Bad MS update Dec 10

[Peru]

The KB 3004394 update that was dated December 10, 2014 can cause additional problems on computers that are running Windows 7 Service Pack 1 (SP1) and Windows Server 2008 R2 SP1. This includes the inability to install future updates.

See here to download the fix:

http://support.microsoft.com/kb/3024777

[Bob]

But, read this first.

[George Tyndall]

But, read this first.

Somehow the idea of Microsoft releasing a Silver Bullet patch that's solely devoted to killing another Microsoft-released patch makes me uneasy.--Woody

Make that very uneasy.

[George Tyndall]

But, read this first.

Hi Bob,

I just found the following -- I've highlighted the portions for your comment, when you have time:

The moral of the story is this: Return to your main Windows Update area and change your settings from “Install updates automatically” to “Check for updates but let me choose whether to download and install them.”

See, Microsoft has a bit of a spotty track record with Windows Updates, and this isn’t the first one to cripple systems. My recommendation is to install system updates about two weeks after they’ve been released, allowing enough time for any potential problems to be identified by users, reported on by the press, and fixed by Microsoft.

I have to close this with a frighteningly accurate observation from InfoWorld about this situation: “Microsoft has the all-time best Windows malware delivery system.” They’re right. The definition of Malware is “any software used to disrupt computer operation.”


UPDATE: Several readers have pointed out that disabling automatic Windows Updates is bad advice, and while that’s a fair argument I have to disagree. There have been no less than 3 occurrences in the last 3 years where Microsoft has issued software and firmware updates to their Xbox platform which have “bricked” — or rendered useless — the consoles. And Windows update that have bricked PCs? There’s this example from August 2014. Or this example from April 2013 which caused widespread BSODs (Blue Screens of Death.) Or this example which rendered Surface 2 Windows tablets unusable. And here’s a more comprehensive list of issues that Windows Update caused from just last year. -- Source: http://www.forbes.com/sites/jasonevangelho/2014/12/13/new-windows-7-patch-is-effectively-malware-disables-graphics-driver-updates-and-windows-defender/

Thank you.

[George Tyndall]

The KB 3004394 update that was dated December 10, 2014 can cause additional problems on computers that are running Windows 7 Service Pack 1 (SP1) and Windows Server 2008 R2 SP1. This includes the inability to install future updates.

See here to download the fix:

http://support.microsoft.com/kb/3024777

Thanks for that, Peru.

Please see my reply to Bob, wherein the quotation recommends simply removing the offending file. I'm awaiting Bob's reply before taking any action.

Do you have an opinion re waiting 2 weeks to install?

Thank you.

[Bob]

“Check for updates but let me choose whether to download and install them” is my standard practice. But, if you are going to use that option, you also need to have the discipline to monitor the updates and apply them when appropriate. I think it is a very bad idea to turn off Windows Update entirely and never receive notifications. But, it is equally as bad to ignore updates and seldom apply them. The problem is knowing when to apply them.

The article you cited mentioned updating two weeks after the patches have been released "allowing enough time for any potential problems to be identified by users, reported on by the press, and fixed by Microsoft". It doesn't quite work that way. That's certainly enough time for problems to be identified and reported, but it isn't necessarily enough time for Microsoft to find a fix or decide on a course of action. It is possible that Microsoft will pull or reissue an update during that timeframe, so that is a bit safer than applying patches immediately. But, it isn't unusual for it to take longer for that to happen. You still have a possibility of getting burned by a bad patch. If you can, I'd recommend checking to see if there are any outstanding problem patches before installing and manually deselect those if necessary. One site that you can check that isn't too overly technical is askwoody.com. He usually does a good job of reporting problem patches. If you check a day or two before scheduled patch days, he may give a recommendation as to whether to go ahead and apply outstanding patches prior to the release of the new patches or to hold off.

Microsoft normally releases updates on the 2nd and 4th Tuesdays of each month. The 2nd Tuesday has traditionally been the main release date and is known as Patch Tuesday. But, over time, the 4th Tuesday has become just as likely to contain significant patches. Microsoft has also been known to release especially critical patches without waiting for the 2nd or 4th Tuesday.

One thing to keep in mind. If you delay applying a security patch, you are exposing yourself to increased risk. The day after Patch Tuesday is often referred to as Exploit Wednesday because of the increased activity of hackers attempting to exploit unpatched PCs. Be sure you have and use current antivirus/antimalware software.

[George Tyndall]

“Check for updates but let me choose whether to download and install them” is my standard practice.

Mine, too.

However, the missing piece was how to know whether they are safe to install -- until, that is, you provided that exceedingly informative post.

One question: How does Woody know in advance which patches will be coming out on Tuesdays and which are safe to install?

Thank you.

[Bob]

Microsoft provides information for IT professionals including an advanced notification service for security updates, and a variety of summaries, and blogs. I would expect that some of his information for upcoming patches comes from there. He has a lot of experience covering Windows news and developments -- he is Senior Editor at Windows Secrets Newsletter and Senior Contributing Editor at InfoWorld. I would say he's very well positioned to get tips and reports of problems and issues from a variety of sources.

[_Paz_]

Thanks again for such valuable information, Bob. I've just changed my settings to "Download updates but let me choose whether to install them."

[George Tyndall]

One thing to keep in mind. If you delay applying a security patch, you are exposing yourself to increased risk. The day after Patch Tuesday is often referred to as Exploit Wednesday because of the increased activity of hackers attempting to exploit unpatched PCs. Be sure you have and use current antivirus/antimalware software.

Hmmm.

The last time I downloaded Windows updates was 11/12.

Those on the attached image I noticed just yesterday -- and the list contains neither the errant KB3004394 nor the fix KB3024777.

I've checked Ask Woody, and I don't see any of the attached on his list, so I'm assuming that, as Rachel Ray would say, "I'm "good to go."

Bob Windows Updates.JPG

[Bob]

Probably, but the last Patch Tuesday was just a week ago. You might want to wait until the end of the week and see if anything new surfaces.

[Bob]

Just saw that the IE 11 cumulative security patch (KB 3008923) has a problem. That one is listed in the screen capture you posted. Microsoft released a patch today (KB 3025930) to fix it, but it hasn't shown up in Windows Update yet.

[George Tyndall]

Just saw that the IE 11 cumulative security patch (KB 3008923) has a problem.

I've followed your recommendation and not yet updated Windows; also, I never open my browser nor run any other updates (Adobe, Java, etc.) until NIS has finished updating.

BTW, speaking of NIS, do you recommend running the "1-step optimization" window that pops up every so often, in addition to running Smart Updates?

It's asking me to make change to my registry "to improve performance," however, I am reluctant to do so, as I'm very satisfied with the present performance of my system.

Did you learn of the problem with (KB 3008923) on woody's site?

Thank you.

[Bob]

I've never seen a "1-step optimization" window popup with NIS. The only "1-step optimization" that I'm aware of was part of Norton utilities and Norton Antivirus which are different products. It may be in Norton 360 also. You don't have one of those do you?

NIS does have an optimization feature in NIS called the Idle Time Optimizer (also known as Insight Optimizer). All of these optimizers basically check the boot drive fragmentation and invoke the Windows defragger if over a threshold. Useful if you are on Windows XP, not so much if you are on Windows 7 or higher. You definitely don't want to invoke the defragger if the boot drive is an SSD. The Idle Time Optimizer can be turned off. In NIS, from the home panel, click settings -> general -> Norton Tasks -> slide idle time optimizer bar to off. Then, go to the bottom of the panel and click "apply".

I'd skip the "1-step optimization". I've never seen NIS ask anything about changing registry entries either. I wouldn't do it.

Yes, I saw the patch report on Woody's site.

[George Tyndall]

The only "1-step optimization" that I'm aware of was part of Norton utilities .... I'd skip the "1-step optimization". I've never seen NIS ask anything about changing registry entries either. I wouldn't do it.

Yes, it is part of Norton Utilities, which came with NIS when I renewed the latter.

I've never used it. Should I uninstall it?

Thank you.