Can Win Update Items Trash Your Computer (?)

[Seeker47]

Have you ever installed a KB____ "fix" from MS that left you with some pretty good evidence it messed up the installed Windows ? The following is from some ongoing notes, where this seems to have happened to one of my desktop systems.

[I should mention that I consider reinstalling Windows from scratch to be cruel & unusual punishment. It has taken me a good two weeks of work to get things back to the previous status quo, the few times I did that. So I don't. This has almost never been necessary, and good partition images have saved the day for me a few times, in recent years. Usually it does not come to that.]

10/20/13:
=======

The Win-7U x64 on this system may be fatally compromised by either some failed
Win Update installation, or some as yet undetected malware. Listings in the Win Update
History are unreliable, including as to what is really there or not, and whether it is there in a
correct state. Anything dated 9/18/13 -- esp. from the .Net updates -- is suspect; a block
of them apparently cannot be deleted (or even removed from the list) and the system says
they may have been previously removed.

There is one or more Win KB Updates, still to be decisively identified, that when applied
gives rise to a fatal error: "The application was unable to start correctly (0Xc0000005).
Click O.K. to close the application." This will then apply to nearly all applications on the
desktop, rendering the computer effectively inoperable. At this point, Win Update and
various other system components also will no longer open. No access to any Restore Points.

If I boot into Safe Mode and from there uninstall a recent block of these updates, this
fatal Windows condition is undone -- but I'm still trying to narrow it down to a particular
KB "fix" that may be incompatible with this hardware. (Or possibly this install of Win-7 was
simply hosed in some unknown way by a failed block of updates applied on 9/18.)

Unfortunately, the last boot partition image made predating these problems is from 4/16/13.
If a satisfactory confidence in the integrity of this Win-7 cannot be restored, it may
be necessary to resort to using that image, after scrubbing off the existing boot partition,
and building it back up from there. In the meantime, try to back up everything post 4/16
that may be important, and which can be backed up. This particular desktop system has more
video-related stuff on it than any of the others: lots & lots of apps, utilities, reference, and so forth.
Also more RAM and HDD space, as the working environment.

A full scan With up-to-date Windows Defender (from Safe Mode), as well as an Avast 8
boot-time scan, have been negative. There is a lot of material on the web about using
Hijack This and Malwarebytes in situations not far removed from this one, but a lot of it
strikes me as a paranoid chasing after phantoms that won't really be the the culprit.

(Why then would this condition go away after I uninstall several MS patches" ?? Malware
does not wreak its havoc in that narrow and specific a manner.)

I have just burned a Memtest-86 CD, since flakey RAM is another possible cause you see
mentioned online, but I don't find much evidence that the 8Gb. of RAM in this computer might
be suspect.

To Be Continued . . . .

[aedipuss]

malwarebytes, the free portion is good. even better is the mbar anti-rootkit beta. there comes a point fairly early with windows when corruption is terminal.

3 days is about average to format/install windows/update/install programs/update them. i prefer that to images that may or may not be already infected. about 5 minutes online is all it takes to infect an unprotected computer.

[Seeker47]

malwarebytes, the free portion is good. even better is the mbar anti-rootkit beta. there comes a point fairly early with windows when corruption is terminal.

3 days is about average to format/install windows/update/install programs/update them. i prefer that to images that may or may not be already infected. about 5 minutes online is all it takes to infect an unprotected computer.

This has been a well-protected computer. Just passed MBAM (except for a couple of install files or unopened archives said to contain PUPs, one of them incidentally being ImgBurn 2.5.8.0, which has been discussed here), though I have not tried out the experimental MBAR as yet.

Have never had an infected image, and my time required to do a full-on Win from scratch -- duplicating all the installed stuff and customizations I had built up over time -- clearly differs from yours.

Some non-malware system corruption would be another matter. But, if it exists and is significant, I have to think it will manifest itself in ways that are hard to miss, sooner rather than later. So far, all the apps etc. that I normally use seem to be working as expected.

I have gradually been putting back those MS updates, in very small, selected steps. There are about 8 of them left to go, not counting some I will likely skip entirely. (I don't use IE at all, and I think it still may be ver. 9 that is installed on the system in question, so the specific fixes for versions 10 & 11 are likely moot.) Right now, if I had to wager, my guess is that one of the Kernel Mode related "fixes" is going to be the guilty party. Once I know the exact KB #, I can mention it here, and do some online searching for any similar reports.

[redwudz]

Keep us updated if you find the problematic update. I haven't had any update problems in the last few years. But in the past MS did have some 'flakey' updates. I recall they used to include updates for non-MS software and that added in outdated and non-compatible software.

And I did have one of MS Vista updates lock up my PC and needed a system restore to fix it.

I suppose the best advice is to turn off MS updates and wait a few weeks before installing new updates to give some time to check for reported problems. And, JMO, but I don't normally install any security updates as most of them are for MS Defender and MS firewall, both of which I consider almost useless. Avast antivirus or simillar and Comodo firewall or similar work much better.

[Nelson37]

Can a MS Update hose up your comnputer? Absolutely, positively, without doubt and without question, YES.

Is that what you are experiencing now? It does seem that way, though more info would be necessary. You are IMO far, far too confident that the problem is NOT a virus or rootkit. It would take at least two scans from different software before I would have any confidence in saying that.

Your current procedure is correct, narrow it down to a single update and eliminate it. Then don't do automatic updates anymore. Do them at periodic intervals AFTER checking for recent bug reports.

Clean out ALL your temporary directories and do a registry clean-up, also re-download the updates in question, you may simply have gotten a corrupted file.

[pearlblack15]

I haven't had any problem so far yet. May be because I go through the details of each update to determine whether its really important or that I would need it as suggested by MS :P But recently this particular update was deliberately unchecked by microsoft themselves not to install because of a problem it may cause described in the article:

http://support.microsoft.com/kb/2862330

I am not sure the above update would have caused the problem but may be some should get cautioned for being too greedy to tick the box to have all the listed updates installed.

[filmboss80]

I had a problem once with legacy software not launching after an automatic update of Win 7. So, yes, it happens. The problem was solved by a simple uninstall and reinstall of the software. I also reset Win Update to allow me to pick and choose what it will install.

[Seeker47]

I haven't had any problem so far yet. May be because I go through the details of each update to determine whether its really important or that I would need it as suggested by MS :P But recently this particular update was deliberately unchecked by microsoft themselves not to install because of a problem it may cause described in the article:

http://support.microsoft.com/kb/2862330

I am not sure the above update would have caused the problem but may be some should get cautioned for being too greedy to tick the box to have all the listed updates installed.

Thanks to All -- appreciate your input.

@pearlblack15,
The USB updates were applied yesterday, and therefore seem to be ruled out -- at least for me. But one unanswered question might be "Can these patches interact with each other in adverse ways, or cause some problem if not applied in some necessary order ?" I think I'll try those kernel mode ones last . . . but not today.

That "IRQL_NOT_LESS_OR_EQUAL" business is a BSOD stop I have seen periodically on another, older desktop computer running XP. It was infrequent and unpredictable but rather annoying, not seemingly tied to anything I was ever able to put my finger on, so it remained a mystery. I'm glad not to have encountered it on other laptops or desktop systems.

@Nelson37,
Good to see you are still posting here. Hadn't seen anything from you for awhile.
Well, Avast 8 boot time scan + an MBAM scan -- there's your two. I'd still have to say that something which comes and goes with the application | removal of KB "fixes" (and excluding Win Defender definitions) is very un-malware-behavior-like.

Just for the hell of it, I might be willing to try a good rootkit scanner, if there was one that was not risky to run. The ones I've seen all seem to carry warnings about very bad things that could happen in their use, and absolving all responsibility. Based on reading through a fair amount of stuff online, including many posted HiJackThis logs and response advice, I have to reiterate my strong impression that in many of these "cases" someone spotted a mouse, mistook it for a rat (presumed to be part of a colony), and determined that the cure must be detonating the entire building. I'd rather see what VirusTotal has to say, before I start wiring up the C4.

I do use CCleaner, fairly regularly. What should I be using for Registry clean-up ?
(Preferably something that works smart, not like a blunt instrument.)

[pearlblack15]

Thanks. Yes, I had just applied the update and no problem here.

Your following question:

"Can these patches interact with each other in adverse ways, or cause some problem if not applied in some necessary order ?"

had been partially answered by MS on their site: http://technet.microsoft.com/en-us/library/cc750077.aspx (some good reminders are there)


"Potential issues will arise from the sequencing of the update, as specific instructions may state or recommend a sequence of events or updates to occur before the service pack, hotfix or security patch is applied."

Also, removing in wrong order might create problem too: http://support.microsoft.com/kb/823836
From the first look, it doesn't seem to be hotfix which was causing the problem. Most updates are independent of each other however some requires prior updates to work or install. I have seen updates refusing to install because they had a missing ''partner''


If you think this could be a virus/rootkit problem, then reformatting the system drive doesn't always solve the issue if you have different partitions from where infection could easily occur. You could however install an up to date AV right after formatting from a clean media and scan the entire system.


Additionally, for your own assurance (as most AVs don't detect viruses well), use winrar to check for viruses on the other partitions (This, you have to determine yourself: Check what foreign and unknown files are residing on your partition except for system(C: ) drive. They would be normally seen as autorun.inf or weird unusual name. But don't delete unless you are sure. Usually an empty drive is shown as empty except for the RecycleBin and System Volume Information. You could delete both and they will be created by the system again so don't worry here.) You could be little sure that you are having a virus free system for now unless you know you have an infected application on your drive waiting for you to click.


Anyway, you have 64 bit system, so, not sure if it has any problem with updates or not. Mine is 32 bit and is running fine for now. Also, a registry cleaner won't do any good. Paid ones seems better at finding more issues in the registry but CCleaner is more than good.

[Nelson37]

CCleaner and MBAM (free version) are extremely dependable and safe, if they say remove it, then remove it. Root-kit scanners are another animal entirely, you need to pay careful attention to their suggested actions and double-check what they are doing. I've had success with TDSSkiller from Kaspersky but it has flagged some false positives. Not big on experimental software unless there is no alternative.

Most "boot-time" scans are NOT the same as a "Full" scan, I would run the Avast in full scan mode and also run the TDSS to see if it finds anything. More proof is better proof.

There is always the possiblilty that a virus, or a partially-removed virus, just happens to interact with a particular update.

Some updates will interact with particular hardware or drivers.

Some info on what programs, specifically, failed to run and also what programs DID run after the update would likely point to a specific area of problem. Look for what the failures all have in common that is DIFFERENT from what the successes all have in common. Memory usage? Hi-res video? There should be something.

All the updates should still load in Safe Mode. Not all of the drivers, though, lower video resolution, startup progs, etc. Somewhere between Safe Mode and Normal Mode lies the problem. I would try MsConfig and narrow down the difference.

[Seeker47]

CCleaner and MBAM (free version) are extremely dependable and safe, if they say remove it, then remove it. Root-kit scanners are another animal entirely, you need to pay careful attention to their suggested actions and double-check what they are doing. I've had success with TDSSkiller from Kaspersky but it has flagged some false positives. Not big on experimental software unless there is no alternative.

Most "boot-time" scans are NOT the same as a "Full" scan, I would run the Avast in full scan mode and also run the TDSS to see if it finds anything. More proof is better proof.

There is always the possiblilty that a virus, or a partially-removed virus, just happens to interact with a particular update.

Some updates will interact with particular hardware or drivers.

Some info on what programs, specifically, failed to run and also what programs DID run after the update would likely point to a specific area of problem. Look for what the failures all have in common that is DIFFERENT from what the successes all have in common. Memory usage? Hi-res video? There should be something.

All the updates should still load in Safe Mode. Not all of the drivers, though, lower video resolution, startup progs, etc. Somewhere between Safe Mode and Normal Mode lies the problem. I would try MsConfig and narrow down the difference.

Thanks for the suggestions. I will try out that Kaspersky item.

My impression had been that the boot-time scan (at least as seen in the Avast example) was more thorough and comprehensive than the regular Full Scan. I've done the latter periodically as well, and will do so again later on today.

At the moment, I still have about 8 KB hotfiixes to investigate / apply. These include the two Kernel Mode ones (KB 2876284 and KB 2883150) and the Denial of Service related one, which had become my leading suspects. Some more recent KB put-back attempts with forced-to-uninstall-them-in-Safe-Mode followups have now cast some doubt on this. I am now tentatively placing the suspicion on KB 2882822, the Itrace Relogger one. I'm seeing some reports that this can clash with other things you may have installed, causing serious problems. For example:

http://social.technet.microsoft.com/Forums/en-US/2800720e-45dd-48b5-a368-3c9016c682a8/...w7itproinstall

Shortly, I expect to have a more specific confirmation of this, should it apply to my system.

You asked for better examples of symptoms. When this system is seriously compromised, the first indication I get at bootup is the error "The application was unable to start correctly (0Xc0000005). Click O.K. to close the application." --> flagging CNSLMAIN.Exe. The latter is an integral part of the Canon Control Center for my color inkjet printer. Normally, what should happen instead is a banner flashing by for the Canon Control Center. This software was installed from the mfr. CD that came with the printer, and provides scanning, photo printing etc. apps, and wireless networking for this printer. I use these fairly regularly, and am not going to uninstall them. After that first indication of trouble, I can be fairly certain that clicking on almost every other app on my desktop will yield the same (memory exception ?) error, such that the app cannot be opened. Basic Windows features like Windows Update will not open.

What are the few app exceptions, apparently unaffected ? Notepad, WordPad, Command Prompt. Also the file manager ZTreeWin still works normally. (It is the Windows descendant of the old DOS XTreeGold, and may be rather different "under the hood" than most Windows apps.) Also, the light duty graphics editor PMView still works. But not its category mate XNView. Go figure.

As I said before, I greatly doubt that any malware works like this, is that specific, or has effects that disappear as soon as certain KB hotfixes are removed !

[Nelson37]

The programs that run are low memory usage and self-contained. How about Regedit from RUN, or Control Panel thru the menu? Print thru Notepad, to the Cannon and to a simple ASCII print-to-file?

Does Safe Mode have the same symptoms BEFORE you uninstall the updates? Particularly the Cannon error?

If you have the disk, and you probably should download the latest Cannon software anyway, might be worth uninstalling the Cannon software entirely and testing that way. It's the first thing that indicates an error, and it loads early. And it's printer software. If it were Brother software, I'd do it hands down, no question. Damn printers, anyway.

After the uninstall, reboot, CClean registry and temp files, manually check ALL temp directories, reboot again. You want it GONE. Doesn't take long, it can be replaced easily and exactly the same, no harm no foul.

If you have 2 4Gb sticks, try removing one at a time and testing each separately. I don't waste time on memory testing programs when the error condition is easily and quickly duplicated. Even when it isn't, swapping RAM is faster and more definite.

Even if you nail it down to a single update, there is still Something on your PC interacting badly that most people don't have. It's a two-part problem that may be fixable on your end. Or MS could fix it first.

Rootkit check ALWAYS worth doing. Scandisk and Defrag also worthwhile. Defrag will notify of serious disk errors. SFC worth a run. Low odds on this stuff but good to eliminate some possibilities. No harm no foul. Also never underestimate what a corrupted file can do.

[Hoser Rob]

When I was using windows more I always completely turned off automatic updates. If you set it to just notify you of available updates it'll still frakkin' want to do it by itself sometimes. I know of people who have left their computer unattended for a while without saving and they lost data because of an automatic update. Ridiculous.

I've also known people who got their systems borked because of malicious little update notifications.

If it's a problem with the update itself I'd suspect a bad download. One good reason to maintain a good backup with nice restore points.

[Nelson37]

All right, WHAT HAPPENED?

Updates, man, UPDATES!

[ranchhand]

My opinion will probably get me hoots of derision from some, but here goes: IMHO based on 30 years of experience (yes, I am MCP) has taught me to turn off all Microsoft updates. Reasons are as follows:
>By far the majority of these updates are for vulnerabilites which are minute and rare.
>I cannot begin to count (no exaggeration) the number of totally updated units that I have removed viruses from, fixed corrupted updates nuking the systems, etc.
>In all the years of running Windows 2000, Windows XP and 7 I have never updated. My current W7 Ultimate has never been updated since W7 was released and I have never been infected with the exception of Ask and Babylon toolbars once. I have another WinXP Pro unit still running clean and never had a virus from the first day installation. Same for my son's Windows 7 unit, now approaching 4 years. I am allowing my Windows8 unit to update automatically and it's a nuisance everytime I want to shut down or start up I have to wait for the updates to install. I don't care since I don't use it much anyway, I have it because I must know something about it for the units that folks bring to me for help.
>All units run Comodo firewall and Avira AV, in addition to the router's firewall.
>All units use Firefox, with Noscript and Self-Destructing Cookies add-ons enabled.
>No kids are allowed to touch these units.
>No p-p filesharing sites or porn sites.
>Just in case, 1Xweek total image backups with Macrium Reflect.
So far so good and trouble-free aside from minor glitches or updated driver conflicts which are easily fixed.

[filmboss80]

In all the years of running Windows 2000, Windows XP and 7 I have never updated. My current W7 Ultimate has never been updated since W7 was released and I have never been infected with the exception of Ask and Babylon toolbars once. I have another WinXP Pro unit still running clean and never had a virus from the first day installation. Same for my son's Windows 7 unit, now approaching 4 years. I am allowing my Windows8 unit to update automatically and it's a nuisance everytime I want to shut down or start up I have to wait for the updates to install. I don't care since I don't use it much anyway, I have it because I must know something about it for the units that folks bring to me for help.
>All units run Comodo firewall and Avira AV, in addition to the router's firewall.
>All units use Firefox, with Noscript and Self-Destructing Cookies add-ons enabled.
>No kids are allowed to touch these units.
>No p-p filesharing sites or porn sites.
>Just in case, 1Xweek total image backups with Macrium Reflect.
So far so good and trouble-free aside from minor glitches or updated driver conflicts which are easily fixed.

Same here, except I use Avast antivirus. Win updates have caused grief, whereas shutting them off has always made things run trouble free. I only update when doing a new build, right after loading the OS for the first time. From thereon, if there are problems, I go to hardware/software forums or MS Knowledge Base to look for specific patches and fixes.

If it ain't broke...

[Seeker47]

All right, WHAT HAPPENED?

Updates, man, UPDATES!

Not sure if you were directing that to me, but:

I printed out all your suggestions, which I definitely appreciated, and which I've intended to follow up on, but so far I've just been too damned busy -- requiring use of this particular system -- to take it offline for a serious investigation. Some of those possibilities strike me as being pretty far-fetched, such as flaky RAM modules, because they tend to have non-missable, non-ignorable symptoms, elsewhere.

In the meantime, I came across this

http://winaero.com/blog/how-to-fix-the-error-0x0000005-and-non-working-apps-in-windows...859537-update/

which seems to have a great deal of overlap with the problem I was seeing. I know there were a couple of updates that I applied, this very probably being one of them, that I can now find no trace of whatever. There may not be any later version of the Canon Control Software available, and that is going to turn out to be a red herring anyway: it is merely the first tripwire that provided evidence of the problem, as the system booted.

As of this writing, I am now up-to-date on the MS "fixes", except for about 5 of them. Three of those are irrelevant, as they have to do with Internet Explorer beyond version 9, and I despise that browser, almost never using it, so I'm not gonna bother with 'em. Unless there was some damage done by that (apparently MS-withdrawn ?) patch from the link above, my main suspicion continues to focus on KB 2882822, the Itrace Relogger one, which was listed as 'Recommended' rather than 'Important', in any case. I'd bet you that the next time I try to put that on again, the problem will return. I think that's when we have to say "BINGO !" The curious thing is that this has not cropped up on other, different hardware (mainly laptops), which have all received the same updates.

I have a couple other links I found, with IT pros saying stay away from this or that KB, it's really bad news ! So, I find the comments in posts #15 & #16 quite interesting. I'm starting to take a good, hard look at these KBs, before I decide whether to apply them.

Wanted to mention also that TDSSkiller, Mbam, etc. all came up negative. No surprises really, since my encounters with malware have been very few and far between. I did get an urgent call from someone who had gotten an extremely annoying bite from the Aartemis browser hijacker, which can also carry bad secondary payloads. This isn't my field at all, but I was a journalist for awhile in a distant life and know how to do research. I found four guides online for eradicating this thing, but two of them struck me as drastic, throwing the baby out with the bathwater. (I hope they were not the type of solution Nelson37 would advocate . . . . ) I chose the one of the remaining two guides that I found credible and not so risky or widely destructive. It involved 5 separate tools, and took a few hours to complete. Well, it seems to have worked. It's about 48 hours later, and that sumbitch be GONE ! For good, I hope. It's nice to log a win now and then.

[fritzi93]

I only update when doing a new build, right after loading the OS for the first time.

Same here. No sense waiting until you've loaded and configured your programs, and taking the chance of screwing everything up. Installing Windows is the easy part; what comes after takes me at least one day, working hard at it. Upon which I run some scans and image the drive.

Like Seeker47 says, it's cruel and unusual punishment.

[Seeker47]

Some more reading I had bookmarked, on very possibly related topics:


http://www.infoworld.com/t/microsoft-windows/lessons-learned-microsofts-botched-kb-285...7-patch-228123

http://www.askwoody.com/2013/microsoft-botches-six-yes-six-black-tuesday-patches-kb-28...nd-kb-2868846/

http://news.softpedia.com/news/Microsoft-Pulls-Botched-KB2859537-Windows-7-Update-377356.shtml

http://forums.riftgame.com/technical-discussions/tech-support/380412-windows-update-kb...w-up-help.html


So, I take all this as strong indication that MS has committed and can commit some colossal boo-boos, which even they have acknowledged in the past, leading them to recall some of these "fixes." Be careful if & when you update.