Re: After 8-12-09 autoupdates, getting C000021a fatal error

<QP>
0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED
This occurs when Windows switches into kernel mode and a user-mode
subsystem, such as Winlogon or the Client Server Runtime Subsystem (CSRSS),
is compromised. Security can no longer be guaranteed. Because Win XP can’t
run without Winlogon or CSRSS, this is one of the few situations where the
failure of a user-mode service can cause the system to stop responding. This
Stop message also can occur as a result of malware infestation or when the
computer is restarted after a system administrator has modified permissions
so that the SYSTEM account no longer has adequate permissions to access
system files and folders.
</QP>
Source: http://aumha.org/a/stop.htm

Tip: Take the above reference to "malware infestation" seriously! Chances
are that none of the updates caused this. More likely possibility: The
Malcious Software Removal Tool found and deleted one or more infections but
couldn't detect and remove all of the infections.

What anti-virus application or security suite is installed and is your
subscription current? What anti-spyware applications (other than Defender)?
What third-party firewall (if any)?

Has a(another) Norton or McAfee application ever been installed on this
machine (e.g., a free-trial version that came preinstalled when you bought
it)?
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002
www.banthecheck.com


Paul Christiansen wrote:
> XP Home, SP3 with all updates. After 8-12-09 autoupdating ran, on reboot,
> going to a blue screen with a c00021a fatal error. Other error code is
> 0xc0000142.
>
> How do I get out of this and back out the updates, one of which obviously
> clobbered the registry in some way?

Are you referring to ZoneAlarm Intenet Security Suite (ZAISS)?

What anti-virus application was installed before you installed the ZA app
and was your subscription still current when you installed the ZA app?

FWIW, you could always...

Start a free Windows Update support incident request:
https://support.microsoft.com/oas/de...spx?gprid=6527

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.

For more information about how to contact your local Microsoft subsidiary
for security update support issues, visit the International Support Web
site: http://support.microsoft.com/common/international.aspx

For enterprise customers, support for security updates is available through
your usual support contacts.


Paul Christiansen wrote:
> I run Zone Alarm, the subscription is current, the machine updates its
> signature files daily and the machine is scanned once a week. The
> firewall
> security is set to High.
>
> I have never had Norton or any other firewall or anti-virus/worm software
> on
> the machine. It was not displaying any signs of an infection (not that
> that
> proves mutch).
>
> I have never changed any systems permissions on the machine.
>
> I would do a repair install, but the Recovery Console doesn't seem to be
> able to find the windows installation already there. it wants to put a
> totally fresh copy of XP on the machine.
>
> So, anybody got any ideas other than a reformat of the partition and start
> over (ouch).
>
>> <QP>
>> 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED
>> This occurs when Windows switches into kernel mode and a user-mode
>> subsystem, such as Winlogon or the Client Server Runtime Subsystem
>> (CSRSS),
>> is compromised. Security can no longer be guaranteed. Because Win XP can’t
>> run without Winlogon or CSRSS, this is one of the few situations where
>> the
>> failure of a user-mode service can cause the system to stop responding.
>> This Stop message also can occur as a result of malware infestation or
>> when the computer is restarted after a system administrator has modified
>> permissions so that the SYSTEM account no longer has adequate permissions
>> to access system files and folders.
>> </QP>
>> Source: http://aumha.org/a/stop.htm
>>
>> Tip: Take the above reference to "malware infestation" seriously!
>> Chances
>> are that none of the updates caused this. More likely possibility: The
>> Malcious Software Removal Tool found and deleted one or more infections
>> but
>> couldn't detect and remove all of the infections.
>>
>> What anti-virus application or security suite is installed and is your
>> subscription current? What anti-spyware applications (other than
>> Defender)? What third-party firewall (if any)?
>>
>> Has a(another) Norton or McAfee application ever been installed on this
>> machine (e.g., a free-trial version that came preinstalled when you
>> bought
>> it)?
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>> www.banthecheck.com
>>
>>
>> Paul Christiansen wrote:
>>> XP Home, SP3 with all updates. After 8-12-09 autoupdating ran, on
>>> reboot,
>>> going to a blue screen with a c00021a fatal error. Other error code is
>>> 0xc0000142.
>>>
>>> How do I get out of this and back out the updates, one of which
>>> obviously
>>> clobbered the registry in some way?

[To keep track of things, it helps immensely if you quote all of the
previous message(s) in your replies to the newsgroup. Thank you.]

> ...No other anti-virus application was installed before ZA.

Then there's a very good chance that your WinXP SP3 computer was infected
before you installed ZAISS and that ZAISS did not install properly &
therefore isn't working properly. My recommendations are as follows:

Backup your personal data, then do a format & clean install of Windows.
Please note that a Repair Install (AKA in-place upgrade) will NOT fix this!

cf. http://michaelstevenstech.com/cleanxpinstall.html#steps

After the clean install, you'll have the equivalent of a "new computer" so
take care of everything on the following page before otherwise connecting
the machine to the internet or a network and before using a USB key that
isn't brand-new or hasn't been freshly formatted:

5 steps to help protect your new computer before you go online
http://www.microsoft.com/protect/com...nced/xppc.mspx

HOW TO get a computer running WinXP Gold (no Service Packs) fully patched
(after a clean install)
http://groups.google.com/group/micro...5afa8ed33e121c

HOW TO get a computer running WinXP SP1(a) or SP2 fully patched (after a
clean install)
http://groups.google.com/group/micro...66ae41add7dd2b

Also see:

Steps To Help Prevent Spyware
http://www.microsoft.com/protect/com...e/prevent.mspx

Rogue Security Software - Microsoft Security:
http://www.microsoft.com/protect/com...ses/rogue.mspx

Best of luck!

Protect Your PC!
http://www.microsoft.com/athome/secu...r/default.mspx


Paul Christiansen wrote:
> Yes, I have ZoneAlarm Internet Security Suite installed. No other
> anti-virus application was installed before ZA.
>
> The Malicious Software Removal Tool did run on 8/12 with the updates and
> the
> log file shows it found no infections. However, the log shows the message
> "Security policy doesn't allow for all actions MSRT may require" Also, a
> list of "Scan Errors" appear, listing resource processes, such as
> //pid:1960, etc. I have no idea what any of that means.
<paste>
PA Bear [MS MVP] wrote:
> Are you referring to ZoneAlarm Intenet Security Suite (ZAISS)?
>
> What anti-virus application was installed before you installed the ZA app
> and was your subscription still current when you installed the ZA app?
>
> FWIW, you could always...
>
> Start a free Windows Update support incident request:
> https://support.microsoft.com/oas/de...spx?gprid=6527
>
> For home users, no-charge support is available by calling 1-866-PCSAFETY
> in
> the United States and in Canada or by contacting your local Microsoft
> subsidiary. There is no-charge for support calls that are associated with
> security updates.
>
> For more information about how to contact your local Microsoft subsidiary
> for security update support issues, visit the International Support Web
> site: http://support.microsoft.com/common/international.aspx
>
> For enterprise customers, support for security updates is available
> through
> your usual support contacts.
>
>
> Paul Christiansen wrote:
>> I run Zone Alarm, the subscription is current, the machine updates its
>> signature files daily and the machine is scanned once a week. The
>> firewall
>> security is set to High.
>>
>> I have never had Norton or any other firewall or anti-virus/worm software
>> on
>> the machine. It was not displaying any signs of an infection (not that
>> that
>> proves mutch).
>>
>> I have never changed any systems permissions on the machine.
>>
>> I would do a repair install, but the Recovery Console doesn't seem to be
>> able to find the windows installation already there. it wants to put a
>> totally fresh copy of XP on the machine.
>>
>> So, anybody got any ideas other than a reformat of the partition and
>> start
>> over (ouch).
>>
>>> <QP>
>>> 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED
>>> This occurs when Windows switches into kernel mode and a user-mode
>>> subsystem, such as Winlogon or the Client Server Runtime Subsystem
>>> (CSRSS),
>>> is compromised. Security can no longer be guaranteed. Because Win XP can’t
>>> run without Winlogon or CSRSS, this is one of the few situations where
>>> the
>>> failure of a user-mode service can cause the system to stop responding.
>>> This Stop message also can occur as a result of malware infestation or
>>> when the computer is restarted after a system administrator has modified
>>> permissions so that the SYSTEM account no longer has adequate
>>> permissions
>>> to access system files and folders.
>>> </QP>
>>> Source: http://aumha.org/a/stop.htm
>>>
>>> Tip: Take the above reference to "malware infestation" seriously!
>>> Chances
>>> are that none of the updates caused this. More likely possibility: The
>>> Malcious Software Removal Tool found and deleted one or more infections
>>> but
>>> couldn't detect and remove all of the infections.
>>>
>>> What anti-virus application or security suite is installed and is your
>>> subscription current? What anti-spyware applications (other than
>>> Defender)? What third-party firewall (if any)?
>>>
>>> Has a(another) Norton or McAfee application ever been installed on this
>>> machine (e.g., a free-trial version that came preinstalled when you
>>> bought
>>> it)?
>>> --
>>> ~Robear Dyer (PA Bear)
>>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>> www.banthecheck.com
>>>
>>>
>>> Paul Christiansen wrote:
>>>> XP Home, SP3 with all updates. After 8-12-09 autoupdating ran, on
>>>> reboot,
>>>> going to a blue screen with a c00021a fatal error. Other error code is
>>>> 0xc0000142.
>>>>
>>>> How do I get out of this and back out the updates, one of which
>>>> obviously
>>>> clobbered the registry in some way?

> This Stop message also can occur as a result of malware infestation or when the computer is
> restarted after a system administrator has modified permissions so that the SYSTEM account no longer
> has adequate permissions to access system files and folders.

It's conceivable that one of the updates is conflicting with ZA and the
Perms on SYSTEM are no longer "adequate" *IF* the system had not been
already been compromised prior to ZA being installed.

Paul ... would you please post the MRT.log, located at
WINDOWS\Debug\mrt.log < -- this file
so that we can see what 'issues' it may have encountered.


MowGreen
===============
*-343-* FDNY
Never Forgotten
===============



PA Bear [MS MVP] wrote:
> [To keep track of things, it helps immensely if you quote all of the
> previous message(s) in your replies to the newsgroup. Thank you.]
>
>> ...No other anti-virus application was installed before ZA.
>
>
> Then there's a very good chance that your WinXP SP3 computer was
> infected before you installed ZAISS and that ZAISS did not install
> properly & therefore isn't working properly. My recommendations are as
> follows:
>
> Backup your personal data, then do a format & clean install of Windows.
> Please note that a Repair Install (AKA in-place upgrade) will NOT fix this!
>
> cf. http://michaelstevenstech.com/cleanxpinstall.html#steps
>
> After the clean install, you'll have the equivalent of a "new computer"
> so take care of everything on the following page before otherwise
> connecting the machine to the internet or a network and before using a
> USB key that isn't brand-new or hasn't been freshly formatted:
>
> 5 steps to help protect your new computer before you go online
> http://www.microsoft.com/protect/com...nced/xppc.mspx
>
> HOW TO get a computer running WinXP Gold (no Service Packs) fully
> patched (after a clean install)
> http://groups.google.com/group/micro...5afa8ed33e121c
>
>
> HOW TO get a computer running WinXP SP1(a) or SP2 fully patched (after a
> clean install)
> http://groups.google.com/group/micro...66ae41add7dd2b
>
>
> Also see:
>
> Steps To Help Prevent Spyware
> http://www.microsoft.com/protect/com...e/prevent.mspx
>
> Rogue Security Software - Microsoft Security:
> http://www.microsoft.com/protect/com...ses/rogue.mspx
>
> Best of luck!
>
> Protect Your PC!
> http://www.microsoft.com/athome/secu...r/default.mspx
>
>
> Paul Christiansen wrote:
>
>> Yes, I have ZoneAlarm Internet Security Suite installed. No other
>> anti-virus application was installed before ZA.
>>
>> The Malicious Software Removal Tool did run on 8/12 with the updates
>> and the
>> log file shows it found no infections. However, the log shows the
>> message
>> "Security policy doesn't allow for all actions MSRT may require" Also, a
>> list of "Scan Errors" appear, listing resource processes, such as
>> //pid:1960, etc. I have no idea what any of that means.
>
> <paste>
> PA Bear [MS MVP] wrote:
>
>> Are you referring to ZoneAlarm Intenet Security Suite (ZAISS)?
>>
>> What anti-virus application was installed before you installed the ZA app
>> and was your subscription still current when you installed the ZA app?
>>
>> FWIW, you could always...
>>
>> Start a free Windows Update support incident request:
>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>
>> For home users, no-charge support is available by calling
>> 1-866-PCSAFETY in
>> the United States and in Canada or by contacting your local Microsoft
>> subsidiary. There is no-charge for support calls that are associated
>> with
>> security updates.
>>
>> For more information about how to contact your local Microsoft subsidiary
>> for security update support issues, visit the International Support Web
>> site: http://support.microsoft.com/common/international.aspx
>>
>> For enterprise customers, support for security updates is available
>> through
>> your usual support contacts.
>>
>>
>> Paul Christiansen wrote:
>>
>>> I run Zone Alarm, the subscription is current, the machine updates its
>>> signature files daily and the machine is scanned once a week. The
>>> firewall
>>> security is set to High.
>>>
>>> I have never had Norton or any other firewall or anti-virus/worm
>>> software
>>> on
>>> the machine. It was not displaying any signs of an infection (not that
>>> that
>>> proves mutch).
>>>
>>> I have never changed any systems permissions on the machine.
>>>
>>> I would do a repair install, but the Recovery Console doesn't seem to be
>>> able to find the windows installation already there. it wants to put a
>>> totally fresh copy of XP on the machine.
>>>
>>> So, anybody got any ideas other than a reformat of the partition and
>>> start
>>> over (ouch).
>>>
>>>> <QP>
>>>> 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED
>>>> This occurs when Windows switches into kernel mode and a user-mode
>>>> subsystem, such as Winlogon or the Client Server Runtime Subsystem
>>>> (CSRSS),
>>>> is compromised. Security can no longer be guaranteed. Because Win XP
>>>> can’t
>>>> run without Winlogon or CSRSS, this is one of the few situations where
>>>> the
>>>> failure of a user-mode service can cause the system to stop responding.
>>>> This Stop message also can occur as a result of malware infestation or
>>>> when the computer is restarted after a system administrator has
>>>> modified
>>>> permissions so that the SYSTEM account no longer has adequate
>>>> permissions
>>>> to access system files and folders.
>>>> </QP>
>>>> Source: http://aumha.org/a/stop.htm
>>>>
>>>> Tip: Take the above reference to "malware infestation" seriously!
>>>> Chances
>>>> are that none of the updates caused this. More likely possibility: The
>>>> Malcious Software Removal Tool found and deleted one or more infections
>>>> but
>>>> couldn't detect and remove all of the infections.
>>>>
>>>> What anti-virus application or security suite is installed and is your
>>>> subscription current? What anti-spyware applications (other than
>>>> Defender)? What third-party firewall (if any)?
>>>>
>>>> Has a(another) Norton or McAfee application ever been installed on this
>>>> machine (e.g., a free-trial version that came preinstalled when you
>>>> bought
>>>> it)?
>>>> --
>>>> ~Robear Dyer (PA Bear)
>>>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>>> www.banthecheck.com
>>>>
>>>>
>>>> Paul Christiansen wrote:
>>>>
>>>>> XP Home, SP3 with all updates. After 8-12-09 autoupdating ran, on
>>>>> reboot,
>>>>> going to a blue screen with a c00021a fatal error. Other error
>>>>> code is
>>>>> 0xc0000142.
>>>>>
>>>>> How do I get out of this and back out the updates, one of which
>>>>> obviously
>>>>> clobbered the registry in some way?
>
>

Forgot to add: Have you tried Last Known Good Configuration ?

If you have already attempted LKG 3 times, then it won't help.
Can the system be booted to Safe Mode ?


MowGreen
===============
*-343-* FDNY
Never Forgotten
===============



PA Bear [MS MVP] wrote:

> [To keep track of things, it helps immensely if you quote all of the
> previous message(s) in your replies to the newsgroup. Thank you.]
>
>> ...No other anti-virus application was installed before ZA.
>
>
> Then there's a very good chance that your WinXP SP3 computer was
> infected before you installed ZAISS and that ZAISS did not install
> properly & therefore isn't working properly. My recommendations are as
> follows:
>
> Backup your personal data, then do a format & clean install of Windows.
> Please note that a Repair Install (AKA in-place upgrade) will NOT fix this!
>
> cf. http://michaelstevenstech.com/cleanxpinstall.html#steps
>
> After the clean install, you'll have the equivalent of a "new computer"
> so take care of everything on the following page before otherwise
> connecting the machine to the internet or a network and before using a
> USB key that isn't brand-new or hasn't been freshly formatted:
>
> 5 steps to help protect your new computer before you go online
> http://www.microsoft.com/protect/com...nced/xppc.mspx
>
> HOW TO get a computer running WinXP Gold (no Service Packs) fully
> patched (after a clean install)
> http://groups.google.com/group/micro...5afa8ed33e121c
>
>
> HOW TO get a computer running WinXP SP1(a) or SP2 fully patched (after a
> clean install)
> http://groups.google.com/group/micro...66ae41add7dd2b
>
>
> Also see:
>
> Steps To Help Prevent Spyware
> http://www.microsoft.com/protect/com...e/prevent.mspx
>
> Rogue Security Software - Microsoft Security:
> http://www.microsoft.com/protect/com...ses/rogue.mspx
>
> Best of luck!
>
> Protect Your PC!
> http://www.microsoft.com/athome/secu...r/default.mspx
>
>
> Paul Christiansen wrote:
>
>> Yes, I have ZoneAlarm Internet Security Suite installed. No other
>> anti-virus application was installed before ZA.
>>
>> The Malicious Software Removal Tool did run on 8/12 with the updates
>> and the
>> log file shows it found no infections. However, the log shows the
>> message
>> "Security policy doesn't allow for all actions MSRT may require" Also, a
>> list of "Scan Errors" appear, listing resource processes, such as
>> //pid:1960, etc. I have no idea what any of that means.
>
> <paste>
> PA Bear [MS MVP] wrote:
>
>> Are you referring to ZoneAlarm Intenet Security Suite (ZAISS)?
>>
>> What anti-virus application was installed before you installed the ZA app
>> and was your subscription still current when you installed the ZA app?
>>
>> FWIW, you could always...
>>
>> Start a free Windows Update support incident request:
>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>
>> For home users, no-charge support is available by calling
>> 1-866-PCSAFETY in
>> the United States and in Canada or by contacting your local Microsoft
>> subsidiary. There is no-charge for support calls that are associated
>> with
>> security updates.
>>
>> For more information about how to contact your local Microsoft subsidiary
>> for security update support issues, visit the International Support Web
>> site: http://support.microsoft.com/common/international.aspx
>>
>> For enterprise customers, support for security updates is available
>> through
>> your usual support contacts.
>>
>>
>> Paul Christiansen wrote:
>>
>>> I run Zone Alarm, the subscription is current, the machine updates its
>>> signature files daily and the machine is scanned once a week. The
>>> firewall
>>> security is set to High.
>>>
>>> I have never had Norton or any other firewall or anti-virus/worm
>>> software
>>> on
>>> the machine. It was not displaying any signs of an infection (not that
>>> that
>>> proves mutch).
>>>
>>> I have never changed any systems permissions on the machine.
>>>
>>> I would do a repair install, but the Recovery Console doesn't seem to be
>>> able to find the windows installation already there. it wants to put a
>>> totally fresh copy of XP on the machine.
>>>
>>> So, anybody got any ideas other than a reformat of the partition and
>>> start
>>> over (ouch).
>>>
>>>> <QP>
>>>> 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED
>>>> This occurs when Windows switches into kernel mode and a user-mode
>>>> subsystem, such as Winlogon or the Client Server Runtime Subsystem
>>>> (CSRSS),
>>>> is compromised. Security can no longer be guaranteed. Because Win XP
>>>> can’t
>>>> run without Winlogon or CSRSS, this is one of the few situations where
>>>> the
>>>> failure of a user-mode service can cause the system to stop responding.
>>>> This Stop message also can occur as a result of malware infestation or
>>>> when the computer is restarted after a system administrator has
>>>> modified
>>>> permissions so that the SYSTEM account no longer has adequate
>>>> permissions
>>>> to access system files and folders.
>>>> </QP>
>>>> Source: http://aumha.org/a/stop.htm
>>>>
>>>> Tip: Take the above reference to "malware infestation" seriously!
>>>> Chances
>>>> are that none of the updates caused this. More likely possibility: The
>>>> Malcious Software Removal Tool found and deleted one or more infections
>>>> but
>>>> couldn't detect and remove all of the infections.
>>>>
>>>> What anti-virus application or security suite is installed and is your
>>>> subscription current? What anti-spyware applications (other than
>>>> Defender)? What third-party firewall (if any)?
>>>>
>>>> Has a(another) Norton or McAfee application ever been installed on this
>>>> machine (e.g., a free-trial version that came preinstalled when you
>>>> bought
>>>> it)?
>>>> --
>>>> ~Robear Dyer (PA Bear)
>>>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>>> www.banthecheck.com
>>>>
>>>>
>>>> Paul Christiansen wrote:
>>>>
>>>>> XP Home, SP3 with all updates. After 8-12-09 autoupdating ran, on
>>>>> reboot,
>>>>> going to a blue screen with a c00021a fatal error. Other error
>>>>> code is
>>>>> 0xc0000142.
>>>>>
>>>>> How do I get out of this and back out the updates, one of which
>>>>> obviously
>>>>> clobbered the registry in some way?
>
>

Or you could...

See the "How to obtain help" section of
http://support.microsoft.com/kb/968537 and be fully-patched againt the
vulnerability!
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002



mtjohn66 wrote:
> I had a Dell desktop doing the exact thing. I ended up putting the
> drive in another desktop to save the data and reloaded XP. After
> applying all updates, the same thing started happening. I have narrowed
> it down to MS Update 968537. It replaces win32.sys umong other things.
> I used Recovery console to copy the old win32.sys file and it booted
> fine. Just dont install that update.
> Hope this helps.

mtjohn66 wrote:

> I had a Dell desktop doing the exact thing. I ended up putting the
> drive in another desktop to save the data and reloaded XP. After
> applying all updates, the same thing started happening. I have narrowed
> it down to MS Update 968537. It replaces win32.sys umong other things.
> I used Recovery console to copy the old win32.sys file and it booted
> fine. Just dont install that update.
> Hope this helps.
>
>

C000021a
http://msdn.microsoft.com/en-us/library/ms797159.aspx

> Cause
>
> This error occurs when a user-mode subsystem, such as WinLogon or the Client Server Run-Time
> Subsystem (CSRSS), has been fatally compromised and security can no longer be
guaranteed.
> <snip>
> Mismatched system files can also cause this error. This can occur if you have restored your hard
> disk from a backup. Some backup programs might skip restoring system files that they determine are
> in use.
> <snip>
> Resolving an error in a user-mode device driver, system service, or third-party application:
> Because bug check 0xC000021A occurs in a user-mode process, the most common culprits are third-party
> applications.

Dollars to donuts that this issue is occurring due to 3rd party
software. It may well be stemming from the antivirus/security suite or
from using backup software.

Microsoft Security Bulletin MS09-025 - Important
Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege
(968537)
http://www.microsoft.com/technet/sec.../MS09-025.mspx

> This security update resolves two publicly disclosed and two privately reported vulnerabilities in
> the Windows kernel that could allow elevation of privilege. An attacker who successfully exploited any
> of these vulnerabilities could execute arbitrary code and take complete control of an affected system.
> An attacker could then install programs; view, change, or delete data; or create new accounts with
> full user rights. An attacker must have valid logon credentials and be able to log on locally to
> exploit these vulnerabilities. The vulnerabilities could not be exploited remotely or by anonymous
> users.

Since this vulnerability can only be exploited if someone has physical
access to the system then it's not rated as Critical.

If you contact MS they will assist you with *no-charge* support in
getting this update installed. Plus, they will then be aware of any
issues caused by 3rd party software with the update:


> Support
> • Customers in the U.S. and Canada can receive technical support from Security Support or
> 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.
> For more information about available support options, see Microsoft Help and Support.
> • International customers can receive support from their local Microsoft subsidiaries. There is no
> charge for support that is associated with security updates. For more information about how to
> contact Microsoft for support issues, visit the International Support Web site
> http://go.microsoft.com/fwlink/?LinkId=21155


MowGreen
===============
*-343-* FDNY
Never Forgotten
===============