[MDGx]

UPDATED · 4-28-2007

• All Windows 98 SE users = new Q891711 [permanent fix] replaced old U891711 [temporary fix]. Please read Q891711.TXT for complete details:
  http://www.mdgx.com/files/Q891711.TXT

* Unofficial Windows 98 SE Animated Cursor (.ANI) + Icon Handling USER32.DLL + USER.EXE 4.10.2233 Security Vulnerability Fix:
http://www.mdgx.com/files/Q891711.TXT
Direct download [375 KB, English]:
http://www.mdgx.com/files/Q891711.EXE
This Fix replaces ALL PREVIOUS Microsoft MS07-017 (Q925902):
http://www.microsoft.com/technet/security/...n/ms07-017.mspx
MS05-002 (Q891711):
http://www.microsoft.com/technet/security/...n/ms05-002.mspx
+ unofficial (U891711) Animated Cursor (.ANI) + Icon Handling Security Vulnerabilities Fixes, which are now OBSOLETE!

How to uninstall Q891711:
Control Panel -> Add/Remove Programs -> "Remove Unofficial USER32.DLL + USER.EXE Fix" -> click the
"Add/Remove" button -> reboot.

• All other Windows 95/OSR1/OSR2/98/98 SP1/ME users = install U891711 [temporary fix]. Please read U891711.TXT for complete details:
  http://www.mdgx.com/files/U891711.TXT

* U891711 [Q891711.DLL 4.10.2223 + KB891711.EXE 4.10.2227] fixes Windows 95/OSR1/OSR2/98/98 SP1/ME Animated Cursor (.ANI) + Icon Handling Security Vulnerabilities:
- MS07-017 (Q925902):
http://www.microsoft.com/technet/security/...n/ms07-017.mspx
- MS05-002 (Q891711):
http://www.microsoft.com/technet/security/...n/ms05-002.mspx
and replaces ALL OTHER similar fixes:
- Both Microsoft fixes listed above.
- Unofficial TI891711 Fix:
http://www.msfn.org/...showtopic=43566
Direct download [120 KB]:
http://www.mdgx.com/files/U891711.EXE
Read U891711.TXT FIRST (this file):
http://www.mdgx.com/files/U891711.TXT

Everything here applies only to English editions.

How to uninstall U891711:
Control Panel -> Add/Remove Programs -> "Uninstall Unofficial Windows 95/98/ME U891711 Fix" -> click the "Add/Remove" button -> reboot.

Both Q891711 + U891711 created by anonymous author.

Both these fixes have been tested and works up to specs, unless some1 discovers a new bug, which should be posted in this forum.
Please do not create other forum topics for any Q891711 / U891711 related issues.

NOTE:
No warranties, expressed or implied. Use these files at your own risk!

4-28-2007 UPDATE:
* Win98 SE only = Old U891711 [temporary fix] has been replaced by new Q891711 [permanent fix].

[Fredledingue]

I just rebooted from the installation of your patch and so far everything seems to be alright. CPU usage slightly up afew moments, but I don't know if it's related.

Do you recommand to install the 98KRNLUP.EXE after this patch too?

[Acheron]

I would like to help testing, however I need something to test. Have you a link to a "malformed" image or so that should be blocked by this new patch?

[MDGx]

Fredledingue, on Oct 22 2005, 12:16 PM, said:

I just rebooted from the installation of your patch and so far everything seems to be alright. CPU usage slightly up afew moments, but I don't know if it's related.

Do you recommand to install the 98KRNLUP.EXE after this patch too?

Yes, the 98(FE)/98SE Kernel patch is also recommended to install after this beta patch, and after all other related patches [MS official + Tihiy unofficial described in U891711.TXT].

hp38guser said:

I would like to help testing, however I need something to test. Have you a link to a "malformed" image or so that should be blocked by this new patch?

Unfortunately I don't.
I'll post the link here if I find one.

CORRECTION:
The two MS IE 6.0 SP1 windows lockup BUG is NOT related to this patch, and I have subsequently removed it from U891711.TXT.

This post has been edited by MDGx: 22 October 2005 - 08:19 PM

[bristols]

Hi MDGX,

I'm currently reinstalling my OS from scratch, and I want to try out U891711. I will install 98SE2ME, with the ME options (hooray!). Just a question about the recommended installation order: would the following order be more or less ok?:

- all Win 98SE updates
- SE SP2.02
- U891711
- 98SE2ME
- RPLite3 (perhaps)
- 98KRNLUP
- 98UPDSYS (for Intel CPU)

Hope this is fairly straightforward.

Thanks for any suggestions.

[Fredledingue]

MGDx,

I have tried without the kernel patch during two days, and it worked fine. Now I did the patch and it's still fine.

[MDGx]

bristols, on Oct 23 2005, 07:23 AM, said:

Hi MDGX,

I'm currently reinstalling my OS from scratch, and I want to try out U891711. I will install 98SE2ME, with the ME options (hooray!). Just a question about the recommended installation order: would the following order be more or less ok?:

- all Win 98SE updates
- SE SP2.02
- U891711
- 98SE2ME
- RPLite3 (perhaps)
- 98KRNLUP
- 98UPDSYS (for Intel CPU)

Hope this is fairly straightforward.

Thanks for any suggestions.

The order you have chosen is ok.
If you want more details, please see 98SE2ME READ1ST.TXT [the FAQ section]:
http://www.mdgx.com/9s2m/READ1ST.TXT

Please note that if you install MS official Q891711 patch after U891711, it will not install, because will not overwrite the newer file version builds installed by U891711.

98KRNLUP = can be installed at any time. May fix Kernel issues related (or not) to MS Q891711, U891711 + Tihiy KB891711 fix.

98UPDSYS = the WinME edition of this patch [ http://www.mdgx.com/web.htm#MEU ] installs as part of 98SE2ME options 1 and 2. No need to install the Win98 SE edition if you plan to install 98SE2ME and/or Maximus-Decim Native USB Drivers:
http://www.msfn.org/...showtopic=43605
which should be included in your updates listed above.

Hope this helps.

Fredledingue, on Oct 24 2005, 01:42 PM, said:

MGDx,

I have tried without the kernel patch during two days, and it worked fine. Now I did the patch and it's still fine.

Many thanks for your feedback.
Sounds good.

[Fredledingue]

MGDx,

I have something to say:

A few times already, I noticed abnormal datas transfert (on a 56k modem I see that easily), I mean data being sent or received while I'm not dowloading anything.
If at this time I shut down the connection (which I always do in this case), I get the internet connection dialog looping again and again until I reconnect.

I checked my my processes and noticed that KB891711.exe was running. Killing this task BSOD'ed my PC.

Now I disabled KB891711.exe from the start-up.
What do you think?

[MDGx]

Fredledingue, on Oct 25 2005, 01:52 PM, said:

MGDx,

I have something to say:

A few times already, I noticed abnormal datas transfert (on a 56k modem I see that easily), I mean data being sent or received while I'm not dowloading anything.
If at this time I shut down the connection (which I always do in this case), I get the internet connection dialog looping again and again until I reconnect.

I checked my my processes and noticed that KB891711.exe was running. Killing this task BSOD'ed my PC.

Now I disabled KB891711.exe from the start-up.
What do you think?

Thanks for your time.
I'll tell the patch author about your bug report, and then I'll post here any comments/solutions.

[MDGx]

Fredledingue:

Here is the author's reply:

Quote

The BSOD also happens with the original security update (v2) from Microsoft (4.10.2223). It is the result of KB891711.EXE running as a service process. One should not kill service processes. It can cause system instability.

Neither the original security update nor the patch (4.10.2224) try to connect to the internet. The only instance where one might see activity if LOADIMAGE loads a file from a network share and that share is accessed through a dial-up connection, but that network activity would occur even w/o the patch.

It is possible that unexpected network activity comes from one other computer scanning IP adresses and ports.

The proof-of-concept .ANI file is at
http://www.xfocus.net/flashsky/icoExp/

Hope this helps.

[Fredledingue]

Thanks MGDx.
I hope eveything's all right then. I will re-intialize the "service" executable.

BTW are you also testing this patch?

[MDGx]

Fredledingue, on Oct 27 2005, 11:51 AM, said:

BTW are you also testing this patch?

I still am.

New addtition to the text file U891711.TXT:
http://www.mdgx.com/files/U891711.TXT

Quote

NOTE #4

KB891711.EXE can be stopped *safely* using the Close option (but *not* the
Kill option) of programs like EndItAll or similar:
http://www.mdgx.com/speed.htm#TSK
CoolKill and Process Explorer do not have a Close option.
Killing (an application) happens w/o a warning to the application, and that
can be disastrous, as is the case with all versions of KB891711.EXE (official
and unofficial), which modify USER.EXE "on the fly" (DrWatson shows that).

[Fredledingue]

MGDx, I'v got a new BSOD!

And it's such an incredible event on w98se-uSP2.02 that each instance of it is worth being mentioned here.

It happened only once, while surfing the web, suddenly poof! And it happened I think, when the connection was shut-off momentarily. But I didn't kill the process this time.
I don't know if it's related because I installed a new adsl modem since.
But this patch seems to be the only thing that is capable of doing a BSOD on my computer. Maybe nothing serious. I will see if it happends again.

This post has been edited by Fredledingue: 29 October 2005 - 02:33 PM

[dnbgroove]

Hi - Just to report that (with Gape's 2.0.2 SP and MDGx's 98SE-MP10) I found missing button images for Media Player, as per the attached. Restarting the app resolved the problem

Attached File(s)

•  mp.png (9K)
  Number of downloads: 5

[the_guy]

MDGx,
I am pleased to report that this update also works on Windows ME. You also apply it like a normal update, you don't need to kill stmgr using coolkill. Just installed it on a virtual pc and it works. Maybe you could pass that on to the author and modify the installer so it installs on ME.

the_guy

[MDGx]

the_guy, on Oct 30 2005, 02:54 PM, said:

MDGx,
I am pleased to report that this update also works on Windows ME. You also apply it like a normal update, you don't need to kill stmgr using coolkill. Just installed it on a virtual pc and it works. Maybe you could pass that on to the author and modify the installer so it installs on ME.

the_guy

Thanks for your feedback.
I will relate this to the author.

[MDGx]

dnbgroove, on Oct 30 2005, 12:57 PM, said:

Hi - Just to report that (with Gape's 2.0.2 SP and MDGx's 98SE-MP10) I found missing button images for Media Player, as per the attached. Restarting the app resolved the problem

Did you notice this when trying to play online or offline?
If this happened while online [over the internet], it might have been because a particular server was either lagging, timed out or had maintenance/repair/backup issues [?], because some of the graphics/icons you see in the WMP window [while online] are located on remote [internet based] servers.

And because the problem was fixed after restarting the app, that is one more reason to believe a remote server was the cause.

PS:
I assumed this was related to installing 98SEMP10 [WMP10 files from WinXP].

Hope this helps.

This post has been edited by MDGx: 31 October 2005 - 02:12 PM

[Chozo4]

I'd have to agree with that being due to a slower server response. If you look closer... the button placeholder images are the typical red 'x' like that from IE. *Smells IE in WMP*

This post has been edited by Chozo4: 01 November 2005 - 12:09 PM

[bristols]

Hi MDGX,

After installing U891711 with 98KRNLUP a week ago on a very old Intel CPU and board (as part of a fresh install that included the installation of the ME options in 98SE2ME - wow, thanks!), I can now report an issue which may or may not be related (people more qualified to make the judgement no doubt will ).

I've experienced quite frequent BSODs while using Winamp v.2.81 Lite (with the Ampesizer skin found here at Radified and the MAD MP3 decoder plugin). They usually occur when clicking Winamp's OPEN icon that opens the file-browsing window. The BSODs have reported OEs at 0028:C16AE309 in VXD ctpci9x(01) + 00055D9 called from 0028:C16B11FC in VXD ctpci9X(01) + 000583CC, and have reported fatal ODs at 0028C0003ABD in VXD VMM(01) + 00002ABD.

Again, I have no idea if this relates specifically to the U891711 patch, and so really no idea if this is helpful or not. But there you go.

[MDGx]

Chozo4, on Nov 1 2005, 11:08 AM, said:

I'd have to agree with that being due to a slower server response. If you look closer... the button placeholder images are the typical red 'x' like that from IE. *Smells IE in WMP*

You're right, WMP is very tightly linked to IE, after all, WMP streaming is done thru IE's engine.

bristols, on Nov 1 2005, 02:09 PM, said:

Hi MDGX,

After installing U891711 with 98KRNLUP a week ago on a very old Intel CPU and board (as part of a fresh install that included the installation of the ME options in 98SE2ME - wow, thanks!), I can now report an issue which may or may not be related (people more qualified to make the judgement no doubt will ).

I've experienced quite frequent BSODs while using Winamp v.2.81 Lite (with the Ampesizer skin found here at Radified and the MAD MP3 decoder plugin). They usually occur when clicking Winamp's OPEN icon that opens the file-browsing window. The BSODs have reported OEs at 0028:C16AE309 in VXD ctpci9x(01) + 00055D9 called from 0028:C16B11FC in VXD ctpci9X(01) + 000583CC, and have reported fatal ODs at 0028C0003ABD in VXD VMM(01) + 00002ABD.

Again, I have no idea if this relates specifically to the U891711 patch, and so really no idea if this is helpful or not. But there you go.

I have sent your bug report to the patch author.
I'll post the answer here.

Thanks for your time and concern.