I just rebooted from the installation of your patch and so far everything seems to be alright. CPU usage slightly up afew moments, but I don't know if it's related.

Do you recommand to install the 98KRNLUP.EXE after this patch too?

I would like to help testing, however I need something to test. Have you a link to a "malformed" image or so that should be blocked by this new patch?

Hi MDGX,

I'm currently reinstalling my OS from scratch, and I want to try out U891711. I will install 98SE2ME, with the ME options (hooray!). Just a question about the recommended installation order: would the following order be more or less ok?:

- all Win 98SE updates
- SE SP2.02
- U891711
- 98SE2ME
- RPLite3 (perhaps)
- 98KRNLUP
- 98UPDSYS (for Intel CPU)

Hope this is fairly straightforward.

Thanks for any suggestions.

MGDx,

I have tried without the kernel patch during two days, and it worked fine. Now I did the patch and it's still fine.

MGDx,

I have something to say:

A few times already, I noticed abnormal datas transfert (on a 56k modem I see that easily), I mean data being sent or received while I'm not dowloading anything.
If at this time I shut down the connection (which I always do in this case), I get the internet connection dialog looping again and again until I reconnect.

I checked my my processes and noticed that KB891711.exe was running. Killing this task BSOD'ed my PC.

Now I disabled KB891711.exe from the start-up.
What do you think?

The BSOD also happens with the original security update (v2) from Microsoft (4.10.2223). It is the result of KB891711.EXE running as a service process. One should not kill service processes. It can cause system instability.

Neither the original security update nor the patch (4.10.2224) try to connect to the internet. The only instance where one might see activity if LOADIMAGE loads a file from a network share and that share is accessed through a dial-up connection, but that network activity would occur even w/o the patch.

It is possible that unexpected network activity comes from one other computer scanning IP adresses and ports.

The proof-of-concept .ANI file is at
http://www.xfocus.net/flashsky/icoExp/

BTW are you also testing this patch?

NOTE #4

KB891711.EXE can be stopped *safely* using the Close option (but *not* the
Kill option) of programs like EndItAll or similar:
http://www.mdgx.com/speed.htm#TSK
CoolKill and Process Explorer do not have a Close option.
Killing (an application) happens w/o a warning to the application, and that
can be disastrous, as is the case with all versions of KB891711.EXE (official
and unofficial), which modify USER.EXE "on the fly" (DrWatson shows that).

MDGx,
I am pleased to report that this update also works on Windows ME. You also apply it like a normal update, you don't need to kill stmgr using coolkill. Just installed it on a virtual pc and it works. Maybe you could pass that on to the author and modify the installer so it installs on ME.

the_guy

Hi - Just to report that (with Gape's 2.0.2 SP and MDGx's 98SE-MP10) I found missing button images for Media Player, as per the attached. Restarting the app resolved the problem

I'd have to agree with that being due to a slower server response. If you look closer... the button placeholder images are the typical red 'x' like that from IE. *Smells IE in WMP*

Hi MDGX,

After installing U891711 with 98KRNLUP a week ago on a very old Intel CPU and board (as part of a fresh install that included the installation of the ME options in 98SE2ME - wow, thanks!), I can now report an issue which may or may not be related (people more qualified to make the judgement no doubt will ).

I've experienced quite frequent BSODs while using Winamp v.2.81 Lite (with the Ampesizer skin found here at Radified and the MAD MP3 decoder plugin). They usually occur when clicking Winamp's OPEN icon that opens the file-browsing window. The BSODs have reported OEs at 0028:C16AE309 in VXD ctpci9x(01) + 00055D9 called from 0028:C16B11FC in VXD ctpci9X(01) + 000583CC, and have reported fatal ODs at 0028C0003ABD in VXD VMM(01) + 00002ABD.

Again, I have no idea if this relates specifically to the U891711 patch, and so really no idea if this is helpful or not. But there you go.

I've experienced quite frequent BSODs while using Winamp v.2.81 Lite (with the Ampesizer skin found here at Radified and the MAD MP3 decoder plugin). They usually occur when clicking Winamp's OPEN icon that opens the file-browsing window. The BSODs have reported OEs at 0028:C16AE309 in VXD ctpci9x(01) + 00055D9 called from 0028:C16B11FC in VXD ctpci9X(01) + 000583CC, and have reported fatal ODs at 0028C0003ABD in VXD VMM(01) + 00002ABD.

Again, I have no idea if this relates specifically to the U891711 patch, and so really no idea if this is helpful or not. But there you go.

Have you a link to a "malformed" image or so that should be blocked by this new patch?

As the original Microsoft KB891711 v2 is exactly the same for 98SE and ME, I am trying U891711 on Windows ME.

So far I have noticed no problems. The only "problem" there is, is the same as with the original one. There is one more executable and one more dll running in the system and it cannot be closed (with a task manager) without soon terminally crashing the entire OS.

I have also downloaded Winamp lite 2.81, the ampesizer skin and the mad plugin. I have no errors when clicking on the open file button while U891711 is running.

However, I have also the same question as hp38guser :

Hi everyone,

Somebody [the author prefers to remain anonymous] released a new unofficial patch for Windows 98 + 98 SE described here [MS05-002]:
http://www.microsoft.com/technet/security/...n/ms05-002.mspx
Unofficial patch download [109 KB, English]:
http://www.mdgx.com/files/U891711.EXE
First, please make sure to read the text file [English]:
http://www.mdgx.com/files/U891711.TXT
To install this unofficial patch on Windows 98/98 SE, just run U891711.EXE and then reboot.

This is a beta release, which means needs testing on as many computers as possible.
Please run this patch on your Windows 98 or 98 SE computer(s), and then post your comments/bugs/tips/suggestions/etc in this MSFN forum, or you can send me feedback: the blue E-mail link.

This patch can be uninstalled from Control Panel -> Add/Remove Programs -> "Unofficial Q891711 Patch (remove only)" -> click the "Add/Remove" button.

I will post this patch as permanent replacement for the official MS patch [see http://www.mdgx.com/files/U891711.TXT for details] if this unofficial patch proves to fix the MS05-002 security vulnerability better than the official MS patch.

Many thanks in advance for your time and concern.

Did you notice this when trying to play online or offline?

I assumed this was related to installing 98SEMP10 [WMP10 files from WinXP]

GET WINAMP LITE 5.11, NOT WINAMP 2.81!!!! Come on, dude! Winamp 2.81 is so old that it is prone to new security threats and v5.11 fixes these new security holes in Winamp.

I dont understand why bristols and eidenk want to use a very outdated release of Winamp as I, on the other hand, have no problems with the latest release of Winamp [5.11], with U891711 installed.

Winamp lite 2.81 is NOT available anymore at the Winamp.com site, eidenk. GET WINAMP LITE 5.11, NOT WINAMP 2.81!!!! Come on, dude! Winamp 2.81 is so old that it is prone to new security threats and v5.11 fixes these new security holes in Winamp.

I dont understand why bristols and eidenk want to use a very outdated release of Winamp as I, on the other hand, have no problems with the latest release of Winamp [5.11], with U891711 installed.

This U891711 patch needs to be revised, MDGx. It will NOT install under WinME (a black eye for ME users). The U891711.TXT file says "Unofficial Windows 98 (FE)/98 SE/ME Q891711 Patch" at the top of the text file but the EXE patch says "Unofficial Windows 98/98 SE Q891711 Patch". Make it install under Win98 FE, SE AND WinME! And edit the title of the U891711.EXE patch to correctly say "Unofficial Windows 98 (FE)/98 SE/ME Q891711 Patch".

Back on-topic: eidenk, that's good to hear, insofar as it's a point for U891711. The BSODs I experience are sporadic (say, 1 in 3 times), and usually happen at the same time as a file is being played.

The BSODs are most likely not related to the installation of U891711.EXE.

I ran a quick search for 'crash' and 'ctpci9x.vxd' and, among other
reports of crashes caused by ctpci9x.vxd, found this at
http://www.sysopt.com/forum/archive/index.php/t-31164.html

Try to upgrade the sound card driver.

I also suggest the following to narrow it down a bit:

(A) Uninstall U891711.EXE and run WinAmp, reinstall U891711.EXE and run
WinAmp

or

( Temporarily stop KB891711.EXE as follows

(1) Boot up PC as normal
(2) Close (but do not kill) KB891711.EXE using EndItAll
(3) Run WinAmp, open file-browsing window, etc.
(4) If no BSOD, close WinAmp, run '%windir%\system\kb891711\kb891711.exe'
(5) Run WinAmp again, open file-browsing window, etc.

Hi MDGxI was playing a local wav file. I don't use Media player for online (much if ever)Your 98SEMP10 automated install was applied some time ago and I was reporting this as it was the first time I'd seen this problem having installed this unofficial 891711 patch

Any ideas ?

Ok. i've downloaded and tested the U891711 patch under Win98se and WinME. Installed OK under Win98se but didn't install under WinME. I get error message when trying to install U891711 under ME so I had to extract the files manually. notified MDGx about it so he should fix that problem easily. Before I installed U891711 I made some changes and corrections to the u891711.inf & u891711.txt files and then installed the files. I've submitted the corrected u891711.inf & u891711.txt files to MDGx. changed the line "Unofficial Windows 98/98 SE Q891711 Patch to "Unofficial Windows 98/98 SE/ME Q891711 Security Patch" in the top section of the u891711.inf file for further clarification. another change I made to the u891711.inf file is the uninstall string from "Unofficial Q891711 Patch (remove only)" to "Unofficial Windows 98/ME Q891711 Patch (remove only)". you really have to specify which version of Windows the U891711 patch will be installed to and uninstalled from. made a minor correction to the u891711.txt file in the "NOTE #2" section, replacing the word "hotfix" with the word "update". Hotfix and update are NOT the same thing. they're different and Microsoft KB891711 is NOT a hotfix; KB891711 is an update, a security update.

I have uploaded the correct version of the patch with modified SED file [please see post # 31 above], which now allows to install directly on WinME, and even if official MS05-002 patch was already installed, it properly overwrites it.
Same behavior if installed on Win98 FE or 98 SE: U891711 can be installed over official MS05-002, it will properly overwrite the MS files, which are older builds [even v2].

I have also replaced "hotfix" with "update" in the text file.

U891711.EXE [110 KB]:
http://www.mdgx.com/files/U891711.EXE
U891711.TXT:
http://www.mdgx.com/files/U891711.TXT

Please try it out at your convenience.

MDGx, you need to date the U891711.TXT file as 11/03/2005 instead of 10/04/2005 to reflect the change in the text file. it's good that you made the correction to the text file but you didnt make the changes I suggested with the U891711.INF file. top of the contents of the u891711.inf file still say "Unofficial Windows 98/98 SE Q891711 Patch" and the un-install string still says "Unofficial Q891711 Patch (remove only)".
Make those changes to the U891711.INF file I mentioned in an earlier post.

if you need the changes I made to the u891711.inf file here they are again:

change ";Unofficial Windows 98/98 SE Q891711 Patch" section to ";Unofficial Windows 98/98 SE/ME Q891711 Security Patch" and change "Unofficial Q891711 Patch (remove only)" to "Unofficial Windows 98/ME Q891711 Patch (remove only)". and be sure to date it 11/03/2005 because that is when I modified the u891711.inf file.

I know when microsoft make revisions to original patches being released, they put a different or newer date to reflect the changes made from the original to the revised patches. MDGx might want to follow suit with U891711.

Gape might want to include U891711 instead of Microsoft KB891711 in his 98se service pack.

I think the un-install string from the U891711.INF file needs one minor tweak.

change "Unofficial Windows 98/98 SE/ME Q891711 Patch (remove only)" to
"Unofficial Windows98/98SE/ME Q891711 Patch (remove only)" so that the word "only" is fully displayed in the Add/Remove programs control panel dialog box.

I have actually stopped using it as I was sometimes getting terminal GDI crashes in image editing programs when resources were still abundant enough. I haven't switched back to the official one that I did not use before testing this one so I can't say if those problems were U891711 specific or if they arise as well with MS KB891711 v2.

KB891711.EXE and Q891711.DLL do not use any GDI functions or GDI objects.
Therefore, it is highly unlikely that any image/icon editing tools crashes are
caused directly by any of the unofficial or official versions. Nor would I
expect the changes in the 'LoadImage' function to be the direct cause. GDI.EXE
(all Win98 + WinME versions) has serious bugs that often lead to heap
corruption when GDI resources drop below 10%. However, this corruption may
manifest itself only much, much later when GDI resource levels are again
higher or even at more than 70%.

All I can say is that I never experience a GDI crash with any of the many image editing programs I use except sometimes when I run this patch.

I use my computer enough to be able to assess that.

On my system (WinME) I get GDI crashes only when I try to go below 0% but this affects all standard applications of course. I have been testing stability in this respect by running scores of applications until reaching 1 or 2% of free resources left. The system remains rock stable. Closing most of the apps then frees most of the resources and the system never GDI crashed afterwards.

If I recall well, some GDI stability problems already begin to arise on Win98SE below 30%. Maybe what is written above by the U891711 author applies to Win98SE but certainly not to WinME which has apparently benefited from great improvement in this respect.

What I am interested in, with respect to resources, is whether the possibilty exist to increase the size of the available resources by hacking/patching certain system files and have, say, the double to start with, which would allow to run more applications at once without falling in the red.

I am afraid the brief answer to 'eidenk's' question is: virtually
impossible w/o a major revamp of GDI.EXE. More details below.

------------------------------------------

'eidenk' wrote:

All I can say is that I never experience a GDI crash with any of the many
image editing programs I use except sometimes when I run this patch.

I use my computer enough to be able to assess that.

On my system (WinME) I get GDI crashes only when I try to go below 0% but
this affects all standard applications of course. I have been testing
stability in this respect by running scores of applications until reaching
1 or 2% of free resources left. The system remains rock stable. Closing
most of the apps then frees most of the resources and the system never GDI
crashed afterwards.

If I recall well, some GDI stability problems already begin to arise on
Win98SE below 30%. Maybe what is written above by the U891711 author
applies to Win98SE but certainly not to WinME which has apparently
benefited from great improvement in this respect.

What I am interested in, with respect to resources, is whether the
possibilty exist to increase the size of the available resources by
hacking/patching certain system files and have, say, the double to start
with, which would allow to run more applications at once without falling
in the red.

--

The amount of GDI resources is largely determined by the GDI 16-bit data
segment. This 16-bit segment is limited to 64 KByte. Unfortunately, there
is no easy way to increase it as a 16-bit offset can only address 65536
bytes max. GDI.EXE 4.90.3000 has fewer bugs and is far more stable than,
for example, 4.10.2225, but it still is very buggy. Fatal GDI heap
corruption shows up mainly in three ways, (1) a GPF in GDI.EXE, (2) a GPF
in USER.EXE, and (3) a BSOD in KERNEL32.DLL (address depends on the
version of KERNEL32.DLL). Depending on the system configuration, (3) &
even (2) may happen more often than (1). Before fatal heap corruption
occurs, some GDI objects may not have been used and/or freed properly (in
particular, when resource levels drop below 10% - even with 4.90.3000!)
and the system may still appear 'rock solid', may never crash or may only
crash when the system is shut down.

Please post original crash error messages if you have them. I have not had
any real GDI.EXE crash in a long, long time and it did not change after I
installed KB891711.EXE 4.10.2222. What I suspect here is the following:
'LoadImage' is called thousands of times by most applications and the
system itself and so is the code in KB891711.EXE/Q891711.DLL. This may
trigger some bug in the 16-bit subsystem, a bug that is there all the
time, but is almost never triggered unless KB891711.EXE is running. For
example, KB891711.EXE allocates and releases additional GlobalMemory
through the 16-bit subsystem (KRNL386.EXE) whenever 'LoadImage' is called.

Please post original crash error messages if you have them.