6-1-2006:

Added instructions on how to install MS01-059 UPnP security fix on Win98/98SE even without WinXP ICS client.

HTH

well there is no point in installing the MS01-059 UPnP update for Win98 w/out the XP ICS Client. It's useless without the client software. the XP SP1 & SP2 versions of the XP ICS Client EXE package [netsetup.exe] do include the updated files from the MS01-059 update for Win98 though they are dated newer than the ones found in MS01-059.

MDGx,

What the ICS Client is. It's something most of w98 users don't use, right?

On your site, it's unclear what is already included in the last uSP. Or "Already installed!" means that?
I think you should add a uSP logo or something...but that's a lot of work.

Fredledingue:

ICS = Internet Connection Sharing
More info:
http://www.dewassoc.com/support/networking/ics_1.htm
http://www.homenethelp.com/ics/
ICS in Win98 SE:
http://support.microsoft.com/?id=234815
ICS in WinXP:
http://support.microsoft.com/?id=310563

Yes, some Win98SE users (still) use ICS, as far as I know.
IMHO:
To me it doesn't matter how many people use ICS, all it matters is that everybody should be able to install and use it, as long as it's available.

Although erpdude8 has a good point:
UPnP may not be available to Win98 SE users without WinXP ICS installed.
I'm going to research more on this.

About uSP [I presume you are referring to Gape's SP2] logo...
The updates/patches/fixes I post at my site are not related to Gape's SP2. They are just individual updates which [usually] fix only 1 bug, the way MS posted them.
When I say something like "requires x already installed", I refer to a system component without which a particular update/patch/fix doesn't work/install/etc.

And you're right, to add an SP2 logo [and/or state which ones are included in SP2] to all related updates at my site would take a very long time, and unfortunately I don't have that much time to spare.

HTH

MDGx,

Thanks for the infos on ICS. In fact, as soon as you own two computer it's wise to run this patch just in case one day you decide to share the conection.

About your site,

I refered to the "Already Installed!" notes that we can seen from time to time on your lists of upgrade...
What does it mean?

I occasionally use ICS depending on configuration. For example, I may have a "sateliite" operation going which is wireless to a laptop containing support files for an install on a nearby machine. The nearby machine is net-wired to the laptop [with a cross-over cable] to obtain files across the baby network between them, etc. If I enable ICS in the laptop, the other machine gets an IP address and Internet access, etc.

Please note a few misconceptions about ICS and UPnP:

1) Despite claims to the contrary, UPnP is NOT required for ICS support, even from XP, which yells the loudest about it. ICS even in XP will assign an IP address to the client machine just like your router, whether it uses UPnP or not (I have used both kinds).

The ONLY actual difference between XP's version of ICS and the 98SE and Win2K and ME version is the strong "recommendation" for the UPnP. They are operationally the same.

2) UPnP is native only to ME and XP. In all relevant systems there are gaping security holes fixed by the same update with separate binaries for ME, XP, and also for 98/98SE. There are generally two updates, but the second one obsoletes the first one. XP SP2 doesn't need the update applied. [Dunno about XP SP1, but earlier clearly needs it.]

3) UPnP can optionally be added to 98 and 98SE using a utility most easily obtained from the XP setup CD. When you first run XP's ICS wizard, it enables you to have a diskette containing netsetup.exe obtained directly from the XP CD. I have heard claims this is also downloadable from some MS site [or was]. Using netsetup.exe, you will get essentially the ME version added onto 98 or 98SE, as well as a shared folder forced upon you inside of your My Documents folder I think called Shared Files [or something like that]. You can undo the sharing of that particular folder if you wish after the fact, and/or enable any form of other sharing you wish, etc.

4) If you DO use UPnP, AND you have either a UPnP-aware router to connect the 98/98SE machine to, or are connected to XP using ICS, or perhaps some other UPnP device, you can notice it and interact with it in some ways, just as you can in ME or XP.

For example, in XP, ME, or upgraded 98/98SE, I can see my UPnP-enabled router and notice a system tray icon showing some activity. In some cases, it can also proclaim to see a device designated as a "residential gateway" which again is the router. Right click on the icon and check status and you can find out a surprising amount of info about your router from the 98/98SE version, even though the specific verbiage differs from the other implementations.

Additionally, certain applications are UPnP aware and can better access Internet ports more automatically, such as recent versions of LimeWire, which apparently find the "holes" you created in your router's firewall for the purpose. Without UPnP you have to manually configure. [Note: You still have to manually do the "port forwarding" and/or "port triggering" in your router since by default these "holes" are plugged, but this is beyond the scope of this, etc.] My 98SE system UPnP status reveals them directly!

The connection icon is sorta like the dial-up connection icon in appearance, but a whole lot different in terms of what it can tell you. But if you aren't connected to any UPnP other device, you don't have a use for it and the icon won't appear. But since it IS PnP, when you connect the machine to something else doing UPnP, the icon will appear.

cjl

The UPnP security patches for Win98se, ME & XP were released in December 2001 so the upnp security fixes ARE included in XP SP1/SP1a and SP2. note that UPNP is NOT included in Win2000.

It means that...
HTH

Ha! You are right. It must be my mind that needs debugging!

heh, no kidding
someday you'll get it



note to the_guy and MDGx: There are problems that come up after installing the KB911567 updates whether official or unofficial. Outlook Express users may have problems opening WAB [Windows Address Book] files after applying the KB911567 update for OE. Problem is noted in Microsoft KB article 917288:
http://support.microsoft.com/kb/917288
MDGx should list the side effect of what KB911567 does to Outlook Express on his IE page.

AND the problem with KB911567 is also mentioned on the Askwoody.com web site [hmm, does that Woody guy hate MS or something?]

Bad news, guys...
http://news.com.com/2100-1002_3-6082307.html

Micro$oft will •not• fix the MS06-015 [Q908531] shell32.dll critical security vulnerability:
http://www.microsoft.com/technet/security/...n/ms06-015.mspx
found in all Windows 98 + ME OSes.
They blame this decision on having to rewrite a huge amount of code [?], and that as a consequence they can't be sure if some apps would still work [or not] afterwards.

They also recommend that all users should install + use a firewall which should be configured to protect port 139 TCP [NetBios].

FYI:
no comments

Yes, the original message is here: http://blogs.technet.com/msrc/archive/2006/06/09/434300.aspx

It is strange - at first Microsoft promissed to fix all critical security flaws, then it failed to do it.

Petr

coming late to the problem but afaik, you can shut this permanently with the 'network bondage' trick

http://www.grc.com/su-bondage.htm
http://www.grc.com/su-rebinding9x.htm

any help ?

Can be shut down also by doing this:
http://www.mdgx.com/newtip19.htm#INS

HTH

What, pray tell, Petr, is so strange about that? MS doesn't have a good track record it that department anyways.

Thanks, by far the most easy, fast and elegant way to do (and undo!) this.

By Disabling this NetBios is it still possible to connect to other computers/networks in a lan?

I can't experiment this, because I do not connect to a LAN.

Please try this [backup 1st] to make sure it works properly on your computer(s).
If it doesn't, please restore your registry keys and all files.
Thanks.

No it disable all computers on a network.

as that Woody guy would say, "Trustworthy Computing" - see his article about MS06-015 not being offered for Win98/ME:
http://www.askwoody.com/newscomments.php?newsid=492

i agree epdude ms wont fix flaws because why fix a os their not making money off of anymore.shamefull because their just get hounded 2 fix it reguardless.

Because we could sue Microsoft because they claimed that there will be an update and know there isn't.
It was so clear that they won't make a patch but they didn't even try.
The good thing is that Microsoft couldn't downgrade the security rating from critical to not critical now(like they did often).^^
They can only say it's too dificult..., there are incompatibilities,.... lazy M$ .

Patch Tuesday again
http://www.microsoft.com/technet/security/...n/ms06-jun.mspx

And the surprise there should be 5 updates for Win98/ME .
The bigger surprise is the wmf security issue gets patched :
http://www.microsoft.com/technet/security/...n/ms06-026.mspx

One more resident s**ker?? They're surely lost 9x code.

YUP. they surely lost the darn 9x code. HAHAHAHA!



heh, DONT waste your time trying to actually sue M$ just to make 'em patch 9x systems now, winxpi. you'll just get into even more trouble.

Note that the new W98/ME updates are NOT yet posted at Windows Update today. Wait until Wednesday noon or afternoon for them to be posted at WU.

New WMP 9/10 security update [917734]:
http://www.microsoft.com/technet/security/...n/MS06-024.mspx

I don't think they lost any code, they're just too lazy to make patches for 9x OSes.
They probably fired/layed off/reprofiled/etc all 9x OS developers/maintainers/support staff, they only need NTx people now.
Why would they keep them, they don't make any money from 9x OSes.
And they can't wait for July 11 to arrive, so they can ditch 98/ME support altogether.

Just checked WU + WUC... no 98/ME updates posted yet.
I'll try again tomorrow [thanks erpdude8].

Petr:

MS posted these fixes:
- Slovenian:
http://www.microsoft.com/downloads/details...&displaylang=sl
- Slovakian:
http://www.microsoft.com/downloads/details...&displaylang=sk
- Thai:
http://www.microsoft.com/downloads/details...&displaylang=th
for the MS06-026 GRE WMF issue:
http://www.microsoft.com/technet/security/...n/ms06-026.mspx
instead of patching gdi32.dll/gdi.exe [?].
These 2 files [Q918547.DLL + KB918547.EXE] are identical with the ones from the English fix because internal language properties box displays English.
The catch is that these 2 files are only residents [TSRs], just like Q891711.

5 updates for win98 on windowsupdate have arrived! (including a wmp9 update). Nice surprise I think, unexpected. To bad for the extra TSR (again...) but its better than nothing.

Urlmon.dll version is updated to 6.0.2800.1550. Winupdate still works on my system, hope this will be the same for other activeX apps.

All June 2006 Security Vulnerability Fixes now posted at WU + WUC.

New URLMON.DLL works properly with WU/WUC/OU, no need for URLMONFX anymore.

Bad news, the GRE WMF fix is made of 2 TSRs, similar to Q891711, actual GDI32.DLL/GDI.EXE *not* patched.

So do we need this file KB918547.EXE cuz i installed it and i get the red x in qfe

when you say "red x" in Qfe, do you mean Qfecheck? Does Qfecheck report those two files Not found?

here's the problem with the KB918547.inf file I found in these two lines:

--
HKLM,%UpdateKey%\%SPKey%\%LocaleID%%UpdID%,%10%\KB918547\KB918547.EXE,,"4.10.0.2224"
HKLM,%UpdateKey%\%SPKey%\%LocaleID%%UpdID%,%10%\KB918547\Q918547.dll,,"4.10.0.2224"
--

they should be the following:

--
HKLM,%UpdateKey%\%SPKey%\%LocaleID%%UpdID%,%11%\KB918547\KB918547.EXE,,"4.10.0.2224"
HKLM,%UpdateKey%\%SPKey%\%LocaleID%%UpdID%,%11%\KB918547\Q918547.dll,,"4.10.0.2224"
--

%10% should be %11% [%10% goes to Windows folder while %11% points to \Windows\System\ folder]
I'll make and INF file that will correct this registry blunder by MS.



ARE you ABSOLUTELY sure the updated URLMON.DLL file from MS06-021 works with WU & OU? Urlmon.dll file I'm using is version 6.00.2800.1551 [the RTMQFE version].

yes it QFE with the red x

Taken from my edited quote below MDGx's in the first page of this thread.




Open Registry Editor [regedit.exe] and look for the KB918547 entries-

KB918547.EXE,,"4.10.0.2224
Q918547.dll,,"4.10.0.2224

I suspect the String variable was called \WINDOWS\KB918547\ for both of those files.
Change \WINDOWS\KB918547\ to \WINDOWS\SYSTEM\KB918547\ and close registry editor. Now QFEcheck should correctly report the two files.

The WinME version of KB918547 does NOT have the QFECheck problem because they reference the updated files at the correct folder.

I'll wait to you or MDGx correct the problem i'm in no rush
thanks

yea M$ screwed up the KB918547 QFECheck registry info for the Win98 version of KB918547. WinME's KB918547 patch is ok. Good thing somebody like me has to fix their mistake.



then I'd suggest installing both the unofficial KB912919 fixes for Win98/ME and the KB918547 fixes for Win98/ME to elliminate the WMF problems.

@erpdude8

The incorrect qfecheck info bug for 918547 is ONLY on 98. Microsoft got it right on Windows ME.

the_guy

yeah I noticed that, the_guy. mentioned it in an earlier post. so are we close to a new beta of the ME service pack being posted. also, I was wondering if you would be interested in making a beta of the 98 FE service pack 2.x. last time I heard the 98fe SP2 was stuck in alpha 2 and hasnt been updated for almost a year and nobody wants to revise it.

I'm planning on making a new release in the next few weeks.

About the 98FE SP: I don't think I'll have time to maintain that. Last I heard, Gape would be maintaining that SP.

the_guy

ok. so far Gape has done nothing with the 98fe SP.

Yup. I've confirmed that KB916281 fixed the URLMON.DLL problem from KB912812 of IE6 SP1. Office Update and Windows Update sites worked correctly.

I went to WU + WUC right after I installed Q916281 on Win98 SE + IE 6.0 SP1, and both sites worked ok.
And nobody reported any bugs accessing OU so far [I don't have any M$ Office components installed, so I can't check the OU site].

Please send me the corrected 98SE INF when u have time.

IMHO:
I believe the GDI*.* fix [unofficial Q912919] for both 98SE + ME takes care of the newly discovered WMF bug [MS06-026 a.k.a. Q918547], but I'm not sure.
I'll wait for the GDI patch author to tell me if that's true, and will let you guys know.
If that's true, then nobody needs to install Q918547, so we don't have to install 2 new CPU-cycles-eating-TSRs.
What the hell kind of patch was that?! Again... similar to official Q891711, which was flawed, so somebody had to make U891711 to fix the M$ original patch (which was later reposted as V2.0) ?!
So we keep putting up with screw-up after screw-up, if u ask me...
But at least all our Win98/ME patch worries will be over July 11 2006.

HTH

That would be great. I was already wondering about this, reading what Ms has to say about themselves doesn't make anything clear to me. They say it's a new bug but they don't tell anything new compared to the old one.

I notice a new update KB917734 for WMP 7.1, but only for Windows 2000.

Inside, there seeems to be Wmpui.dll Version 7.10.00.3078, presumably one point release past what KB911565 applies in 9x with WMP 7.1 installed. [KB917734 claims WMP 6.4, such as obtainable with installing IE 6.0/SP1, is unaffected.]

Can anyone check this one out? [It would seem to be an easy fix borrowing the innards of KB911565 installer, and incidentally likely obsoleting KB911565 for WMP 7.1 users.]

I don't think everyone installs WMP 9.

cjl

uh I USE WMP9, CLASYS!

I'll ask MDGx to make an unofficial KB917734 wmpui.dll WMP 7.1 patch for Win9x/ME/NT4 which should replace the unofficial WMP 7.1 KB911565 patch for 9x/NT4.



You mean the corrected Win98 INF file for KB918547. already did late Wednesday. should apply to ALL editions of Win98 (both FE & SE).

I already made unofficial 917734 for WMP 7.1 on 95/98/SE/ME/NT4 and 916281 on IE6 and NT4. I also sent them to MDGx.

I plan on making an unofficial MS06-022 and an unofficial MS05-013 update for NT4 this weekend.

the_guy

I do too!

I didn't say NO ONE uses WMP 9, just not EVERYONE uses it! [I also use MPC 6.4.9.0.]

cjl

Apparently the KB918547 updates DO care what version of IE is installed. I've tested the KB918547 updates under Win98/ME. They will NOT work unless IE 5.5 SP2 or higher is installed. Looked at the contents of the KB918547 Win98/ME updates in Wordpad and they check the version of SHDOCVW.DLL file installed. It has to be version 5.50.4807.2300 or better. Otherwise the KB918547 patches refuse to install the files.

Can we now agree that the SP should optionally include updates to IE? Apparently limiting the choices to either IE55SP2 or IE60 [or IE60 SP1]?

It would appear the hand is now forced, else new updates have to be withheld!

cjl

BTW, there seems to be more IE 5.0 browsers than IE 5.5 browsers:
http://history.toplist.cz/stat/?a=graph&type=1

At least in the Czech Republic. Do you know any similar graph for the whole world (or USA)?

Petr

What's the benefit of IE6.1 over 5.5 ?

Besides the downsides, hopefully mostly band-aided by using the browseui and browselc substitutions to overcome:

Many on-line anti-malware scans require Active-X, a virtual lock for IE. An alarming change is that they are now also requiring IE 6.0, not earlier [ Haven't yet found one that required IE 6.0 SP1, yet!] I assume you understand the worth of such as Trend Micro Housecall, Panda Security Scan, Bit-Defender, a-squared anti-malware scanner, Webroot Spy Audit, or even McAfee and Symantec's parallel offerings.

IE <less-than-6> is now officially a dead-end. New security updates already have appeared post 5.x; more will follow; some are specific to 98/SE/ME, or some of us will make them so.

To my knowledge, AOL is a thinly-disguised IE 6.0 SP1. Clearly many other apps are; they don't work with earlier versions, or at least not necessarily completely.

I prefer FireFox; these companies and others prefer IE, and most if not all either currently do or soon will require IE 6 or newer.

cjl

These are the answers from the author of the GDI*.* patch: