Security Bulletin MS14-045 rereleased

[LazyTom]

I missed that bit about removing 2982791 first. Now I have to uninstall both updates and reinstall 2993651.

Source:

Updated: August updates cause trouble for some Windows users | www.winhelp.us

I also had it installed this morning, but I also forgot to uninstall 2982791 first.

So should I do the same as Callender told earlier?
Btw, in what order did you uninstall the above referenced KB's, Callender?

EDIT: I found this Micro$oft statement on the web (source: http://windowsitpro.com/security/its-back-microsoft-begins-pushing-out-fixed-version-kb2982791):

The statement on the matter goes like this:
Microsoft strongly recommends that customers who have not uninstalled the 2982791 update do so prior to applying the 2993651 update. Customers do not need to uninstall the expired 2982791 update before applying the 2993651 update; however, Microsoft strongly recommends it. Customers who do not remove the expired update will retain a listing for 2982791 under installed updates in Control Panel.

Well, what should I do now? Uninstall it or leave it be? I mean after reading this I'm kind of confused right now.

 

[Callender]

Re: Updates

I missed that bit about removing 2982791 first. Now I have to uninstall both updates and reinstall 2993651.

Source:

Updated: August updates cause trouble for some Windows users | www.winhelp.us

I also had it installed this morning, but I also forgot to uninstall 2982791 first.

So should I do the same as Callender told earlier?
Btw, in what order did you uninstall the above referenced KB's, Callender?

EDIT: I found this Micro$oft statement on the web (source: It's Back. Microsoft Begins Pushing Out Fixed Version of KB2982791 | Security content from Windows IT Pro):

The statement on the matter goes like this:
Microsoft strongly recommends that customers who have not uninstalled the 2982791 update do so prior to applying the 2993651 update. Customers do not need to uninstall the expired 2982791 update before applying the 2993651 update; however, Microsoft strongly recommends it. Customers who do not remove the expired update will retain a listing for 2982791 under installed updates in Control Panel.

Well, what should I do now? Uninstall it or leave it be? I mean after reading this I'm kind of confused right now.

Personally I uninstalled 2993651 then rebooted. Then I uninstalled 2982791 - rebooted. Then I let Windows Updates take care of reinstalling 2993651.

I'm currently at work and see that the IT department has left both updates installed on my work machine so make what you will of that. All I know is that on my machine the old 2982791 hasn't been offred by Windows Updates as a missing update after it was removed.

 

[LazyTom]

Personally I uninstalled 2993651 then rebooted. Then I uninstalled 2982791 - rebooted. Then I let Windows Updates take care of reinstalling 2993651.

Thanks! I did it like that and everything went A-OK.

When it comes to patches like this, it's better safe than sorry.

 

[Anak]

So it looks like this update should still be avoided.

In my case yes.

It took Microsoft (MS) 15days to come up with a fix for the problems encountered on this August's (08-12-2014) patch Tuesday, at that rate I'm assuming they will have a new fix by September's patch Tuesday and I'm going to wait until I see any announcements.

The problem report has been sent to MS:


I'm not sure if it was an indication of the severity of the problem but it took four tries before MS's busy servers accepted the report.

Here's a copy of the .dmp, it was a problem with the win32k.sys - LogonUI.exe files. That's why it BSOD'd at the "starting windows" screen.
Strange, I've never used a log-on, but I would believe Windows needs to check the LogonUI.exe to see if one is needed or not.

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\Amln0\AppData\Local\Temp\WER3079.tmp\082714-36067-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.22616.amd64fre.win7sp1_ldr.140303-2307
Machine Name:
Kernel base = 0xfffff800`04054000 PsLoadedModuleList = 0xfffff800`04298890
Debug session time: Wed Aug 27 20:30:18.518 2014 (GMT-4)
System Uptime: 0 days 0:00:47.970
Loading Kernel Symbols
...............................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff9600029ab0a, fffff880025167a0, 0}

Probably caused by : win32k.sys ( win32k!DEVLOCKBLTOBJ::vClearRenderState+4a )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff9600029ab0a, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880025167a0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!DEVLOCKBLTOBJ::vClearRenderState+4a
fffff960`0029ab0a ff1500f50b00    call    qword ptr [win32k!_imp_PsGetCurrentThreadWin32Thread (fffff960`0035a010)]

CONTEXT:  fffff880025167a0 -- (.cxr 0xfffff880025167a0)
rax=fffff900c00be010 rbx=fffff88002517450 rcx=fffff88002517400
rdx=fffff88002517450 rsi=fffff900c1d81280 rdi=fffff900c1d67cd0
rip=fffff9600029ab0a rsp=fffff88002517180 rbp=0000000000000000
 r8=0000000000000000  r9=fffff900c1ccd010 r10=fffff900000004c0
r11=fffff900c01e8d40 r12=0000000000000000 r13=fffff9600038e4e0
r14=0000000000000001 r15=fffff900c1cc1b80
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
win32k!DEVLOCKBLTOBJ::vClearRenderState+0x4a:
fffff960`0029ab0a ff1500f50b00    call    qword ptr [win32k!_imp_PsGetCurrentThreadWin32Thread (fffff960`0035a010)] ds:002b:fffff960`0035a010=0000000000306352
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

[U][B]PROCESS_NAME[/B][/U]:  [U][B][COLOR=Blue]LogonUI.exe[/COLOR][/B][/U]

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff9600013a029 to fffff9600029ab0a

STACK_TEXT:  
fffff880`02517180 fffff960`0013a029 : fffff880`02517400 fffff900`c1d81280 00000000`00000000 00000000`00ffffff : win32k!DEVLOCKBLTOBJ::vClearRenderState+0x4a
fffff880`025171b0 fffff960`00139ebd : fffff880`02517400 fffff900`c1d81280 fffff900`c1d81280 00000000`00000000 : win32k!DEVLOCKBLTOBJ::bDisposeTrgDco+0x41
fffff880`025171e0 fffff960`0024519c : fffff900`c1cc1b80 fffff900`c1cc1b80 00000000`746c7847 fffff900`c1cc1b80 : win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+0xdd
fffff880`02517210 fffff800`040c77d3 : 00000000`07010284 00000000`0000028b 00000000`00000186 00000000`00000014 : win32k!NtGdiAlphaBlend+0x1900
fffff880`02517610 000007fe`fda33f0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0018e188 fffff800`040bfb90 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fda33f0a
fffff880`02517860 fffff880`02506000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000058`00000001 : nt!KiCallUserMode
fffff880`02517868 00000000`00000000 : 00000000`00000000 00000000`00000000 00000058`00000001 fffff880`02517db0 : 0xfffff880`02506000


FOLLOWUP_IP: 
win32k!DEVLOCKBLTOBJ::vClearRenderState+4a
fffff960`0029ab0a ff1500f50b00    call    qword ptr [win32k!_imp_PsGetCurrentThreadWin32Thread (fffff960`0035a010)]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!DEVLOCKBLTOBJ::vClearRenderState+4a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  53f7e75f

STACK_COMMAND:  .cxr 0xfffff880025167a0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k!DEVLOCKBLTOBJ::vClearRenderState+4a

BUCKET_ID:  X64_0x3B_win32k!DEVLOCKBLTOBJ::vClearRenderState+4a

Followup: MachineOwner
---------

 

[Seffrid]

It might be worth holding back on this update for a few days, there are a lot of reports on the MS Community Forums about it possibly being the cause of the manual searching for Windows Updates being screwed up this week. The security bulletin for the update also refers to a known issue that is currently being worked on.

 

[Anak]

This just started in another Forum I'm in: Is update KB 2993651 safe to install? | Windows Secrets Lounge

I'm post #6.

 

[NotASpeckOfCere]

FYI: Not of this fixed it for me:

http://www.sevenforums.com/windows-updates-activation/343631-ms14-045-kb-2993651-not-fixing-kernel-mode-bsods.html

 

[RoasterMen]

So it looks like this update should still be avoided.

Installed on 7 HomePrem host & guest VM, no ill effects as of yet.

I installed the update at the moment, no problems yet

 

[Urthboundmisfit]

...actually I've since uninstalled it, not because of problems but I figured why look for possible trouble when I can just eliminate the source of said possible trouble. Overkill/overthinking on my part? Perhaps. But I sleep well at night.