Windows 7 'security' patch knocks out PCs, knackers antivirus tools
Job done, lads. Now no one's getting infected
Windows 7 users should uninstall a security patch Microsoft issued on Tuesday because some PCs failed to restart after applying the update.
The software giant advised users of Win 7 and Windows Server 2008 R2* to roll-back a patch within MS13-036, a security update that closed two vulnerabilities in the Windows file system kernel-mode driver. Exactly how one nukes the wobbly patch is explained here.
The advice follows complaints that after applying the update computers would either fail to restart or applications would not load. Users who experienced problems were sometimes confronted by "fatal system error" warnings on start up, as illustrated by Sophos here.
In a post on Microsoft's Security Response blog, Redmond blamed the glitch on conflicts with third-party software:
We are aware that some of our customers may be experiencing difficulties after applying security update 2823324, which we provided in security bulletin MS13-036 on Tuesday, April 9. We’ve determined that the update, when paired with certain third-party software, can cause system errors. As a precaution, we stopped pushing 2823324 as an update when we began investigating the error reports, and have since removed it from the download centre.
Contrary to some reports, the system errors do not result in any data loss nor affect all Windows customers. However, all customers should follow the guidance that we have provided in KB2839011 to uninstall security update 2823324 if it is already installed.
The buggy patch causes, among other headaches, Kaspersky Anti-Virus for Windows to display a message claiming its user licence is invalid, implying that the PC is unprotected from malware nasties. Other reports suggest that some machines have been thrown into a continuous reboot cycle: Win 7 PCs in Samba-loving Brazil are apparently hardest hit.
Problems of this type of rare but not unprecedented. Redmond has withdrawn patches before. Microsoft's security gnomes also deserve credit for quickly determining there was a problem before the vast majority of corporates rolled out the problematic patch.
The dodgy fix, numbered 2823324, addresses a "moderate" privilege elevation flaw. Redmond has removed it from the MS13-036 update, which just leaves security update 2778344, also a privilege elevation fix that is rated as important. ®
* Both OSes are related, code-wise.