers on Naomi. As things stood, I had the following:
>
> Megumi:
> -------
>
> Intel Celeron 700MHZ processor
> Intel 82810 graphics chip set (driver version: 4.13.01.3196)
> Windows ME
>
> Naomi:
> ------
>
> Intel Celeron 700MHZ processor
> Intel 82810 graphics chip set (driver version: 4.13.01.3004)
> Windows ME
>
> Kb891711 causes all browsers to blue screen on Megumi, but causes no
> problems on Naomi.
>
> So I just rolled back the driver update on Megumi; it is now, like
> Naomi, on Intel driver version 4.13.01.3004. I just reinstalled the
> Kb891711 "patch". Tested launch on all browsers which crashed Megumi
> before. MSIE6 SP1, Firefox 1.0.1, Mozilla 1.7.5, Netscape 7.2. No
> crashes.
>
> It looks, to me, like a graphics driver issue. I don't know if the
> onus should be on Intel to provide an updated graphics driver for the
> 82810 graphics chip set, but I suspect not. Kb891711 is a "kludge",
> not a "patch". It does not patch system files, it runs resident from
> the RunServices key. The vulnerability that it "fixes" is still
> present. In my opinion, this "kludge" needs to be fixed with a true
> patch; one that won't break the OS when current graphics drivers are
> installed.
>
> Now to review the MSFT write up on the vulnerability. It may be that
> I don't need to run kb891711.exe; if my default browser, Firefox
> 1.0.1, isn't vulnerable, I will just restore things. On Megumi,
> anyway.

In article <>, Mike M says...

> Looks good to me Norman. I did ask you elsewhere whether the bios version
> was the same for both systems (shades of the Prescott XP SP2 debacle last
> year) but it would appear that your findings have dispensed with that as
> being a possible reason for the problem.

Unfortunately, I made a fundamental error, and I am back to square one. I
forgot to check the Close Program list after rolling back the graphics
driver version, and I didn't reboot the system after reinstalling the
"patch". Once I discovered that error, I retested. It turns out that Intel
graphics driver version 4.13.01.3004 didn't cure the problem on Megumi.
Worse, installing Intel graphics driver 4.13.01.3196 on Naomi didn't break
anything. As it stands, whichever Intel graphics driver is installed, Naomi
works and Megumi doesn't.

MSFT System Information reports the same BIOS version on both computers.
Executing a restart, and using the <F1> on boot reveals this about the BIOS
(identical for both computers):

Core version: 4.06
BIOS Revision: 2.02 7/14/00

So, I have two nearly identical HP Pavilion 6745Cs. Currently equipped so:

Processor: Intel Celeron 700MHz
Graphics: Intel 82821 chip set; driver revision: 4.13.01.3196
BIOS revision: 2.02 7/14/00
Memory: 192 MBytes RAM
OS: Windows 4.90.3000 (Millennium Edition)

While I was rolled back to 4.13.01.3004 on the broken computer, and with
Blue Screens on trying to launch MSIE6; SP1, I used 'msconfig' to divide the
startup group. It comes down to this:

All items checked to start, except Mercury Mail MTA 4.01b, and MSIE
launches. Only Mercury Mail MTA 4.01b and Kb891711 checked to start, and
MSIE fails to launch, generating a blue screen error.

Advancing the graphics driver back to 4.13.01.3196, and nothing changes. If
I let the computer start with Mercury Mail running, then kill the process,
launching the browser still causes a blue screen. Odds are that not
everybody having this problem is running Mercury Mail, nor that everybody
running Mercury Mail is having this problem.

I have spent more time than I should have testing this configuration. I have
paid for more MS operating systems than I ever had up and running at any one
time; but you can bet that MSFT won't pay me for this time. MSFT insists
that I have to use their Product Aggravation in order to install Windows XP.
MSFT won't support Windows ME any longer. MSFT has just put me through
several reboots, and having to reconfigure my display after the fact. And
the evil patch, "kb891711" is still broken. I give up. The patch remains off
of Megumi; and my next computer will be running anything but MSFT software
on it.

--
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint

Excellent sleuthing, Norman. Congrats.

I suppose we well have to await the results of the MS gnome's exploration of
the different video driver interactions to learn more. This confirms that
users should be reporting the video adapter and driver for problematic
machines.

Please have Belarc and Everest reports for the two machines ready should MS
contact you directly.
Confirm that the m/b and video BIOS versions are identical.
--
Jack E. Martinelli 2002-05 MS MVP for Shell/User / DTS
Help us help you: http://www.dts-L.org/goodpost.htm

http://www.microsoft.com/athome/secu...t/default.aspx
In Memorium: Alex Nichol
http://www.microsoft.com/windowsxp/e...ts/nichol.mspx
Your cooperation is very appreciated.
------
"N. Miller" <> wrote in message
news: om...
> On the one hand, I am reluctant to start a new thread, with so many
already
> scattered about. On the other hand, I have something concrete that I
> discovered, and it seems to warrant a new thread.
>
> As a background, I found that the "Kb891711.exe" patch caused problems on
> one of my computers. Poking around the groups I found a scattered list of
> possible causes. Broswers. AV programs. Software firewalls. Processors. In
> every case, somebody had a counter example to the claim.
>
> My solution to avoid the crashes was to stop the process with the Close
> Programs list; the computer running Windows ME. Then use Add/Remove
Programs
> from the Control Panel to remove it from the system. This deletes four
> registry keys, and two system files; leaving only the folder to which the
> system files were written. So there is no need to take super drastic
steps;
> like System Restore rollback, or Format & Reinstall. Worst case is that
you
> would have to boot in Safe Mode, I should think.
>
> However, I was curious. Because of the counter examples, I decided to
> install the patch on a second, identical computer. Both computers are HP
> Pavilion 6745Cs. Intel Celeron 700MHz processors. Intel 82810 graphics
chip
> set. Windows ME. Kb891711 crashes one computer ("Megumi"), but not the
other
> computer ("Naomi"). Differences? A few programs in startup; but none on
> Megumi that are definitively problematic on every computer with crashes; I
> can find a counter example for each program on Megumi, which doesn't cause
> crashes on some other computer.
>
> When I checked the driver versions, I notice that I hadn't updated the
> graphics drivers on Naomi. As things stood, I had the following:
>
> Megumi:
> -------
>
> Intel Celeron 700MHZ processor
> Intel 82810 graphics chip set (driver version: 4.13.01.3196)
> Windows ME
>
> Naomi:
> ------
>
> Intel Celeron 700MHZ processor
> Intel 82810 graphics chip set (driver version: 4.13.01.3004)
> Windows ME
>
> Kb891711 causes all browsers to blue screen on Megumi, but causes no
> problems on Naomi.
>
> So I just rolled back the driver update on Megumi; it is now, like Naomi,
on
> Intel driver version 4.13.01.3004. I just reinstalled the Kb891711
"patch".
> Tested launch on all browsers which crashed Megumi before. MSIE6 SP1,
> Firefox 1.0.1, Mozilla 1.7.5, Netscape 7.2. No crashes.
>
> It looks, to me, like a graphics driver issue. I don't know if the onus
> should be on Intel to provide an updated graphics driver for the 82810
> graphics chip set, but I suspect not. Kb891711 is a "kludge", not a
"patch".
> It does not patch system files, it runs resident from the RunServices key.
> The vulnerability that it "fixes" is still present. In my opinion, this
> "kludge" needs to be fixed with a true patch; one that won't break the OS
> when current graphics drivers are installed.
>
> Now to review the MSFT write up on the vulnerability. It may be that I
don't
> need to run kb891711.exe; if my default browser, Firefox 1.0.1, isn't
> vulnerable, I will just restore things. On Megumi, anyway.
>
> --
> Norman
> ~Win dain a lotica, En vai tu ri, Si lo ta
> ~Fin dein a loluca, En dragu a sei lain
> ~Vi fa-ru les shutai am, En riga-lint

In article <>, Jack E Martinelli says...

> Excellent sleuthing, Norman. Congrats.

> I suppose we well have to await the results of the MS gnome's exploration of
> the different video driver interactions to learn more. This confirms that
> users should be reporting the video adapter and driver for problematic
> machines.

Alas, I failed to check one simple step before that write up; I had not
rebooted the silly system after reinstalling the "patch". Consequently,
Kb89171 wasn't running when I ran my initial tests. I didn't catch the error
until after posting, and once I did get the "patch" properly loaded and
running, I was back to blues screens on launching the browsers.

At this time, I have two computers with identical software builds, BIOS
versions, and hardware, including video; one which will blue screen on
launching browsers, and one which won't.

> Please have Belarc and Everest reports for the two machines ready should MS
> contact you directly.
> Confirm that the m/b and video BIOS versions are identical.

I have know idea what those reports are. I am not a paid MSFT employee, or
any kind of MSFT beta tester. Just an ordinary user on the street; a tad
frustrated that I am doing this work at all. Shouldn't us ordinary users
just have software that works? We (well, at least I!) have paid for the
software.

--
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint

Very interesting, all.

This is the problem I am currently having after downloading that same WinME
security update last Friday (3/11). I kept getting blue screen (Windows)
error messages (crashes requiring restarts) while online, then even before
getting online! I uninstalled it today, then ran "msconfig" and unselected
"StartUp Group" items (in Selective Startup), restarted my PC, and did some
puter maint (Disk cleanup, ScanDisk, and Disk Defrag). Then I went into
msconfig again and re-selected startup group items in Selective Startup again
(I always run my pc on selective startup--too many hookups when I use
"Normal" startup), and restarted my PC again.

So far, no blue screens! Tho, I did go to Windows Update and tried to
re-download the security patch, but can't because--even after uninstalling
it--the scan ignores my uninstall and the Update History page still shows a
successful download of that patch! Ack! So annoying. But, then again, if
the patch is so damaging to WinME, do I really NEED it? I have, and run,
Norton Internet Security 2004 with Live Update--plus I update DAILY!

The patch isn't as such damaging to Win Me but rather causes major
problems such as you are seeing for certain video card/video driver
combinations.

A couple of questions if I may. What video card/chip does your PC have
and what driver version do you have installed. You will find this
information at System Properties | Device Manager. Also what is the make,
model and speed of your processor, that is AMD or Intel, etc.

Regards,
--
http://www.microsoft.com/windowsxp/e...ts/nichol.mspx
In memory of a very dear friend, Windows MVP Alex Nichol

Mike Maltby MS-MVP



CataBird62 <> wrote:

> Very interesting, all.
>
> This is the problem I am currently having after downloading that same
> WinME security update last Friday (3/11). I kept getting blue screen
> (Windows) error messages (crashes requiring restarts) while online,
> then even before getting online! I uninstalled it today, then ran
> "msconfig" and unselected "StartUp Group" items (in Selective
> Startup), restarted my PC, and did some puter maint (Disk cleanup,
> ScanDisk, and Disk Defrag). Then I went into msconfig again and
> re-selected startup group items in Selective Startup again (I always
> run my pc on selective startup--too many hookups when I use "Normal"
> startup), and restarted my PC again.
>
> So far, no blue screens! Tho, I did go to Windows Update and tried to
> re-download the security patch, but can't because--even after
> uninstalling it--the scan ignores my uninstall and the Update History
> page still shows a successful download of that patch! Ack! So
> annoying. But, then again, if the patch is so damaging to WinME, do
> I really NEED it? I have, and run, Norton Internet Security 2004
> with Live Update--plus I update DAILY!

In article <556AB32E-C158-4641-90EA->, =?Utf-8?B?
Q2F0YUJpcmQ2Mg==?= says...

> So far, no blue screens! Tho, I did go to Windows Update and tried to
> re-download the security patch, but can't because--even after uninstalling
> it--the scan ignores my uninstall and the Update History page still shows a
> successful download of that patch! Ack! So annoying. But, then again, if
> the patch is so damaging to WinME, do I really NEED it? I have, and run,
> Norton Internet Security 2004 with Live Update--plus I update DAILY!

If you didn't get the program files out of the folder they installed to,
Windows Update will find them, and declare your system to be current. For
Windows Me, C:\WINDOWS\SYTEM\KB891711; you will find two files there:
Q891711.EXE and Q891711.DLL. The installation also creates four registry
keys; all of which have "891711" in them.

--
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint

"N. Miller" <> wrote in message
news: om...
> In article <556AB32E-C158-4641-90EA->,
> =?Utf-8?B?
> Q2F0YUJpcmQ2Mg==?= says...
>
> If you didn't get the program files out of the folder they installed to,
> Windows Update will find them, and declare your system to be current. For
> Windows Me, C:\WINDOWS\SYTEM\KB891711; you will find two files there:
> Q891711.EXE and Q891711.DLL. The installation also creates four registry
> keys; all of which have "891711" in them.
>
So what is the method to cleaning up the bad update so that future fixed
updates will download and install?

Sarah

Norman, have you tested whether just renaming the two file's extensions, to
file_name.old, for example will permit Windows Update to reoffer the
"patch"?

--
Jack E. Martinelli 2002-05 MS MVP for Shell/User / DTS
Help us help you: http://www.dts-L.org/goodpost.htm

http://www.microsoft.com/athome/secu...t/default.aspx
In Memorium: Alex Nichol
http://www.microsoft.com/windowsxp/e...ts/nichol.mspx
Your cooperation is very appreciated.
------
"N. Miller" <> wrote in message
news: om...
> In article <556AB32E-C158-4641-90EA->,
=?Utf-8?B?
> Q2F0YUJpcmQ2Mg==?= says...
>
> > So far, no blue screens! Tho, I did go to Windows Update and tried to
> > re-download the security patch, but can't because--even after
uninstalling
> > it--the scan ignores my uninstall and the Update History page still
shows a
> > successful download of that patch! Ack! So annoying. But, then again,
if
> > the patch is so damaging to WinME, do I really NEED it? I have, and
run,
> > Norton Internet Security 2004 with Live Update--plus I update DAILY!
>
> If you didn't get the program files out of the folder they installed to,
> Windows Update will find them, and declare your system to be current. For
> Windows Me, C:\WINDOWS\SYTEM\KB891711; you will find two files there:
> Q891711.EXE and Q891711.DLL. The installation also creates four registry
> keys; all of which have "891711" in them.
>
> --
> Norman
> ~Win dain a lotica, En vai tu ri, Si lo ta
> ~Fin dein a loluca, En dragu a sei lain
> ~Vi fa-ru les shutai am, En riga-lint