KB951748 security update blocked my internet completely today. Grrr

Although this update is listed as Important, the DNS issue is being
addressed by *many* other Vendors issuing a patch for it :
http://www.doxpara.com/?p=1162

> Specifically:
>
> 1) It’s a bug in many platforms
>
> 2) It’s the exact same bug in many platforms (design bugs, they are a pain)
>
> 3) After an enormous and secret effort, we’ve got fixes for all major platforms, all out on the same
> day.
>
> 4) This has not happened before. Everything is genuinely under control.
>
> I’m pretty proud of what we accomplished here. We got Windows. We got Cisco IOS. We got Nominum. We
> got BIND 9, and when we couldn’t get BIND 8, we got Yahoo, the biggest BIND 8 deployment we knew of,
> to publicly commit to abandoning it entirely.

*PLEASE* take the time to read the article. There's also a DNS Checker
available on the above page that shows if KB951748 has resolved the
vulnerability.

To push out all the updates/patches at the same time is quite remarkable
and, I think, unheard of when it comes to one specific Vuln.

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============



Roger Overunder wrote:

> "Victoria V." wrote:
> I thought I'd awakened this morning to the computer Twilight
> Zone!!"
>
> Yeah, not the best way to start one's morn! Even if you're a Rod Serling
> fan!
>
>
> "I also went in and changed the update settings on all of the machines to
> download updates, but not to automatically load them. [I'll do it.]"
>
> I think that's the only way to go.
>
> Even better is to go the Update page when you get update notice and do the
> downloading from there 'cause you can get a better idea of what's what & see
> your download history, including the ones you just downloaded. That way you
> know the names of the little guys you just downloaded and have an idea of
> which one might be the culprit in a similiar situation.
>
>

Absolutely!! I'm not going to use auto-update EVER again!! What a mess.
I've spent the last 6+ hours on this fiasco. Anyway, All machines are
working just fine...Just wanted to pass along a note for all those who are
using Zone Alarm.

ZA says NOT to reduce your Internet Zone Security to "medium." The gurus on
their message boards say to leave the setting on "high" (to avoid other nasty
buggers), and to go into your Control Panel, select Add/Remove Programs (make
sure to have "show updates" checked), and remove/uninstall the offending
update. You'll have to reboot (make sure your ZA is set on high just to be
safe before you do this), and you should be all set once your system has
rebooted. The nasty yellow shield shows up at the bottom of your screen, but
at least your internet connections work again.

If anyone knows how to get rid of the yellow shield, I'd love to know. I've
already killed half of my day fixing this mess, might as well blow off the
rest of the day!!! )



"Roger Overunder" wrote:

> "Victoria V." wrote:
> I thought I'd awakened this morning to the computer Twilight
> Zone!!"
>
> Yeah, not the best way to start one's morn! Even if you're a Rod Serling
> fan!
>
>
> "I also went in and changed the update settings on all of the machines to
> download updates, but not to automatically load them. [I'll do it.]"
>
> I think that's the only way to go.
>
> Even better is to go the Update page when you get update notice and do the
> downloading from there 'cause you can get a better idea of what's what & see
> your download history, including the ones you just downloaded. That way you
> know the names of the little guys you just downloaded and have an idea of
> which one might be the culprit in a similiar situation.
>
>

How do you uninstall the update?

Thanks.

"TaurArian" wrote:

>
>
> "Charles Lee" <No_Spam@for.me> wrote in message
> news:Or85iVb4IHA.4488@TK2MSFTNGP03.phx.gbl...
> | My internet was blocked completely by the last security update....
> | yesterday, I was fine....
> |
> | I have 3 pc's on a home network, all on xp...
> |
> | 2 of them, I let update with the latest offering from ms... the security
> | update KB951748...
> |
> | then I lost all connectivy to the net via my router upon reboot, except for
> | the pc I didn't update...
> |
> | pc number 2, I recovered via system restore, back to yesterday... all became
> | fine again...
> |
> |
> | with my main pc, I had not any restore points.... so had to remove the
> | update via 'add/remove' which then killed off 2 programs after uninstalling,
> | which I then had to reinstall.... yawn....
> |
> | after removing KB951748, my internet connection came back to me, like a
> | faithful dog, no probs... phew....
> |
> |
> |
> | is there a way to install this update & adjust it so internet stays working,
> | or....
> | should this update be avoided altoogether...???????
> |
>
>
> If you're using ZA - you should read this -
>
> Zone Alarm & KB951748 Workaround:
> http://forum.zonelabs.org/zonelabs/b...ssage.id=52727
>
>
>
> xposted to the Windows Update Newsgroup for your convenience.
>
>
>
>
> --
>
> TaurArian [MVP] 2005-2009 - Update Services
> http://taurarian.mvps.org
> ======================================
> How to ask a question: http://support.microsoft.com/kb/555375
> Computer Maintenance: Acronis / Diskeeper / Paragon / Raxco
>
>
>

http://download.zonealarm.com/bin/fr...cessIssue.html


"Kim" wrote:

> How do you uninstall the update?
>
> Thanks.
>
> "TaurArian" wrote:
>
> >
> >
> > "Charles Lee" <No_Spam@for.me> wrote in message
> > news:Or85iVb4IHA.4488@TK2MSFTNGP03.phx.gbl...
> > | My internet was blocked completely by the last security update....
> > | yesterday, I was fine....
> > |
> > | I have 3 pc's on a home network, all on xp...
> > |
> > | 2 of them, I let update with the latest offering from ms... the security
> > | update KB951748...
> > |
> > | then I lost all connectivy to the net via my router upon reboot, except for
> > | the pc I didn't update...
> > |
> > | pc number 2, I recovered via system restore, back to yesterday... all became
> > | fine again...
> > |
> > |
> > | with my main pc, I had not any restore points.... so had to remove the
> > | update via 'add/remove' which then killed off 2 programs after uninstalling,
> > | which I then had to reinstall.... yawn....
> > |
> > | after removing KB951748, my internet connection came back to me, like a
> > | faithful dog, no probs... phew....
> > |
> > |
> > |
> > | is there a way to install this update & adjust it so internet stays working,
> > | or....
> > | should this update be avoided altoogether...???????
> > |
> >
> >
> > If you're using ZA - you should read this -
> >
> > Zone Alarm & KB951748 Workaround:
> > http://forum.zonelabs.org/zonelabs/b...ssage.id=52727
> >
> >
> >
> > xposted to the Windows Update Newsgroup for your convenience.
> >
> >
> >
> >
> > --
> >
> > TaurArian [MVP] 2005-2009 - Update Services
> > http://taurarian.mvps.org
> > ======================================
> > How to ask a question: http://support.microsoft.com/kb/555375
> > Computer Maintenance: Acronis / Diskeeper / Paragon / Raxco
> >
> >
> >

1.. Click the Start Menu
2.. Click the Settings menu
3.. Click on Add or Remove Programs
4.. On the top of the add/remove programs dialog box, you should see a
checkbox that says "show updates". Select this checkbox
5.. Scroll down until you see "Security update for Windows (KB951748)"
6.. Click remove to uninstall the hotfix


"Kim" <Kim@discussions.microsoft.com> wrote in message
news:5588E019-2E6A-47D6-80E0-8EBD82D40DA7@microsoft.com...
> How do you uninstall the update?
>
> Thanks.
>
> "TaurArian" wrote:
>
>>
>>
>> "Charles Lee" <No_Spam@for.me> wrote in message
>> news:Or85iVb4IHA.4488@TK2MSFTNGP03.phx.gbl...
>> | My internet was blocked completely by the last security update....
>> | yesterday, I was fine....
>> |
>> | I have 3 pc's on a home network, all on xp...
>> |
>> | 2 of them, I let update with the latest offering from ms... the
>> security
>> | update KB951748...
>> |
>> | then I lost all connectivy to the net via my router upon reboot, except
>> for
>> | the pc I didn't update...
>> |
>> | pc number 2, I recovered via system restore, back to yesterday... all
>> became
>> | fine again...
>> |
>> |
>> | with my main pc, I had not any restore points.... so had to remove the
>> | update via 'add/remove' which then killed off 2 programs after
>> uninstalling,
>> | which I then had to reinstall.... yawn....
>> |
>> | after removing KB951748, my internet connection came back to me, like a
>> | faithful dog, no probs... phew....
>> |
>> |
>> |
>> | is there a way to install this update & adjust it so internet stays
>> working,
>> | or....
>> | should this update be avoided altoogether...???????
>> |
>>
>>
>> If you're using ZA - you should read this -
>>
>> Zone Alarm & KB951748 Workaround:
>> http://forum.zonelabs.org/zonelabs/b...ssage.id=52727
>>
>>
>>
>> xposted to the Windows Update Newsgroup for your convenience.
>>
>>
>>
>>
>> --
>>
>> TaurArian [MVP] 2005-2009 - Update Services
>> http://taurarian.mvps.org
>> ======================================
>> How to ask a question: http://support.microsoft.com/kb/555375
>> Computer Maintenance: Acronis / Diskeeper / Paragon / Raxco
>>
>>
>>

Another option, Charles Lee -

1. Click Start Menu
2. Click "Run"
3. Copy and Paste the below in the "Run" field:

C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst .exe

(hope that line displays okay in this post!)

4. Then restart the PC..

I believe that should do the job just fine.

===========================

"Charles Lee" wrote:

> 1.. Click the Start Menu
> 2.. Click the Settings menu
> 3.. Click on Add or Remove Programs
> 4.. On the top of the add/remove programs dialog box, you should see a
> checkbox that says "show updates". Select this checkbox
> 5.. Scroll down until you see "Security update for Windows (KB951748)"
> 6.. Click remove to uninstall the hotfix
>
>
> "Kim" <Kim@discussions.microsoft.com> wrote in message
> news:5588E019-2E6A-47D6-80E0-8EBD82D40DA7@microsoft.com...
> > How do you uninstall the update?
> >
> > Thanks.
> >
> > "TaurArian" wrote:
> >
> >>
> >>
> >> "Charles Lee" <No_Spam@for.me> wrote in message
> >> news:Or85iVb4IHA.4488@TK2MSFTNGP03.phx.gbl...
> >> | My internet was blocked completely by the last security update....
> >> | yesterday, I was fine....
> >> |
> >> | I have 3 pc's on a home network, all on xp...
> >> |
> >> | 2 of them, I let update with the latest offering from ms... the
> >> security
> >> | update KB951748...
> >> |
> >> | then I lost all connectivy to the net via my router upon reboot, except
> >> for
> >> | the pc I didn't update...
> >> |
> >> | pc number 2, I recovered via system restore, back to yesterday... all
> >> became
> >> | fine again...
> >> |
> >> |
> >> | with my main pc, I had not any restore points.... so had to remove the
> >> | update via 'add/remove' which then killed off 2 programs after
> >> uninstalling,
> >> | which I then had to reinstall.... yawn....
> >> |
> >> | after removing KB951748, my internet connection came back to me, like a
> >> | faithful dog, no probs... phew....
> >> |
> >> |
> >> |
> >> | is there a way to install this update & adjust it so internet stays
> >> working,
> >> | or....
> >> | should this update be avoided altoogether...???????
> >> |
> >>
> >>
> >> If you're using ZA - you should read this -
> >>
> >> Zone Alarm & KB951748 Workaround:
> >> http://forum.zonelabs.org/zonelabs/b...ssage.id=52727
> >>
> >>
> >>
> >> xposted to the Windows Update Newsgroup for your convenience.
> >>
> >>
> >>
> >>
> >> --
> >>
> >> TaurArian [MVP] 2005-2009 - Update Services
> >> http://taurarian.mvps.org
> >> ======================================
> >> How to ask a question: http://support.microsoft.com/kb/555375
> >> Computer Maintenance: Acronis / Diskeeper / Paragon / Raxco
> >>
> >>
> >>
>
>
>

See related conversations in this forum:
http://forum.zonelabs.org/zonelabs/board?board.id=cfg

Keep an eye on this thread:
http://forum.zonelabs.org/zonelabs/b...ssage.id=52785

Although the fix here should work:
http://forum.zonelabs.org/zonelabs/b...ssage.id=52727

I strongly disagree with this advice:
http://download.zonealarm.com/bin/fr...cessIssue.html

Perhaps a better firewall is what's needed?
http://www.matousec.com/projects/fir...ge/results.php

--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Charles Lee wrote:
> My internet was blocked completely by the last security update....
> yesterday, I was fine....
>
> I have 3 pc's on a home network, all on xp...
>
> 2 of them, I let update with the latest offering from ms... the security
> update KB951748...
>
> then I lost all connectivy to the net via my router upon reboot, except
> for
> the pc I didn't update...
>
> pc number 2, I recovered via system restore, back to yesterday... all
> became
> fine again...
>
>
> with my main pc, I had not any restore points.... so had to remove the
> update via 'add/remove' which then killed off 2 programs after
> uninstalling,
> which I then had to reinstall.... yawn....
>
> after removing KB951748, my internet connection came back to me, like a
> faithful dog, no probs... phew....
>
>
>
> is there a way to install this update & adjust it so internet stays
> working,
> or....
> should this update be avoided altoogether...???????

That's weird. The posted link for the ZA "bulletin" contained the option to
change your setting from "high" to "medium." That's what I did at first,
until I saw this posting from the Zone Alarm Forum Moderator:

"We have been working with MS over night on the issue. We are very confident
a fix will be released soon. As far as how that is distributed either a patch
from MS or in the form of a new build from ZA has not been determined.

We will notify all users of a fix when its ready at the top of the forum in
the main announcements section.

We also still stand by our current workaround that you should uninstall the
MS update KB951748 and do not set your ZA internet security level to Medium.
By setting to Medium you potential expose your computers to a huge number of
other threats than just the one that this patch from MS fixes.

Forum Moderator"

Well, I guess we're all in advice overload, but at least the powers-that-be
at ZA and Microsoft are working on this. I went the "uninstall KB951748"
route and put all of our ZA settings back on high. I did the same steps that
"Charles Lee" recommended for the uninstall, although "Roger Overunder's" way
seems much faster. Either way, "Kim", you should be up and running once the
uninstall is complete. Make sure to reboot! )

So far, so good for all of our PCs...

BTW, there's a lot of chatter on the ZA message boards about multiple patch
releases today for this problem from a number of companies. Apparently this
patch has been in the works for some time, and all fixes were launched the
same day (yesterday). Wonder what's going on?...


"Mark Dyson" wrote:

> http://download.zonealarm.com/bin/fr...cessIssue.html
>
>
> "Kim" wrote:
>
> > How do you uninstall the update?
> >
> > Thanks.
> >
> > "TaurArian" wrote:
> >
> > >
> > >
> > > "Charles Lee" <No_Spam@for.me> wrote in message
> > > news:Or85iVb4IHA.4488@TK2MSFTNGP03.phx.gbl...
> > > | My internet was blocked completely by the last security update....
> > > | yesterday, I was fine....
> > > |
> > > | I have 3 pc's on a home network, all on xp...
> > > |
> > > | 2 of them, I let update with the latest offering from ms... the security
> > > | update KB951748...
> > > |
> > > | then I lost all connectivy to the net via my router upon reboot, except for
> > > | the pc I didn't update...
> > > |
> > > | pc number 2, I recovered via system restore, back to yesterday... all became
> > > | fine again...
> > > |
> > > |
> > > | with my main pc, I had not any restore points.... so had to remove the
> > > | update via 'add/remove' which then killed off 2 programs after uninstalling,
> > > | which I then had to reinstall.... yawn....
> > > |
> > > | after removing KB951748, my internet connection came back to me, like a
> > > | faithful dog, no probs... phew....
> > > |
> > > |
> > > |
> > > | is there a way to install this update & adjust it so internet stays working,
> > > | or....
> > > | should this update be avoided altoogether...???????
> > > |
> > >
> > >
> > > If you're using ZA - you should read this -
> > >
> > > Zone Alarm & KB951748 Workaround:
> > > http://forum.zonelabs.org/zonelabs/b...ssage.id=52727
> > >
> > >
> > >
> > > xposted to the Windows Update Newsgroup for your convenience.
> > >
> > >
> > >
> > >
> > > --
> > >
> > > TaurArian [MVP] 2005-2009 - Update Services
> > > http://taurarian.mvps.org
> > > ======================================
> > > How to ask a question: http://support.microsoft.com/kb/555375
> > > Computer Maintenance: Acronis / Diskeeper / Paragon / Raxco
> > >
> > >
> > >

Thanks Roger but I'm not the one with the problem. I was cross posting Charles Lee's post.
Personally I wouldn't use ZA.

--

TaurArian [MVP] 2005-2009 - Update Services
http://taurarian.mvps.org
======================================
How to ask a question: http://support.microsoft.com/kb/555375
Computer Maintenance: Acronis / Diskeeper / Paragon / Raxco


"Roger Overunder" <RogerOverunder@discussions.microsoft.com> wrote in message
news:7EA22EF4-6539-4727-B4F5-0BCC57511AFC@microsoft.com...
| "TaurArian" wrote:
|
| > | is there a way to install this update & adjust it so internet stays working,
| > | or....
| > | should this update be avoided altoogether...???????
| > |
|
| If you're not quite up to do the suggested work around, TaurArian, you can
| set ZoneAlarm to "Medium" security instead of "High". You should be able to
| connect okay on Medium.
|
| Or you can leave KB951748 uninstalled, keep the ZoneAlarm High settings and
| wait for a patch, fix or update to be issued for this bug.
|
| best wishes.
|
| >
| > If you're using ZA - you should read this -
| >
| > Zone Alarm & KB951748 Workaround:
| > http://forum.zonelabs.org/zonelabs/b...ssage.id=52727
| >
| >
| >
| > xposted to the Windows Update Newsgroup for your convenience.
| >
| >
| >
| >
| > --
| >
| > TaurArian [MVP] 2005-2009 - Update Services
| > http://taurarian.mvps.org
| > ======================================
| > How to ask a question: http://support.microsoft.com/kb/555375
| > Computer Maintenance: Acronis / Diskeeper / Paragon / Raxco
| >
| >
| >

FWIW, I did the update on one computer without problems. The other computer,
however, was fubar'd. Of course, both computers are running zone alarm suite
and XP SP3. So I'm not sure why one went kaput while the other is going
strong.

Victoria V asked how to remove the little yellow shield that keeps telling
you to install updates.

This is how I did it. First, I went to Start --> Run --> (then typed in)
services.msc --> hit OK, double clicked on "Automatic Updates", clicked on
Stop. Then, for good measure, I went to Start --> Control Panel --> double
clicked on automatic Updates and set t to "Notify me but don't automatically
download or install them".

Then, I went to Start --> Run --> (then typed in)
%windir%\SoftwareDistribution --> hit OK. I first opened the Download folder
and deleted everything in it. This didn't seem to do the trick, so I then
went through every folder in this subdirectory and deleted any file that was
modified on the date that the faulty update was downloaded (July 9, 2008 for
me). Once every file was deleted, I emptied the recycle bin and rebooted the
computer.

Voila! no more small yellow shield. I actually did this whole process a few
times as I was going on the idea that the download had been corrupted. This
is the method I have used in the past to delete the stored download of a MS
patch so I can re-download it. But now I realize it was not necessarily a
corruption during the download but an overall bug in the patch.

"Victoria V." wrote:

> Absolutely!! I'm not going to use auto-update EVER again!! What a mess.
> I've spent the last 6+ hours on this fiasco. Anyway, All machines are
> working just fine...Just wanted to pass along a note for all those who are
> using Zone Alarm.
>
> ZA says NOT to reduce your Internet Zone Security to "medium." The gurus on
> their message boards say to leave the setting on "high" (to avoid other nasty
> buggers), and to go into your Control Panel, select Add/Remove Programs (make
> sure to have "show updates" checked), and remove/uninstall the offending
> update. You'll have to reboot (make sure your ZA is set on high just to be
> safe before you do this), and you should be all set once your system has
> rebooted. The nasty yellow shield shows up at the bottom of your screen, but
> at least your internet connections work again.
>
> If anyone knows how to get rid of the yellow shield, I'd love to know. I've
> already killed half of my day fixing this mess, might as well blow off the
> rest of the day!!! )
>
>
>
> "Roger Overunder" wrote:
>
> > "Victoria V." wrote:
> > I thought I'd awakened this morning to the computer Twilight
> > Zone!!"
> >
> > Yeah, not the best way to start one's morn! Even if you're a Rod Serling
> > fan!
> >
> >
> > "I also went in and changed the update settings on all of the machines to
> > download updates, but not to automatically load them. [I'll do it.]"
> >
> > I think that's the only way to go.
> >
> > Even better is to go the Update page when you get update notice and do the
> > downloading from there 'cause you can get a better idea of what's what & see
> > your download history, including the ones you just downloaded. That way you
> > know the names of the little guys you just downloaded and have an idea of
> > which one might be the culprit in a similiar situation.
> >
> >