Security Patch 908531 - April 11, 2006

[GCounty]

Applied April 11, 2006 security patches to a number of "test" machines yesterday. Patch 908531 has caused problems on several of these machines both WXP sp2 and W2K sp4.

There are various symptoms all of which are Windows (File) Explorer related. Doing a save as from (say) Word freezes the application. There are no "+" drop down symbols by folders in "My Documents", and double-clicking a folder on the left side of the screen freezes Explorer. And other similar symptoms.

The one thing I have fould is when the "freeze" happens, going into Task Manager, viewing processes, and killing the VERCLSID.EXE process restores order, and whatever goes back to working - until the next Windows Explorer function.

VERCLSID.EXE was one of the files in the 908531 security update.

Some machines "cured" themselves after 6-8 reboots but others have not.

Anyone else seeing this problem or have suggestions?

Thanks

[GCounty]

Have now found numerous other rantings about problems with this patch. According to a few, Microsoft acknowledges the problem.

If you have not installed this one, I would wait for a patch for the patch.

[tommyp]

So much for all the regression testing that they do before they release something. But on the bright side, my windows update says I'm good! Yippie!

Edited April 13, 2006 by tommyp

[cluberti]

In most scenarios this is caused not by verclsid.exe itself, but a shell object or extension that is loading a COM object, sometimes in Office, sometimes in Windows Explorer, sometimes even in IE, that causes verclsid.exe to run (to check the security before instantiating the COM object). Unfortunately, it's hard to say which software is causing it, but disabling shell extensions with shellexview and rebooting is a good test, as is removing any software that uses COM objects as handlers (like HP's Share-To-Web application, for example). In some cases, removing antivirus software also resolved the issue when the issue was affecting Office and IE.

This is a bit of trial and error, unfortunately, and you can always uninstall the patch and wait for this to be fixed, if it becomes a big enough issue for a re-release of the patch.

It can sometimes be easier to find if you can reproduce it at will - load up Process Explorer, reproduce the problem, and see what was the last binary to load before verclsid.exe. Uninstall the patch, reboot, load up process Explorer, then run through the repro steps again and see what loads up - usually you'll see something load up during the repro steps the second time that didn't load up during the first run (when verclsid.exe kicked in), and this may help lead you down the path of the app causing the issue.

Edited April 13, 2006 by cluberti

[chilifrei64]

very interesting.. I just had this happen to me the other day too.. it was locking up MS Outlook/Word/Excel. I just thought her computer was going bad. That was the only PC to have the problem and seems isolated. But looks like I will keep an eye on things...

[ceez]

we also had 1 user with the same problem today, not bad compared to 230 users. add/remove programs and removed it. fixed the issue.

[GCounty]

Interesting comment from "cluberti" about the HP Publish-to-web software. All the PCs that had this problem have HP scanners attached, and I believe the Publish-to-web software comes bundled with that.

Have seen posts in other forums about this problem that also mention HP scanner software.

[cluberti]

It's actually the HP daemon (hpgs2wnd.exe) that's causing it in those scenarios, and it comes with LOTS of different HP software, apparently. Deleting it from the Startup folder and the Run registry keys usually fixes it.

[ner]

Hi does anyone know if microsoft has updated this patch yet?

[RyanVM]

They probably won't until next month at the earliest.

[cluberti]

I don't know if there'll be an update to this, but I can say there is not an update as of now.

[GCounty]

See this link for info....

MS Info on Patch Problem

[gbp007]

This patch also got rid of my buttons tab under keyboard properties used to configure my hp multimedia keyboard..Anybody that has a hp also have the problem where you lost your buttons tab ? I got it back after i uninstalled the patch..

Edited April 20, 2006 by gbp007

[IceBlackIce]

i had similar issues, after adding this reg patch the problems were solved.

http://support.microsoft.com/kb/918165

[tomcatuk.net]

Microsoft has this to say:

You may experience problems in Windows Explorer or in the Windows shell after you install security update MS06-015

Interesting....this patch brought down my Small Business Server 2003, resulting in 10 memebers of staff screaming at me as to why they couldn't connect to either the Exchange Server or the Internet. We're basically an "Internet" company so net access is kind of important. It took 2.5 hours to fix as I had to....

1) Set the most important client machines to connect directly to the net so at least some people could get some work done

2) Re-run the install routine on my SBS2003 machine as it was stuck in an unrecoverable reboot loop. This swallowed 3 hours of my day, and let's face it we all have more interesting things to do than install operating systems (if you haven't, ask yourself what you are actually achieving every day!)

This happened Tuesday morning - which meant I was left with a SBS installation nagging me to apply the critical updates until today when I'm finally able to identify which patch was the culprit for bringing down my server!

Here's where I first heard what I was looking for

My Webpage