erpdude8 Posted December 16, 2005 Share Posted December 16, 2005 Can anyone tell if KB891711.exe shows up in the Task list after pressing CTRL-ALT-DEL, using this patch?Nope, it doesn't show up in the Windows Task List window. and it never does show up in the Close Program dialog box when pressing [Ctrl]+[Alt]+[Del].you will need a utility like EndItAll (mentioned by the author of U891711) to safely shut down KB891711.exe (by selecting the Close option in EndItAll, not the Kill option)using Coolkill, WinKill or Process Explorer to "kill" KB891711.exe will result in a BSOD. Link to comment Share on other sites More sharing options...
MDGx Posted December 17, 2005 Author Share Posted December 17, 2005 More details from the author of U891711:I noticed the discussion on TI891711.EXE the other day. There are more issues with Tihiy's patch than the one I pointed out originally.I examined TI891711.DLL and the hex-patched USER32.DLL very closely before I came to the conclusion that TI891711.EXE was neat piece of work, but most definitely not a solution. Modifying KB891711.EXE (and Q891711.DLL) was the only way forward.(1) It is possible to add another code segment to USER.EXE and move essential code from KB891711.EXE to this segment to avoid the very small performance penalty from KB891711.EXE running all the time. However, it would have to be done indvidually for all versions (1998, 2000, 2001, 2222-2231, 3000, 3001 - did I miss one?) and also all languages. I certainly lack the time for that.(2) Tihiy's hex-patched USER32.DLL is for Win98SE only and has at least two bugs. One of the bugs is very serious - the relocation table is faulty, for example, b/c of missing entries forBFC04DF4: 68 AC D5 C0 BF push BFC0D5ACand so forth.(3) To determine whether a file is malformed or not, just integer values have to be checked. TI891711.DLL uses a large number of (much slower) floating-point instructions almost exclusively. I was unable to figure out why.(4) No protection from TI891711.DLL for 16-bit applications.(5) A 32-bit application could call 'LoadImage' in USER.EXE directly through a procedure called thunking and so bypass TI891711.DLL, but this is an extremely unlikely scenario.(6) No protection from TI891711.DLL, for example, when a 32-bit program uses 'LoadCursorFromFileA' in USER32.DLL.(7) Functionality has been removed from the patched USER32.DLL 4.10.2231. IMO, this should not be done w/o a README.TXT file that explains it. Link to comment Share on other sites More sharing options...
MDGx Posted January 9, 2006 Author Share Posted January 9, 2006 (edited) Edited February 14, 2006 by MDGx Link to comment Share on other sites More sharing options...
Petr Posted January 9, 2006 Share Posted January 9, 2006 U891711 Patch updated 1-5-2006:KB891711.EXE 4.10.2224 appeared to be causing some performance degradation onan older PC using Windows 98 SE.Therefore KB891711.EXE was updated to use fixed GlobalMemory instead of movable GlobalMemory. This appears to improve things.Please see top of this topic to download and install updated patch:http://www.msfn.org/board/?showtopic=58780It is bad that there are two different KB891711.EXE 4.10.2224 files with the same size and date.Petr Link to comment Share on other sites More sharing options...
MDGx Posted January 9, 2006 Author Share Posted January 9, 2006 U891711 Patch updated 1-5-2006:KB891711.EXE 4.10.2224 appeared to be causing some performance degradation onan older PC using Windows 98 SE.Therefore KB891711.EXE was updated to use fixed GlobalMemory instead of movable GlobalMemory. This appears to improve things.Please see top of this topic to download and install updated patch:http://www.msfn.org/board/?showtopic=58780It is bad that there are two different KB891711.EXE 4.10.2224 files with the same size and date.PetrI thought of that too, but I tested the updated patch with the newer file and installed it over the older one, and installed ok under Win98 SE + ME.Hope this helps. Link to comment Share on other sites More sharing options...
erpdude8 Posted January 9, 2006 Share Posted January 9, 2006 I'll try out the newly released U891711 patch as soon as I can get it. I'll let you know how well it did on the computers that I've tested. Link to comment Share on other sites More sharing options...
MDGx Posted February 14, 2006 Author Share Posted February 14, 2006 (edited) U891711 Patch updated 2-14-2006:When KB891711.EXE starts it registers itself as a Service Process and patchesUSER.EXE. When a user logs off it stays on as a service process, but unpatchesUSER.EXE and does not patch USER.EXE again when the same or another user logson. This means KB891711.EXE no longer provides protection.Therefore KB891711.EXE was updated to build 4.10.2225 to fix this.DrWatson can be used to reproduce this issue and verify that the fix works. Itlists USER.EXE as patched if there is protection from KB891711.EXE.Please see top of this topic to download and install updated patch:http://www.msfn.org/board/?showtopic=58780 Edited February 14, 2006 by MDGx Link to comment Share on other sites More sharing options...
erpdude8 Posted February 14, 2006 Share Posted February 14, 2006 (edited) new U891711 patch has KB891711.exe 4.10.2225 but dated 10/4/2005 with time 10:25pmTHAT AINT GOOD ENOUGH! Microsoft can do a much better job modding system files bychanging BOTH the date and time (and version number). At least MS want to make iteasier for Windows users to distinguish between older and newer system files by changingthe version number, the date and time. the anonymous author of U891711 should make attempts of doing what MS does with modding system files.I've just submitted changes to the KB891711.exe file to MDGx; corrected date to 2/11/2006but still with 10:25pm as the time.See here (my post from an older topic about kb891711):Microsoft kb891711 for Windows 98/ME [version 1] hadKb891711.exe ver. 4.10.2222 dated 2/22/2005, 6:07pmQ891711.dll ver. 4.10.2222 dated 2/18/2005, 9:53am<this one was known to cause problems on some W98/ME machines>Microsoft kb891711 for Windows 98/ME [version 2] hadKb891711.exe ver. 4.10.2223 dated 3/23/2005, 2:54pmQ891711.dll ver. 4.10.2222 dated 3/18/2005, 4:54pm<this one resolved many of the problems caused by the previous release>see how Microsoft dates the files. Many times MS does a brilliant job giving newer dates/times ofnewer builds of system files. Edited February 14, 2006 by erpdude8 Link to comment Share on other sites More sharing options...
erpdude8 Posted February 17, 2006 Share Posted February 17, 2006 (edited) the author of U891711 needs to use more "common sense" when dating and versioning files.when giving kb891711.exe 4.10.2224 a date of 10/4/2005, and you revise it as 4.10.2225you absolutely do NOT date it 10/4/2005. that can cause major confusion to Windows usersbecause they can not tell if the file was modified or not.If Microsoft were to do such a thing in not changing the date of when a file was modified and the file was given a different version number,I would be critical of them too. Edited February 17, 2006 by erpdude8 Link to comment Share on other sites More sharing options...
erpdude8 Posted February 20, 2006 Share Posted February 20, 2006 ok. I've done enough complaining about version 4.10.2225 of the KB891711.exe file having the same exact date as version 4.10.2224 of the KB891711.exe file [both builds 2224 and 2225 of KB891711.exe file were dated 10/4/2005 which is an abomination]. I've changed the date of build 2225 of the KB891711.exe file so it should now be dated 2/11/2006 with 10:25pm as the time. I've sent the revised U891711 fix to MDGx (the KB891711.exe file should be dated 2/11/2006 instead of 10/4/2005) but has not posted it up yet. Seems that the author of the U891711 fix forgot to change the date of the KB891711.exe file after he changed the build number from 2224 to 2225. It's barely inexcusable for newer builds of the U891711 files to have the same exact date as older builds. Link to comment Share on other sites More sharing options...
MDGx Posted June 28, 2006 Author Share Posted June 28, 2006 (edited) Edited September 29, 2006 by MDGx Link to comment Share on other sites More sharing options...
Hu$tle Posted September 19, 2006 Share Posted September 19, 2006 Windows KB891711 component has altered Windows system files.Module Name: KB891711.EXEDescription: Windows KB891711 componentVersion: 4.10.2225Product: Microsoft® Windows® Operating SystemManufacturer: Microsoft Corporationthis is my Dr Watson report Link to comment Share on other sites More sharing options...
noguru Posted September 20, 2006 Share Posted September 20, 2006 Windows KB891711 component has altered Windows system files.Module Name: KB891711.EXEDescription: Windows KB891711 componentVersion: 4.10.2225Product: Microsoft® Windows® Operating SystemManufacturer: Microsoft Corporationthis is my Dr Watson reportDon't worry, it's supposed to do that. The official Ms patch works the same way. Link to comment Share on other sites More sharing options...
MDGx Posted September 29, 2006 Author Share Posted September 29, 2006 (edited) Edited November 20, 2006 by MDGx Link to comment Share on other sites More sharing options...
erpdude8 Posted October 2, 2006 Share Posted October 2, 2006 (edited) Windows KB891711 component has altered Windows system files.Module Name: KB891711.EXEDescription: Windows KB891711 componentVersion: 4.10.2225Product: Microsoft® Windows® Operating SystemManufacturer: Microsoft Corporationthis is my Dr Watson reportDon't worry, it's supposed to do that. The official Ms patch works the same way.in other words, it's normal for Dr Watson to report KB891711 "altering system files"that dont bother me. win98se/winme will work just fineditto for official MS KB918547 patch Edited October 4, 2006 by erpdude8 Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now