939653 Causes IE7 Crash in ntdll

[Frank Haber]

IE7 on XPSP2 pro crashes out on web pages of any complexity after 939653 was
installed. Couldn't find anything much like this on the web or in 7000
messages here. Note this is one of *last* month's updates.

1. I do use 16-bit programs, but none were runing at the time

2. Yah, I know virut throws ntdll mesages, but

a. this system has been and is running crisply, Firefox and Opera just sing,
etc.
b.I have a quiet cablemodem connection, and nothing untoward is going out.
While I'm watching, that is (g).
c. I've scanned with three antispy programs, two in safe mode.
d. I've used Panda's and Kaspersky's online scans, and Panda's antirootkit.
Nothing found.
e. I see no untoward BHOs or LSPs. Procexp shows only my usual stuff, with
nothing unsigned other than what MS forgot to sign.
f. I got no "cannot display this page" errors, just IE crashes.
g. Uninstalling the update fixed things instantly.

Some of the entries in applog involve IE6 (!). I don't think I have any
alternate IE shells around. Suggestions?

Sample errmsgs:

======
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 11/9/2007
Time: 2:06:20 PM
User: N/A
Computer: [elided]
Description:
Faulting application iexplore.exe, version 7.0.6000.16544, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00002f17.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 65 78 ure iex
0018: 70 6c 6f 72 65 2e 65 78 plore.ex
0020: 65 20 37 2e 30 2e 36 30 e 7.0.60
0028: 30 30 2e 31 36 35 34 34 00.16544
0030: 20 69 6e 20 6e 74 64 6c in ntdl
0038: 6c 2e 64 6c 6c 20 35 2e l.dll 5.
0040: 31 2e 32 36 30 30 2e 32 1.2600.2
0048: 31 38 30 20 61 74 20 6f 180 at o
0050: 66 66 73 65 74 20 30 30 ffset 00
0058: 30 30 32 66 31 37 0d 0a 002f17..

------
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 11/9/2007
Time: 2:07:51 PM
User: N/A
Computer: [elided]
Description:
Faulting application explorer.exe, version 6.0.2900.3156, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00002f17.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 33 31 35 36 20 00.3156
0030: 69 6e 20 6e 74 64 6c 6c in ntdll
0038: 2e 64 6c 6c 20 35 2e 31 .dll 5.1
0040: 2e 32 36 30 30 2e 32 31 .2600.21
0048: 38 30 20 61 74 20 6f 66 80 at of
0050: 66 73 65 74 20 30 30 30 fset 000
0058: 30 32 66 31 37 0d 0a 02f17..

 

[PA Bear]

Please cite a few URL's that crash IE7.

Does the behavior persist if you uninstall 939563?
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.org/


Frank Haber wrote:
> IE7 on XPSP2 pro crashes out on web pages of any complexity after 939653
> was
> installed. Couldn't find anything much like this on the web or in 7000
> messages here. Note this is one of *last* month's updates.
>
> 1. I do use 16-bit programs, but none were runing at the time
>
> 2. Yah, I know virut throws ntdll mesages, but
>
> a. this system has been and is running crisply, Firefox and Opera just
> sing,
> etc.
> b.I have a quiet cablemodem connection, and nothing untoward is going out.
> While I'm watching, that is (g).
> c. I've scanned with three antispy programs, two in safe mode.
> d. I've used Panda's and Kaspersky's online scans, and Panda's
> antirootkit.
> Nothing found.
> e. I see no untoward BHOs or LSPs. Procexp shows only my usual stuff,
> with
> nothing unsigned other than what MS forgot to sign.
> f. I got no "cannot display this page" errors, just IE crashes.
> g. Uninstalling the update fixed things instantly.
>
> Some of the entries in applog involve IE6 (!). I don't think I have any
> alternate IE shells around. Suggestions?
>
> Sample errmsgs:
>
> ======
> Event Type: Error
> Event Source: Application Error
> Event Category: None
> Event ID: 1000
> Date: 11/9/2007
> Time: 2:06:20 PM
> User: N/A
> Computer: [elided]
> Description:
> Faulting application iexplore.exe, version 7.0.6000.16544, faulting module
> ntdll.dll, version 5.1.2600.2180, fault address 0x00002f17.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 70 70 6c 69 63 61 74 Applicat
> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> 0010: 75 72 65 20 20 69 65 78 ure iex
> 0018: 70 6c 6f 72 65 2e 65 78 plore.ex
> 0020: 65 20 37 2e 30 2e 36 30 e 7.0.60
> 0028: 30 30 2e 31 36 35 34 34 00.16544
> 0030: 20 69 6e 20 6e 74 64 6c in ntdl
> 0038: 6c 2e 64 6c 6c 20 35 2e l.dll 5.
> 0040: 31 2e 32 36 30 30 2e 32 1.2600.2
> 0048: 31 38 30 20 61 74 20 6f 180 at o
> 0050: 66 66 73 65 74 20 30 30 ffset 00
> 0058: 30 30 32 66 31 37 0d 0a 002f17..
>
> ------
> Event Type: Error
> Event Source: Application Error
> Event Category: None
> Event ID: 1000
> Date: 11/9/2007
> Time: 2:07:51 PM
> User: N/A
> Computer: [elided]
> Description:
> Faulting application explorer.exe, version 6.0.2900.3156, faulting module
> ntdll.dll, version 5.1.2600.2180, fault address 0x00002f17.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 70 70 6c 69 63 61 74 Applicat
> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> 0010: 75 72 65 20 20 65 78 70 ure exp
> 0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
> 0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
> 0028: 30 30 2e 33 31 35 36 20 00.3156
> 0030: 69 6e 20 6e 74 64 6c 6c in ntdll
> 0038: 2e 64 6c 6c 20 35 2e 31 .dll 5.1
> 0040: 2e 32 36 30 30 2e 32 31 .2600.21
> 0048: 38 30 20 61 74 20 6f 66 80 at of
> 0050: 66 73 65 74 20 30 30 30 fset 000
> 0058: 30 32 66 31 37 0d 0a 02f17..

 

[Ottmar Freudenberger]

"Frank Haber" <frhaber@N0SPAMrcn.com> schrieb:

> IE7 on XPSP2 pro crashes out on web pages of any complexity after 939653 was
> installed.

Could you please provide some URLs which "crash" IE7 on your machine
constantly?

Have you tried starting IE7 without any AddOn loaded?
Start -> Run -> iexplore.exe -extoff

Bye,
Freudi

 

[Frank Haber]

As I've said, backing out that update fixed things. That's where I stand now.

When the update was installed, anything with complex 3rd-party referral links
would crash IE in a few seconds. It was hard to test.

I was hoping this had been seen before - guess not.

Admittedly, several other machines here are happy with 939653. When I get
time, I guess I'll repatch and test.

 

[PA Bear]

Suit yourself and continue running a vulnerable version of IE7.
--
~PA Bear

Frank Haber wrote:
> As I've said, backing out that update fixed things. That's where I stand
> now.
> When the update was installed, anything with complex 3rd-party referral
> links would crash IE in a few seconds. It was hard to test.
>
> I was hoping this had been seen before - guess not.
>
> Admittedly, several other machines here are happy with 939653. When I get
> time, I guess I'll repatch and test.

 

[Ottmar Freudenberger]

"Frank Haber" <frhaber@N0SPAMrcn.com> schrieb:

> As I've said, backing out that update fixed things. That's where I stand now.

And the security holes closed by KB939653 are still open. You should
apply KB939653 ASAP.

> When the update was installed, anything with complex 3rd-party referral links
> would crash IE in a few seconds. It was hard to test.

Without further infos from your side, nobody will be able to help you
in resolving the issue. Make sure, you've at least shut down completely
*any* applications running in the background while installing updates
and have Windows Firewall enabled.

Bye,
Freudi

 

[Frank Haber]

Thanks for your concern, everyone.

Most peculiar. After using the computer daily with no problems, and a
successful November WU, I did a backup, then cleaned cache and index.dat. It
was time to bite the bullet.

1. WU insisted on testing me again with September's WGA thingy. This is Dell's
XP Pro, regularly updated exept for the above trouble. Multiple WGAs on a
tatooed machine? Sheesh.

2. I reselected 939653, leaving Office 2003 SP3 hidden. Everything went
flawlessly, and continued copacetic after the reboot.

Hey, it's Windows. Think anyone would want a copy of WindowsUpdate.log? (I
can't see anything untoward in it.)

-Frank

 

[Ottmar Freudenberger]

"Frank Haber" <frhaber@N0SPAMrcn.com> schrieb:

> 1. WU insisted on testing me again with September's WGA thingy.

Nope, there has been a new version of KB892130 released on November 15th.

> 2. I reselected 939653, leaving Office 2003 SP3 hidden. Everything went
> flawlessly, and continued copacetic after the reboot.

Ehm, fine but strange. Have you tried installing SP3 for Office 2003 in
the meantime?

Bye,
Freudi

 

[Frank Haber]

> Have you tried [re]installing SP3 for Office 2003?

Nope. Need the oldformat import. Not installing is easier than a series of
lumpen reg-hacks.

(I'm not a truculent guy, really. Just careful. Thanks for your help.)

 

[Ottmar Freudenberger]

"Frank Haber" <frhaber@N0SPAMrcn.com> schrieb:

>> Have you tried [re]installing SP3 for Office 2003?
>
> Nope. Need the oldformat import.

Pardon?

> Not installing is easier than a series of lumpen reg-hacks.

Hm, ...

Bye,
Freudi

 

[Frank Haber]

>> Nope. Need the oldformat import.

>Pardon?

SP3 for Office 03 disables the open of many older binary wp and spreadsheet
formats for security reasons. You can patch around that, but it's a pain.

 

[Ottmar Freudenberger]

"Frank Haber" <frhaber@N0SPAMrcn.com> schrieb:

> SP3 for Office 03 disables the open of many older binary wp and spreadsheet
> formats for security reasons. You can patch around that, but it's a pain.

You mean Works files? Does
http://www.microsoft.com/downloads/details.aspx?FamilyID=bf41401e-70fa-465d-ae2e-cf44dbf05297
don't fit your needs?

Bye,
Freudi

 

[Frank Haber]

>You mean Works files? Does
http://www.microsoft.com/downloads/details.aspx?FamilyID=bf41401e-70fa-465d-ae2e-cf44dbf05297
don't fit your needs?

Not exactly. I regularly need import of Word 6 through 11 binary files, and
Excel 4 through latest, plus Macintosh, plus some WordPerfect files, plus
WordStar, which was removed from the converter in the Office XP timeframe.

Q: How did God create the world in 6 days?
A: No installed base