We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
 
75,294 News Articles

Microsoft acts to avoid Windows blue screens

Rootkit-infected PCs won't get latest update

Microsoft is hoping that the security update released yesterday will not trigger the 'Blue Screen of Death' which crippled a number of Windows XP PCs two months ago.

In February, a security update that fixed two flaws in the Windows kernel - the operating system's most important component - wreaked havoc when it was applied by users, who almost immediately flooded Microsoft 's support forum with reports of crippled computers .

As the number of reports grew, Microsoft first stopped automatically serving the MS10-015 update, then confirmed that a rootkit caused the crashes.

Only PCs that had been previously infected with the Alureon rootkit were incapacitated, Microsoft's investigation found.

Microsoft restarted distribution of the update only after it had come up with a way to block rootkit-infected PCs from receiving the patches.

"If detection logic included in Automatic Update discovers abnormal conditions in certain operating system file configurations, the update will fail and customers will be presented with an error message that offers alternative support options," said Jerry Bryant, general manager with the Microsoft Security Response Team, in early March.

MS10-021 , one of the 11 updates issued yesterday as part of Microsoft's monthly Patch Tuesday cycle, also fixed flaws in the Windows kernel. But Microsoft is hoping that this month's update won't trigger a repeat Blue Screen of Death.

"This security update includes package detection logic that prevents the installation of the security update if certain abnormal conditions exist on 32-bit systems," stated the MS10-021 bulletin.

"These abnormal conditions on a system could be the result of an infection with a computer virus that modifies some operating system files, which renders the infected computer incompatible with the kernel update."

One security expert applauded the move.

"I give Microsoft a big tip of the hat for not taking [the February incident] as a one-off," said Jason Miller, data and security team manager at network compliance and security vendor Shavlik Technologies.

"The kernel is something that if something goes bad, that's not good. Patching the kernel is not like patching a media player."

Microsoft obviously learned a lesson. Even though the February update crashed a relatively small number of PCs, the problem actually affected many more, he argued.

"It may have affected just a few people, but it scared almost everyone into not patching," Miller said.

Although scattered reports of problems with Tuesday's security updates have been posted on Microsoft's support forum, PC Advisor's sister title Computerworld did not find any message threads describing Blue Screen of Death crashes after users applied yesterday's MS10-021 kernel update.

Enterprises should still test the update before widely deploying it, Miller recommended.

"With every kernel patch, you really have to test. We're pretty adamant about that," he said.

Microsoft also urged users to apply MS10-021 to protect themselves.

Although attacks had not been found in the wild exploiting any of the eight vulnerabilities addressed by the update, the company noted that users would "likely...see reliable exploit code developed for one or more of these eight vulnerabilities" in the next 30 days.

This month's security update, including MS10-021, can be downloaded and installed via the Windows Update and Microsoft Update services, as well as through Windows Server Update Services.

See also: Microsoft says rootkit could cause XP BSOD

Dell XP Migration SMB
Dell XP Migration SMB
IDG UK Sites

Lytro Illum release date, price and specs: Light field camera goes 3D

IDG UK Sites

Tim Cook says Apple aims to be best, not first, hinting that iWatch is coming

IDG UK Sites

Twitter - not news

IDG UK Sites

Fun film festival trailer plays with classic movie scenes