Q891711 + U891711 = Unofficial MS07-017 + MS05-002 .ANI fix

[MDGx]

UPDATED · 4-28-2007

• All Windows 98 SE users = new Q891711 [permanent fix] replaced old U891711 [temporary fix]. Please read Q891711.TXT for complete details:
  http://www.mdgx.com/files/Q891711.TXT
  

* Unofficial Windows 98 SE Animated Cursor (.ANI) + Icon Handling USER32.DLL + USER.EXE 4.10.2233 Security Vulnerability Fix:

http://www.mdgx.com/files/Q891711.TXT

Direct download [375 KB, English]:

http://www.mdgx.com/files/Q891711.EXE

This Fix replaces ALL PREVIOUS Microsoft MS07-017 (Q925902):

http://www.microsoft.com/technet/security/...n/ms07-017.mspx

MS05-002 (Q891711):

http://www.microsoft.com/technet/security/...n/ms05-002.mspx

+ unofficial (U891711) Animated Cursor (.ANI) + Icon Handling Security Vulnerabilities Fixes, which are now OBSOLETE!

How to uninstall Q891711:

Control Panel -> Add/Remove Programs -> "Remove Unofficial USER32.DLL + USER.EXE Fix" -> click the

"Add/Remove" button -> reboot.

• All other Windows 95/OSR1/OSR2/98/98 SP1/ME users = install U891711 [temporary fix]. Please read U891711.TXT for complete details:
  http://www.mdgx.com/files/U891711.TXT
  

* U891711 [Q891711.DLL 4.10.2223 + KB891711.EXE 4.10.2227] fixes Windows 95/OSR1/OSR2/98/98 SP1/ME Animated Cursor (.ANI) + Icon Handling Security Vulnerabilities:

- MS07-017 (Q925902):

http://www.microsoft.com/technet/security/...n/ms07-017.mspx

- MS05-002 (Q891711):

http://www.microsoft.com/technet/security/...n/ms05-002.mspx

and replaces ALL OTHER similar fixes:

- Both Microsoft fixes listed above.

- Unofficial TI891711 Fix:

http://www.msfn.org/board/?showtopic=43566

Direct download [120 KB]:

http://www.mdgx.com/files/U891711.EXE

Read U891711.TXT FIRST (this file):

http://www.mdgx.com/files/U891711.TXT

Everything here applies only to English editions.

How to uninstall U891711:

Control Panel -> Add/Remove Programs -> "Uninstall Unofficial Windows 95/98/ME U891711 Fix" -> click the "Add/Remove" button -> reboot.

Both Q891711 + U891711 created by anonymous author.

Both these fixes have been tested and works up to specs, unless some1 discovers a new bug, which should be posted in this forum.

Please do not create other forum topics for any Q891711 / U891711 related issues.

NOTE:

No warranties, expressed or implied. Use these files at your own risk!

4-28-2007 UPDATE:

* Win98 SE only = Old U891711 [temporary fix] has been replaced by new Q891711 [permanent fix].

[Fredledingue]

I just rebooted from the installation of your patch and so far everything seems to be alright. CPU usage slightly up afew moments, but I don't know if it's related.

Do you recommand to install the 98KRNLUP.EXE after this patch too?

[Acheron]

I would like to help testing, however I need something to test. Have you a link to a "malformed" image or so that should be blocked by this new patch?

[MDGx]

I just rebooted from the installation of your patch and so far everything seems to be alright. CPU usage slightly up afew moments, but I don't know if it's related.

Do you recommand to install the 98KRNLUP.EXE after this patch too?

Yes, the 98(FE)/98SE Kernel patch is also recommended to install after this beta patch, and after all other related patches [MS official + Tihiy unofficial described in U891711.TXT].

I would like to help testing, however I need something to test. Have you a link to a "malformed" image or so that should be blocked by this new patch?

Unfortunately I don't.

I'll post the link here if I find one.

CORRECTION:

The two MS IE 6.0 SP1 windows lockup BUG is NOT related to this patch, and I have subsequently removed it from U891711.TXT.

Edited October 23, 2005 by MDGx

[bristols]

Hi MDGX,

I'm currently reinstalling my OS from scratch, and I want to try out U891711. I will install 98SE2ME, with the ME options (hooray!). Just a question about the recommended installation order: would the following order be more or less ok?:

- all Win 98SE updates

- SE SP2.02

- U891711

- 98SE2ME

- RPLite3 (perhaps)

- 98KRNLUP

- 98UPDSYS (for Intel CPU)

Hope this is fairly straightforward.

Thanks for any suggestions.

[Fredledingue]

MGDx,

I have tried without the kernel patch during two days, and it worked fine. Now I did the patch and it's still fine.

[MDGx]

Hi MDGX,

I'm currently reinstalling my OS from scratch, and I want to try out U891711. I will install 98SE2ME, with the ME options (hooray!). Just a question about the recommended installation order: would the following order be more or less ok?:

- all Win 98SE updates

- SE SP2.02

- U891711

- 98SE2ME

- RPLite3 (perhaps)

- 98KRNLUP

- 98UPDSYS (for Intel CPU)

Hope this is fairly straightforward.

Thanks for any suggestions.

The order you have chosen is ok.

If you want more details, please see 98SE2ME READ1ST.TXT [the FAQ section]:

http://www.mdgx.com/9s2m/READ1ST.TXT

Please note that if you install MS official Q891711 patch after U891711, it will not install, because will not overwrite the newer file version builds installed by U891711.

98KRNLUP = can be installed at any time. May fix Kernel issues related (or not) to MS Q891711, U891711 + Tihiy KB891711 fix.

98UPDSYS = the WinME edition of this patch [ http://www.mdgx.com/web.htm#MEU ] installs as part of 98SE2ME options 1 and 2. No need to install the Win98 SE edition if you plan to install 98SE2ME and/or Maximus-Decim Native USB Drivers:

http://www.msfn.org/board/?showtopic=43605

which should be included in your updates listed above.

Hope this helps.

MGDx,

I have tried without the kernel patch during two days, and it worked fine. Now I did the patch and it's still fine.

Many thanks for your feedback.

Sounds good.

[Fredledingue]

MGDx,

I have something to say:

A few times already, I noticed abnormal datas transfert (on a 56k modem I see that easily), I mean data being sent or received while I'm not dowloading anything.

If at this time I shut down the connection (which I always do in this case), I get the internet connection dialog looping again and again until I reconnect.

I checked my my processes and noticed that KB891711.exe was running. Killing this task BSOD'ed my PC.

Now I disabled KB891711.exe from the start-up.

What do you think?

[MDGx]

MGDx,

I have something to say:

A few times already, I noticed abnormal datas transfert (on a 56k modem I see that easily), I mean data being sent or received while I'm not dowloading anything.

If at this time I shut down the connection (which I always do in this case), I get the internet connection dialog looping again and again until I reconnect.

I checked my my processes and noticed that KB891711.exe was running. Killing this task BSOD'ed my PC.

Now I disabled KB891711.exe from the start-up.

What do you think?

Thanks for your time.

I'll tell the patch author about your bug report, and then I'll post here any comments/solutions.

[MDGx]

Fredledingue:

Here is the author's reply:

The BSOD also happens with the original security update (v2) from Microsoft (4.10.2223). It is the result of KB891711.EXE running as a service process. One should not kill service processes. It can cause system instability.

Neither the original security update nor the patch (4.10.2224) try to connect to the internet. The only instance where one might see activity if LOADIMAGE loads a file from a network share and that share is accessed through a dial-up connection, but that network activity would occur even w/o the patch.

It is possible that unexpected network activity comes from one other computer scanning IP adresses and ports.

The proof-of-concept .ANI file is at

http://www.xfocus.net/flashsky/icoExp/

Hope this helps.

[Fredledingue]

Thanks MGDx.

I hope eveything's all right then. I will re-intialize the "service" executable.

BTW are you also testing this patch?

[MDGx]

BTW are you also testing this patch?

I still am.

New addtition to the text file U891711.TXT:

http://www.mdgx.com/files/U891711.TXT

NOTE #4

KB891711.EXE can be stopped *safely* using the Close option (but *not* the

Kill option) of programs like EndItAll or similar:

http://www.mdgx.com/speed.htm#TSK

CoolKill and Process Explorer do not have a Close option.

Killing (an application) happens w/o a warning to the application, and that

can be disastrous, as is the case with all versions of KB891711.EXE (official

and unofficial), which modify USER.EXE "on the fly" (DrWatson shows that).

[Fredledingue]

MGDx, I'v got a new BSOD!

And it's such an incredible event on w98se-uSP2.02 that each instance of it is worth being mentioned here.

It happened only once, while surfing the web, suddenly poof! And it happened I think, when the connection was shut-off momentarily. But I didn't kill the process this time.

I don't know if it's related because I installed a new adsl modem since.

But this patch seems to be the only thing that is capable of doing a BSOD on my computer. Maybe nothing serious. I will see if it happends again.

Edited October 29, 2005 by Fredledingue

[dnbgroove]

Hi - Just to report that (with Gape's 2.0.2 SP and MDGx's 98SE-MP10) I found missing button images for Media Player, as per the attached. Restarting the app resolved the problem

[the_guy]

MDGx,

I am pleased to report that this update also works on Windows ME. You also apply it like a normal update, you don't need to kill stmgr using coolkill. Just installed it on a virtual pc and it works. Maybe you could pass that on to the author and modify the installer so it installs on ME.

the_guy