January 3, 2018 - KB4056897 (Security-only update) Windows 7

[Ranger4]

You are welcome & thank you.

 

[Brds7t7]

Ok, where is the registry editor?

Oops, sorry about the lack of instructions LF! As you've been on here a long time I just assumed you knew where to find regedit already. My mistake.

 

[Pete4]

I run manual update check in the morning and got kb4056894 installed. Then run update check again in the afternoon and same kb showed up and installed again. Either a bug, or MS updated the fix without changing the kb number.

 

[Hellriser]

I'll be waiting for a final update on Tuesday, maybe it has been thoroughly tested and configured by then. Since my browser is impervious to the exploits already, I don't see any other way I could catch these darned things -- unless I install them myself.

Would it be advisable to also keep an eye on those motherboard bios upgrades and new cpu drivers (or whatever they are called) form Intel?

 

[Lady Fitzgerald]

Oops, sorry about the lack of instructions LF! As you've been on here a long time I just assumed you knew where to find regedit already. My mistake.

No worries. Once I found out how to get to regedit, your instructions took me the rest of the way. Thanks (and I would rep you too, if I could.)

 

[lehnerus2000]

Possible Issues

There are reports that this update (KB4056894) is causing problems:
https://social.technet.microsoft.co...a027-fdad302a1d3f/blue-screen-after-kb4056894
https://answers.microsoft.com/en-us...1/f09a8be3-5313-40bb-9cef-727fcdd4cd56?auth=1

I downloaded it the other day, but I haven't tried installing it yet.

 

[Lady Fitzgerald]

There are reports that this update (KB4056894) is causing problems:
https://social.technet.microsoft.co...a027-fdad302a1d3f/blue-screen-after-kb4056894
https://answers.microsoft.com/en-us...1/f09a8be3-5313-40bb-9cef-727fcdd4cd56?auth=1

I downloaded it the other day, but I haven't tried installing it yet.

And that is why I make an image of my C: drive BEFORE I make any changes, install any updates, add or remove programs, etc. and is why I like to wait awhile before installing any MS updates.

 

[Layback Bear]

Hi Iko,

may fail or corrupt your system

Uninstall the AV FIRST, (completely)
then run the KB.

Roy

That is also my understanding. Some 3rd party anti virus programs are getting in the way.
The KB installed on my system with no problems using MSE and Malwarebytes Premium both active.

Jack

 

[Ranger4]

I have had no problems with KB4056894 & it's been installed for a couple of days now. I use MSE as my AV so that could explain why I have had no problems.

I see Layback Bear has had no problems as well using MSE.

When that KB came through there was also a big 37MB update for MSE, so perhaps MS made some changes to MSE so as not to cause any problems with KB4056894.

 

[iko22]

What if someone were to install KB4056897 AND then uninstall their AV?

Hi Iko,

may fail or corrupt your system

Uninstall the AV FIRST, (completely)
then run the KB.

Roy

That is also my understanding. Some 3rd party anti virus programs are getting in the way.
The KB installed on my system with no problems using MSE and Malwarebytes Premium both active.

Jack

I have had no problems with KB4056894 & it's been installed for a couple of days now. I use MSE as my AV so that could explain why I have had no problems.

I see Layback Bear has had no problems as well using MSE.

When that KB came through there was also a big 37MB update for MSE, so perhaps MS made some changes to MSE so as not to cause any problems with KB4056894.

I have not installed KB4056897 yet. My AV is Avast so I am expecting no problems. I think my question was centered on what if I uninstalled my AV AFTER KB was installed.

I am thinking if the AV licience expired or if I simply change AV provider, should I then uninstall KB before?

 

[LevelBest]

Hello Anak

Thank you for the information.

I've also seen a number of posts that this is causing some quite significant problems.

I've found the registry entry, pic attached, it seems to be the same numbers as in your post, so it that how it should be?

I've also seen a reference to only needing to install this update if you have 'crypto currency' whatever that is, pretty sure I've not got it.

LevelBest

 

[Seffrid]

Both KB4056897 (security-only) and KB4056894 (monthly rollup) are causing massive problems for AMD users (notably failure to boot up with BSOD) and should definitely not be installed yet, especially as the monthly rollup is generally not checked and is therefore not intended to be ready for installation.

One problem with the security-only update is that by downloading it from the MS Windows Catalog and installing it you are bypassing the registry key test that determines whether your machine is suitable for it.

If you have installed one of these updates and can't boot the machine try to boot into repair mode and then use System Restore to roll back the computer to a date prior to the update being installed.

It looks highly likely, however, that both updates will either be pulled shortly or else replaced on Patch Tuesday. In the meantime it would be prudent to leave well alone, especially on AMD machines.

 

[torchwood]

HI @iko22,

Thanks to @Anak, he has posted a check list of dates AV's for updating the key
CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754 (Meltdown and Spectre) Windows antivirus patch compatibility

As for replacing your AV, as long as the reg key has been set by the new provider then it should not be a problem
Believe Avast has but mine Panda hasn't NO WAY i would swop until ALL AV's have updated


In reality there are 4 parts to fixing the "Meltdown +" issue
MS - Manfacturer(intel/AMD) - OEM - AV

In my eyes the correct order to update

Manufacturer (note Intel have issued a check tool)
AV
MS
OEM

Its been handled piecemeal which doesnt help us,
Even the COMPLETE MS patch comes in 2 parts
(the 2nd is in the monthly cumulative - for IE and Edge browsers)
when the OEM's patch the BIOS, were going to hit another problem are they going to issue it for older machines as well - DONT think so
(that includes my 2009 rig:shock

Roy

 

[Seffrid]

Make sure that any Intel check tool actually relates to the Meltdown issue, there are a lot of posters on multiple forums linking an old Intel check tool that was for a different problem entirely and if applied to this situation it will give a false sense of security.

AMD don't believe that their processors are at significant risk from Meltdown, and there is currently insufficient reason to worry about Meltdown if you have an AMD machine.

Remember too that with Windows Updates you can usually uninstall them or roll back the machine if they cause issues. However, BIOS updates and firmware updates generally don't typically have the same option so only consider any such updates with extreme caution and, most crucially in the light of the many problems being reported all over the place - not yet!

 

[torchwood]

Hi Seffrid,

The intel tool i was refering to is Dated Nov 2017.
Intel-SA-00086 Detection Tool

Unfortunately for some AMD users ithat kb is causing a BSOD

Possibly another related problem
Affecting Sandboxie users - its reporting NOT supported
fix issued
5.23 Beta Available (latest version 5.23.3) - Sandboxie Support

Roy

 

[Seffrid]

Hi Seffrid,

The intel tool i was refering to is Dated Nov 2017.
Intel-SA-00086 Detection Tool

Unfortunately for some AMD users ithat kb is causing a BSOD

Possibly another related problem
Affecting Sandboxie users - its reporting NOT supported
fix issued
5.23 Beta Available (latest version 5.23.3) - Sandboxie Support

Roy

That's an old tool relating to the Management Engine Critical Firmware Update and is nothing to do with the present Meltdown issue. As such it won't tell you whether you're vulnerable to it.

 

[Anak]

Hi, I've seen the previous posts that require my attention but for now all I have time for is to address the issue of: How to Check and Update Windows Systems for the Meltdown and Spectre CPU Flaws from Bleepingcomputer. It has a way with using powershell to check the status of the updates.

I saw it today in a thread I'm in over at TenForums "Kernel memory leaking Intel processor design flaw"; This is one of the posts in the thread: Post #121 Check the status of the patches

 

[Lady Fitzgerald]

...Believe Avast has but mine Panda hasn't NO WAY i would swop until ALL AV's have updated...

As long Avast updates are current, it has the registry key. Panda is supposed to get theirs on the 9th.

 

[Mellon Head]

I checked for the registry key prior to installing the rollup. I had the key, so I went ahead, making a restore point. I have an AMD FX-8350 and there were no problems with the update. The computer is running just fine.

Maybe the issue is only affecting certain AMD cores? The complaints that I've seen from AMD users are older cored models, such as Brisbane and Windsor that have been out of production for years. Perhaps MS forgot to make allowances for these older models in the patches. I have not seen any reports from users of Vishera, Bulldozer or Ryzen cores yet, though I may have missed them.

 

[LevelBest]

I still have not installed this update.

I've seen on the news this morning that intel processors are at risk from the Meltdown issue but patches/updates (?) are being issued for intel processors that are up to five years old. My trusty laptop is 6 years plus old.

Then there's the issue of whether McAfee have released the update for the registry part.

I don't know whether to install this update or not, even if I do, will it protect my laptop and now given this latest intel issue, whether it could potentially wreck my laptop.

Can anyone help?

LevelBest