Re: Windows update hoses Activesync and Security Center reporting

Sam wrote:
> On Tue, 11 Oct 2005 19:40:22 -0700, Sam <> wrote:
>
>> After installing the latest roundup of patches ActiveSync stopped
>> functioning, complaining that it didn't have permission to login. I
>> tried uninstalling it and reinstalling... no difference. So I
>> uninstalled all of the new patches (not knowing which one was causing
>> the problem). ActiveSync works just fine again. Apparently they made
>> the system so secure that their own software couldn't access the
>> Outlook data.
>>
>> While I'm on a rant, I also noticed that, after the updates, the
>> Security Center no longer recognized either my existing firewall or
>> antivirus software. I use the ZoneAlarm Security Suite and it was
>> recognized before. After I uninstalled the MS updates (see above) the
>> Security Center was once again happy. <sigh>
>>
>> So, until they fix whatever they broke, it looks like I'll be
>> patchless for awhile.
>>
>> Sam
>
> I finally figured out that the problem was the Windows update
> KB902400. Once this update was uninstalled, ActiveSync now works. No
> problems with it recognizing my firewall or virus protection either. I
> now have 6 out of the 8 patches installed. (I haven't reinstalled
> KB896688 either since it has been reported to cause other problems).

Read this and you may want to rethink your decision:

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And
Alert System - Current Infosec News and Analysis:
http://isc.sans.org/diary.php?storyid=759
--
~PA Bear

Sam wrote:
>>>> After installing the latest roundup of patches ActiveSync stopped
>>>> functioning, complaining that it didn't have permission to login. I
>>>> tried uninstalling it and reinstalling... no difference. So I
>>>> uninstalled all of the new patches (not knowing which one was causing
>>>> the problem). ActiveSync works just fine again. Apparently they made
>>>> the system so secure that their own software couldn't access the
>>>> Outlook data.
>>>>
>>>> While I'm on a rant, I also noticed that, after the updates, the
>>>> Security Center no longer recognized either my existing firewall or
>>>> antivirus software. I use the ZoneAlarm Security Suite and it was
>>>> recognized before. After I uninstalled the MS updates (see above) the
>>>> Security Center was once again happy. <sigh>
>>>>
>>>> So, until they fix whatever they broke, it looks like I'll be
>>>> patchless for awhile.
>>>>
>>> I finally figured out that the problem was the Windows update
>>> KB902400. Once this update was uninstalled, ActiveSync now works. No
>>> problems with it recognizing my firewall or virus protection either. I
>>> now have 6 out of the 8 patches installed. (I haven't reinstalled
>>> KB896688 either since it has been reported to cause other problems).
>>
>> Read this and you may want to rethink your decision:
>>
>> SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And
>> Alert System - Current Infosec News and Analysis:
>> http://isc.sans.org/diary.php?storyid=759
>
> I'm doing some further testing to see what's going on. I've
> reinstalled the KB902400 update and like clockwork ActiveSync refused
> to synch.
>
> However, I've noticed a bunch of Event Viewer errors. Maybe they'll
> help figure out what's going on.
>
> Event ID 8193 : Volume Shadow Copy Service error: Unexpected error
> calling routine CoCreateInstance. hr = 0x80040206. [this error
> appears three times]
>
> Event ID 4609 : The COM+ Event System detected a bad return code
> during its internal processing. HRESULT was 80070005 from line 44 of
> d:\qxp_slp\com\com1x\src\events\tier1\eventsystemo bj.cpp. Please
> contact Microsoft Product Support Services to report this error. [this
> error appears five times]
>
> Event ID 5013 : Volume Shadow Copy Service error: Shadow Copy writer
> Microsoft Writer (Bootable State) called routine
> CVssWriterShim::Subscribe which failed with status 0x8000ffff
> (converted to 0x800423f4).
>
> Event ID 1802 : The Windows Security Center Service was unable to
> establish event queries with WMI to monitor third party AntiVirus and
> Firewall. [this error appears twice]

I'd forward all of 'em (or this reply) to MS Product Support Services
(), Sam, and reference this newsgroup thread (in archive:
http://groups.google.com/group/micro...cd34512df750c6).
You may reference my name.

The last one concerns me most and may indicate a hijackware problem is at
least part of the overall problem. (See below.)

With 902400 installed, you might want to try the Clean Boot troubleshooting
technique to see if you're able to nail down a culprit other than the
update(s). See http://support.microsoft.com/default.aspx/kb/310353.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/archive/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/

When all else fails, HijackThis v1.99.1
(http://aumha.net/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://forums.spywareinfo.com/,
http://castlecops.com/forum67.html or http://aumha.net/viewforum.php?f=30
for expert analysis, not here.**
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Security, Shell/User)

Sam wrote:
> On Thu, 13 Oct 2005 19:32:03 -0400, "PA Bear" <>
> wrote:
>> I'd forward all of 'em (or this reply) to MS Product Support Services
>> (), Sam, and reference this newsgroup thread (in
>> archive:
>> http://groups.google.com/group/micro...cd34512df750c6).
>> You may reference my name.
>
> Just one last wrinkle... I tried to forward all this to
> and my mail got rejected:
>
>> <>:
>> 131.107.3.123 does not like recipient.
>> Remote host said: 550 5.1.1 User unknown
>> Giving up on 131.107.3.123.
>
> Any other places where I can send this information?

Check your inbox, Sam. Also see
http://support.microsoft.com/oas/def...px?&gprid=6527
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Security, Shell/User)

I'm also wondering if there might be some sort of undetected conflict in the
COM fixes introduced by KB896688 and the COM+ fixes introduced by KB902400.
Maybe their coexistence is not coexisting?

I've seen responses that either of these updates being uninstalled has
'fixed' problems.

Personally, I have KB902400 installed without any noticeable issues
(although I'm not using ActiveSync).

It was the Cumulative Update that I'm holding off on, but I expect to do a
test install of it within the hour.


"PA Bear" <> wrote in message
news:...

> Sam wrote:

>> I'm doing some further testing to see what's going on. I've
>> reinstalled the KB902400 update and like clockwork ActiveSync refused
>> to synch.
>>
>> However, I've noticed a bunch of Event Viewer errors. Maybe they'll
>> help figure out what's going on.
>>
>> Event ID 8193 : Volume Shadow Copy Service error: Unexpected error
>> calling routine CoCreateInstance. hr = 0x80040206. [this error
>> appears three times]
>>
>> Event ID 4609 : The COM+ Event System detected a bad return code
>> during its internal processing. HRESULT was 80070005 from line 44 of
>> d:\qxp_slp\com\com1x\src\events\tier1\eventsystemo bj.cpp. Please
>> contact Microsoft Product Support Services to report this error. [this
>> error appears five times]
>>
>> Event ID 5013 : Volume Shadow Copy Service error: Shadow Copy writer
>> Microsoft Writer (Bootable State) called routine
>> CVssWriterShim::Subscribe which failed with status 0x8000ffff
>> (converted to 0x800423f4).
>>
>> Event ID 1802 : The Windows Security Center Service was unable to
>> establish event queries with WMI to monitor third party AntiVirus and
>> Firewall. [this error appears twice]
>
> I'd forward all of 'em (or this reply) to MS Product Support Services
> (), Sam, and reference this newsgroup thread (in archive:
> http://groups.google.com/group/micro...cd34512df750c6).
> You may reference my name.
>
> The last one concerns me most and may indicate a hijackware problem is at
> least part of the overall problem. (See below.)
>
> With 902400 installed, you might want to try the Clean Boot
> troubleshooting technique to see if you're able to nail down a culprit
> other than the update(s). See
> http://support.microsoft.com/default.aspx/kb/310353.
>
> Checking for/Help with Hijackware
> http://aumha.org/a/parasite.htm
> http://aumha.org/a/quickfix.htm
> http://aumha.net/viewtopic.php?t=5878
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
> http://inetexplorer.mvps.org/archive/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://defendingyourmachine.blogspot.com/
>
> When all else fails, HijackThis v1.99.1
> (http://aumha.net/downloads/hijackthis.zip) is the preferred tool to use.
> It will help you to both identify and remove any hijackware/spyware.
> **Post your log to http://forums.spywareinfo.com/,
> http://castlecops.com/forum67.html or http://aumha.net/viewforum.php?f=30
> for expert analysis, not here.**
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE/OE, Security, Shell/User)

Sam.. package it up and send it to me via email at l r g a r v i n @ s w b e
l l . n e t

and I'll funnel through the WSUS group and see if they can help us.


"Sam" <> wrote in message
news:...
> On Thu, 13 Oct 2005 19:32:03 -0400, "PA Bear" <>
> wrote:
>>I'd forward all of 'em (or this reply) to MS Product Support Services
>>(), Sam, and reference this newsgroup thread (in archive:
>>http://groups.google.com/group/micro...cd34512df750c6).
>>You may reference my name.
>
> Just one last wrinkle... I tried to forward all this to
> and my mail got rejected:
>
>><>:
>>131.107.3.123 does not like recipient.
>>Remote host said: 550 5.1.1 User unknown
>>Giving up on 131.107.3.123.
>
> Any other places where I can send this information?
>
> Sam

Yeah.. I just identified a "problem" with KB902400 a few minutes ago. See my
post with the details elsewhere in this newsgroup.


"Sam" <> wrote in message
news:...
> On Fri, 14 Oct 2005 12:04:44 -0500, "Lawrence Garvin [MVP]"
> <> wrote:
>
>>
>>I'm also wondering if there might be some sort of undetected conflict in
>>the
>>COM fixes introduced by KB896688 and the COM+ fixes introduced by
>>KB902400.
>>Maybe their coexistence is not coexisting?
>>
>>I've seen responses that either of these updates being uninstalled has
>>'fixed' problems.
>>
>>Personally, I have KB902400 installed without any noticeable issues
>>(although I'm not using ActiveSync).
>>
>>It was the Cumulative Update that I'm holding off on, but I expect to do a
>>test install of it within the hour.
>
> Except I had the same problem with KB896688 not installed. I actually
> installed KB896688 a day after I figured out that KB902400 was the
> cause of my problem.
>
> Sam
>

Sam, I understand from your reply to another thread in this newsgroup that
KB909444 gave you information to resolve your problem, yes?
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Security, Shell/User)

CC: MarieM


Sam wrote:
> On Thu, 13 Oct 2005 19:32:03 -0400, "PA Bear" <>
> wrote:
>> I'd forward all of 'em (or this reply) to MS Product Support Services
>> (), Sam, and reference this newsgroup thread (in
>> archive:
>> http://groups.google.com/group/micro...cd34512df750c6).
>> You may reference my name.
>
> Just one last wrinkle... I tried to forward all this to
> and my mail got rejected:
>
>> <>:
>> 131.107.3.123 does not like recipient.
>> Remote host said: 550 5.1.1 User unknown
>> Giving up on 131.107.3.123.
>
> Any other places where I can send this information?
>
> Sam