Struggling with KB891711 and U891711 on ME

[KevinR]

Hi guys. Lurked here a bit and use the 98SE2.1SP.

Anyway we just gained a PC running ME from elsewhere in the family. Amazingly it updates were there and it had a firewall. Discovered it had a certain KB891711.exe disabled in the startup. Enabled it - and it locks at reboot.

Read about the second release so uninstalled it and reloaded from windows update. Same problem.

Read more here about the U891711 version. Tried that - same problem - machine locks when it runs in startup.

I seem to have understood that there are alternative fixes for 98SE. (eg. hacked USER & KERNEL).

Are there any other solutions for ME?

Thanks

[MDGx]

The Anonymous author has answered some of your questions/requests:

I am way too busy to make WinME USER.EXE + USER32.DLL 4.90.3003.

I doubt this is going to change anytime soon.

I also cannot test such a patch under Win98SE without messing up my OS

installation.

AFAICT, GDI.EXE + GDI32.DLL have no code that interferes with

Power Management. Most definitely, the sections of code I modified and

added to make 4.10.2227 and 4.90.3003 have nothing to do with

Power Management. The problems PROBLEMCHYLD reported about a year ago must

be a mere coincidence.

USER.EXE does call APM BIOS functions. The differences between USER.EXE

4.10.22xx and 4.90.300y are indeed responsible for how 'Restart in MS-DOS

mode' is handled. Some of the differences result from the underlying major

differences between Win98SE and Winme in (WIN.COM), KRNL386.EXE and, most

importantly, VMM.VXD.

BenoitRen wrote Apr 30 2007, 8:44 AM:

> Awesome! Congratulations to the author. I hope he'll be able

> to provide a fix for Windows 95's files as well (both

> version 4.00.950, unless those got updates somewhere?).

As unlikely as a Win98FE patch I am afraid - it is just too time-consuming.

> I have a question, though. It's my understanding that the parsing

> happens in user.exe, and that the way to fix the vulnerabilities is to

> check the size of what user32.dll returns. So why does user32.dll need

> patching? I don't mean to criticise, I just want to learn.

USER.EXE and USER32.DLL are interdependent. So they need to be of the same

version and be updated at the same time. USER32.DLL was patched basically

to make sure this happens under all circumstances.

HTH

[KevinR]

Thanks for the info MDGx .

It seems to confirm that the USER/GDI/KERNEL alternatives to the freestanding patch were not (fully or maybe at all) developed for Win/ME. That leaves me with the official KB891711 (v2) or the hacked (in the best sense) U891711.

As I said in my OP both of these give me a lockup during startup. (ME has all automatic updates).

Has anyone any experience of solving this? Or do we just live without that patch? Is it targetted in the wild?

Thanks guys.

[eidenk]

Or do we just live without that patch?

FWIW I live very well without it and without the other one (can't recall it's name right now) that also adds a new exe as well.

[KevinR]

eidenk: Thanks for the info. It looks like all versions of the exe based patch conflict with something else on this install.

I guess a lot of kudos goes to the guy who produced the proper win98 USER correction. I assume retrofitting that to ME would lose to many other official changes fixes.

Coincidentally we had the SDBOT worm turn up via MSN this week. I think avira stopped it. Reading up on that one of its first steps can be to download a rootkit that hids it. So its hard to be sure. (One of my daughters friends must have the worm though.)

So on a similar note I'm not sure what we'll all do for AV or equivalent next year as most (all?) antivirus makers are dropping all pretense of 98 support next year. I noticed that a lot of other firms are even deleting the downloads for 98 for drivers (eg. HP) and tools (eg. firewalls). This seems crazy as many ordinary users are going to be unable to reinstall after disk crashes etc.

Latest thoughts are either to:

1. Run 98 in a VM inside Linux and use (say) Fprot in Linux.

2. Boot a small linux from a live CD or flash an run (say) Fprot in that.

3. Use an exe blocker (white list) tool of some sort.

There are some opensource AVs but I worry that they will lack the money/time to generate new detections quickly. That part does seem easier to arrange (fund) in a commercial product.

[MDGx]

Reply from the Anonymous author:

KevinR wrote on Oct 31 2007, 05:10 AM:

> As I said in my OP both of these give me a lockup during startup. (ME

> has all automatic updates).

Please install http://www.mdgx.com/files/MEKRNLUP.EXE and post in this

forum if it makes any difference.

I hope this helps.

HTH

[erpdude8]

Thanks for the info MDGx .

It seems to confirm that the USER/GDI/KERNEL alternatives to the freestanding patch were not (fully or maybe at all) developed for Win/ME. That leaves me with the official KB891711 (v2) or the hacked (in the best sense) U891711.

As I said in my OP both of these give me a lockup during startup. (ME has all automatic updates).

Has anyone any experience of solving this? Or do we just live without that patch? Is it targetted in the wild?

Thanks guys.

You may want to consider switching to Win98 SE. I have given up use of WinME in the summer due to lack of the user*.* 891711 fix for WinME and upgraded to WinXP. And I've also switched the OS on my aunt's computer from WinME to Win2000.

I am way too busy to make WinME USER.EXE + USER32.DLL 4.90.3003.

I doubt this is going to change anytime soon.

I also cannot test such a patch under Win98SE without messing up my OS

installation.

This is one of the reasons why I no longer use WinME and have switched to XP. hope the Anonymous author understands my disappointment and doesn't mind me switching from ME to XP.

[KevinR]

Reply from the Anonymous author:

Please install http://www.mdgx.com/files/MEKRNLUP.EXE and post in this forum if it makes any difference.

Finally got a chance to try this. Installed the Kernel Patch - went OK.

Installed the U891711 patch (again - previously removed it).

Windows ME again hangs during processing of the startup apps (presumably on the 891711 executable).

Thanks for trying though.

My guess is that there is a conflict somewhere with one of the device drivers or other startup processes.

Hmm. I may try reordering the startup so this is earlier/later?!?!

SUSSED (aka Solved)

This PC came from a family member and had a copy of ZoneAlarm-Free on it. As this dated from the same era as the PC I had not interfered with it in any way; I assumed load sv performance would be OK. While googling for a solution (again) today I found a correlation between the KB891711v2 (official) and various programs - especially firewalls. This included the v3.7.179 of ZoneAlarm (v3.final really).

So as not to tax this old machine too hard - or explore the joys of we don't do ME any more I picked v5 of zone alarm which had been reported to work. Now running v5.5.094.000 (= v5.final) of ZoneAlarm and the U891711 patch. I still have the improved kernel files - shown in a post above - installed.

Hope this helps anyone else who hits problems. The patches were incompatible with various programs at the time.

Thanks for all the help guys.

Edited November 18, 2007 by KevinR

[erpdude8]

So it looks like KB891711 and U891711 are not compatible with older versions of the ZoneAlarm firewall software and that Zonealarm should be upgraded to work correctly with KB891711/U891711. Good find, KevinR.

If you also have antivirus software installed, upgrade that one as well.

I never had Zonealarm installed on my former WinME machine installed. I had Trend Micro PC-Cillin Internet security 2004 suite which was an antivirus & firewall package and didn't mess with KB891711v2 and U891711.