Feeds

Windows 7 'security' patch knocks out PCs, knackers antivirus tools

Job done, lads. Now no one's getting infected

Using blade systems to cut costs and sharpen efficiencies

Windows 7 users should uninstall a security patch Microsoft issued on Tuesday because some PCs failed to restart after applying the update.

The software giant advised users of Win 7 and Windows Server 2008 R2* to roll-back a patch within MS13-036, a security update that closed two vulnerabilities in the Windows file system kernel-mode driver. Exactly how one nukes the wobbly patch is explained here.

The advice follows complaints that after applying the update computers would either fail to restart or applications would not load. Users who experienced problems were sometimes confronted by "fatal system error" warnings on start up, as illustrated by Sophos here.

In a post on Microsoft's Security Response blog, Redmond blamed the glitch on conflicts with third-party software:

We are aware that some of our customers may be experiencing difficulties after applying security update 2823324, which we provided in security bulletin MS13-036 on Tuesday, April 9. We’ve determined that the update, when paired with certain third-party software, can cause system errors. As a precaution, we stopped pushing 2823324 as an update when we began investigating the error reports, and have since removed it from the download centre.

Contrary to some reports, the system errors do not result in any data loss nor affect all Windows customers. However, all customers should follow the guidance that we have provided in KB2839011 to uninstall security update 2823324 if it is already installed.

The buggy patch causes, among other headaches, Kaspersky Anti-Virus for Windows to display a message claiming its user licence is invalid, implying that the PC is unprotected from malware nasties. Other reports suggest that some machines have been thrown into a continuous reboot cycle: Win 7 PCs in Samba-loving Brazil are apparently hardest hit.

Problems of this type of rare but not unprecedented. Redmond has withdrawn patches before. Microsoft's security gnomes also deserve credit for quickly determining there was a problem before the vast majority of corporates rolled out the problematic patch.

The dodgy fix, numbered 2823324, addresses a "moderate" privilege elevation flaw. Redmond has removed it from the MS13-036 update, which just leaves security update 2778344, also a privilege elevation fix that is rated as important. ®

* Both OSes are related, code-wise.

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.