MS-DEFCON 3: September patches are as baked as they’re gonna get

Topic

New Reply

We had quite a ride with the last-minute patches to Win10 1803 and 1709. I think I’ve found out why MS released that huge bunch of kitchen sink fixes
[See the full post at: MS-DEFCON 3: September patches are as baked as they’re gonna get]

6 users thanked author for this post.

abbodi86, SueW, Elly, GreatAndPowerfulTech, jburk07, geekdom

Reply | Quote

Replies

Well, I dunno because, last few days, I got hit with the internet connectivity problem on my Win 7 Pro 64-bit machine from these Sept 11 patches.

About five days ago, I installed the two updates from Sept 11 because Susan showed them as OK on her patch list page, but about two days ago started having internet connectivity issues on reboots about every other reboot. (Strangely, internal network connectivity on my workgroup home LAN seemed to be OK.)

Trying to update the driver for my Intel NIC didn’t help.

SO I uninstalled three or four items that “Installed Updates” were showing with September dates, and it seems I am now OK.

Windows Updates is again showing me the same two items as before: KB 4457918 and KB 4457144.

But now that Woody is giving DefCon 3, I don’t know what to do.

Should I retry????

4 users thanked author for this post.

abbodi86, Myst, fernlady, FakeNinja

Reply | Quote

Wait for Woody’s instructions in ComputerWorld. They should be out shortly.

3 users thanked author for this post.

walker, Myst, woody

Reply | Quote

PKCano and others – Love this website and Woody’s articles in ComputerWorld, but I have not seen a fix for this issue where – on some (not all) reboots of my Win 7 Pro 64-bit system – I had internet connectivity problems.  Specifically, when I was away from this PC, I had difficulty using TeamViewer to access this PC remotely.  After some reboots of this PC, there was no connection at all, and after other reboots there was a connection but the remote mousing was very bad.  A totally new experience after using TeamViewer for years.

As I wrote above, when this happened some days ago, I UNinstalled all updates that I had installed in September, and that helped.  But after a day or so, the intermittent problem came back, and then (right now) has stopped.  No problem right now, but I’m afraid to reboot this PC.

And I have reinstalled the network card drivers, but that hasn’t helped.

Is there any fix?

Thanks.

Reply | Quote

UPDATE TO ABOVE —
I’ve had problems with internet connections the last 10 days when I reboot my Win 7 Pro 64-bit machine, which has Simple DNSCrypt and so of course the dnscrypt-proxy service and process.  (See the stupendous article https://arstechnica.com/information-technology/2018/04/how-to-keep-your-isps-nose-out-of-your-browser-history-with-encrypted-dns/  .)

Upon the most recent reboot with no internet connection, I saw that I had the Event Viewer Error “The DNSCrypt client proxy service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.”

Upon starting the dnscrypt-proxy service manually, I was suddenly connected.

Suspecting my Avast Free AV, I “excluded” the entire dnscrypt-proxy folder.  So far, so good – no internet connection problems on reboot.    My Avast Free is version 18.6.2349 (build 18.6.3983.371).

So maybe it’s not the September updates!!  And can anyone here persuade Avast to play nice with dnscrypt-proxy service?

Thanks.

Reply | Quote

FURTHER UPDATE —

I installed the two Sept cumulative updates for Win 7 Pro 64-bit, and so far so good.  (Group A.)

Reply | Quote

EVEN FURTHER UPDATE —

Sorry, but now I DON’T think it’s Avast’s fault.

Even with dnscrypt-proxy’s folder EXCEPTED from my Avast AV, Malwarebytes and CryptoPrevent, still half my reboots saw dnscrypt-proxy start BUT THEN STOP, leaving my PC cut off from the internet.

I tried some more things, but the only thing that’s working is to change the dnscrypt-proxy service to “Automatic (Delayed Start)”.

Something in my long list of startup apps, services and stuff is TERMINATING the dnscrypt-proxy process and service very quickly after they start.  Only the delayed start keeps it going, but that makes my bootup longer.

This link will take you to an xls with my entire Autoruns result. < THIS LINK >  (Rows with strikeout text are DISABLED and do not start.)  Do you see anything that would cause the dnscrypt-proxy process and service to terminate?

Thanks.

Reply | Quote

DEFCON 3 is not really that good.  DEFCON 4 & 5 are what we all hope and pray for.  There really has to be a good reason before I update early on a DEFCON 3.

Being 20 something in the 70's was so much better than being 70 something in the insane 20's

Reply | Quote

The trouble is that DEFCON 3 is about as good as it gets these days!

2 users thanked author for this post.

Myst, SueW

Reply | Quote

Woody, any ETA on when you’ll be recommending either 1709 or 1803 for the 1703 users? Just curious.

Reply | Quote

I’m cutting it right down to the wire. Probably sometime next week, after the 1703 patches dry up.

1 user thanked author for this post.

zero2dash

Reply | Quote

Any recommendation for someone who just bought a new HP Probook 450 G5 yesterday that came with Windows 10 Pro build 15063 installed?  I set it to a metered connection, so it hasn’t updated yet.

Now that we’re at Defcon-3, I am curious as to what build you would recommend, and if there are any special considerations.  I have two other machines with Windows 7 Pro that I’ve updated for September already, no problems.

Reply | Quote

They usually come through Half Baked, hopefully they’ll be better than that by now or Oct. 9.

🙂

Being 20 something in the 70's was so much better than being 70 something in the insane 20's

Reply | Quote

Wouldn’t that be the 8th? (Before all the patches change on the 9th?)

-- rc primak

Reply | Quote

Yep, sorry, sometimes I’m updating right up until the second Tuesday and sometimes, for reasons unknown to me, I don’t get the latest month’s updates until Wednesday.  But that’s me, you’re right about the 8th.

Being 20 something in the 70's was so much better than being 70 something in the insane 20's

Reply | Quote

Tried to install Sept. Patches and got hit with error code 0x8000FFFF. As I said in an earlier discussion on the error code topic I couldn’t find KB3177467 in installed updates.Tried to download and install from MS catalog and window popped up “This update does not apply to your computer.” Now what? Patched up through August with no problems. Win 7 SP1 x64 i7-core Haswell

Reply | Quote

Windows Update Troubleshooter
If you are having problems updating, select the correct version for your operating system, download it, and run it. It may not cure your problem, but then again, it may.
https://support.microsoft.com/en-us/help/4027322/windows-update-troubleshooter

For the whole banana, read here:
https://www.askwoody.com/forums/topic/troubleshooting-microsoft-tools-and-download-links/

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

2 users thanked author for this post.

MrToad28, Demeter

Reply | Quote

Also have Win7 Pro x64  i7 Haswell on a Zbook. Don’t have kb3177467 installed/listed in my installed updates. Was able to run kb4457145 without the error, go figure!

Reply | Quote

You may have gotten lucky and you still may want to install KB3177467. Read GoneToPlaid here:
https://www.askwoody.com/forums/topic/win7-servicing-stack-updates-managing-change-and-appreciating-cumulative-updates/#post-218937

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

@demeter… the message “This update does not apply to your computer” normally appears if you’re trying to install a patch for an incorrect OS architecture and I think you may have downloaded the wrong file from the catalog. There are separate files for 32 bit and 64 bit and you MUST download & install the one that matches your version of Windows.

Look at the name of the file you tried to install… right after the KB number in the file name you will see either “x86” or “x64”. The “x86” version is for 32 bit and the “x64” version is for 64 bit.

3 users thanked author for this post.

jburk07, Demeter, geekdom

Reply | Quote

Halleujah. I did find the correct version of KB3177467 by clicking a link in Woody’s Computerworld article about error 0x8000FFF from a couple of weeks ago. It installed and and then I was able to install KB4457144 without error. This has taken up most of a morning as I had KB4457144 fail 3x, ran Windows Troubleshooter more than once, to no avail. KB4457918 and KB890830 had already installed OK without error. All appears to be tickety-boo.   Win 7 Pro x64, Grp. A, i7-core Haswell

4 users thanked author for this post.

MrToad28, woody, jburk07, geekdom

Reply | Quote

You’d think the Win7 installer would be smart enough to update itself – or at least not spit out fatuous error codes.

Reply | Quote

I’m having the same problem with the Win 7 updates. KB4457918, the .NET Framework update installed properly.  KB4457144, the Security Rollup, has failed repeatedly with Error Code 8000FFFF.   The Window Update Troubleshooter did not fix all the problems and this update still will not install.  I don’t recall having this problem in the past.  Any other suggestions?

iPhone 13, 2019 iMac(SSD)

Reply | Quote

Prior to installing KB4457145, KB4457144, you must install KB3177467. Pick the correct bit-size for your computer and download it and install it:
https://support.microsoft.com/en-us/help/3177467/servicing-stack-update-for-windows-7-sp1-and-windows-server-2008-r2-sp

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

1 user thanked author for this post.

pmcjr6142

Reply | Quote

Geekdom…I’m not really aware of what KB3177467 is supposed to do or what problem it’s supposed to fix, but after installing it, the problem Win 7 update, KB4457144, installed properly.  Thank you very much for posting this fix.  Now that it’s installed, did it fix a problem that might have prevented future updates from installing as well?

iPhone 13, 2019 iMac(SSD)

Reply | Quote

GoneToPlaid explains here:
https://www.askwoody.com/forums/topic/win7-servicing-stack-updates-managing-change-and-appreciating-cumulative-updates/#post-218937

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

3 users thanked author for this post.

walker, Demeter, pmcjr6142

Reply | Quote

Please see this Thread about 0x800FFF

3 users thanked author for this post.

walker, Demeter, pmcjr6142

Reply | Quote

Just did jump to 1803 from 1703 and with the exception of having to redo some of my settings, it did very well. Actually 1803 fixed a couple of software bugs that were present in 1703 and gone in 1803. Overall Win. 10 upgrade is working out better than having 1703. My Win. 7 updates and Office 365 all went on with no problems encountered. Best update month, for me anyway, in a long time.

Reply | Quote

I advice you to wait for a few days, usually the versions issues start to appear weeks following upgrades.

2 users thanked author for this post.

Myst, OscarCP

Reply | Quote

I installed KB4457918, KB4457144 and KB890830. All went ok but had a strange blue screen with a pop-up saying Personalizing your personal settings for desktop. I have never have seen that before! Something new????

Windows 11 Pro
Version 23H2
OS build 22631.5335

2 users thanked author for this post.

walker, OldBiddy

Reply | Quote

I also have Windows 7 and had the same problem last year. What happens is that information with your user profile, such as your chosen desktop layout, your login user id and password, etc. has been lost and now Windows “assumes” that this is the very first time you are using this machine. To avoid this happening again, someone here advised me to get rid of services not started by MS that I had installed on my PC. I did that, if fixed the problem, but cannot find now the notes I wrote down on how to do this. Perhaps someone else here can help fernlady with this particular problem?

Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).

MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV

Reply | Quote

That pop-up went away after a few seconds. Think it will do it again in the morning after being shut down all night? Hope not!

Windows 11 Pro
Version 23H2
OS build 22631.5335

Reply | Quote

I have seen this during installs this month. I think it is something MS changed in the patches. You shouldn’t see it again. Breathe easy!

7 users thanked author for this post.

walker, SueW, Myst, jburk07, OscarCP, geekdom, fernlady

Reply | Quote

ok Thanks PK

Windows 11 Pro
Version 23H2
OS build 22631.5335

Reply | Quote

OK, your explanation from the Ignite presentation seems to make sense since some early 1803 bugs were fixed first in 1809 Insider builds. However, it remains to be seen if all the fixes will get ported back before the version where the bug first appeared is expired! Not quite sure I understand the wisdom in this approach.

Reply | Quote

I will wait until I know for sure either 1803 or 1809 have issues regarding feature updates.

As for september updates, I will install them right away

Just someone who don't want Windows to mess with its computer.

Reply | Quote

woody wrote:

We’re now at MS-DEFCON 3: Patch reliability is unclear, but widespread attacks make patching prudent.

Which are the widespread attacks? (No mention of any in this Compterworld article.)

woody wrote:

Just remember that if you hit an error 0x8000FFFF when installing the Win7 Monthly Rollup, it isn’t your fault.

… except that you did fail to install a Critical update for two years.

woody wrote:

Step 1. Make a full system image backup before you install the June patches.

June?

Reply | Quote

Glad you asked!

b wrote:

Which are the widespread attacks?

The FragmentSmack attack

The ALPC Elevation attack

CVE-2018-8475, which still isn’t very well documented.

b wrote:

except that you did fail to install a Critical update for two years.

Correct, except it’s a “critical” update that doesn’t even appear on your Windows Update list unless you’ve completely cleared out the cache. There’s a reason why MS has promised that they’ll fix it next month.

b wrote:

June?

Yikes. Man oh man,  you got me there. Sorry about that!

3 users thanked author for this post.

abbodi86, Elly, Demeter

Reply | Quote

woody wrote:

Glad you asked!

b wrote:

Which are the widespread attacks?

The FragmentSmack attack

Mostly servers (and Linux)?

desktop users will rarely see a FragmentSmack attack

woody wrote:

The ALPC Elevation attack

Anything happen since, “Right now, it’s not a huge threat.”

woody wrote:

CVE-2018-8475, which still isn’t very well documented.

Because there’s still no attack?

Not getting the “widespread” aspect of any of these three.

But also not seeing how “sweeter and cleaner than we’ve seen in a long time” equates to “Patch reliability is unclear”.

Reply | Quote

b wrote:

Anything happen since, “Right now, it’s not a huge threat.”

Yes. https://www.askwoody.com/2018/the-windows-alpc-security-hole-cve-2018-8440-is-now-readily-exploitable/

b wrote:

But also not seeing how “sweeter and cleaner than we’ve seen in a long time” equates to “Patch reliability is unclear”.

The first wave of patches in September were quite benign. The second wave was so bad, MS yanked them within a day.

2 users thanked author for this post.

SueW, columbia2011

Reply | Quote

The first wave of patches in September were quite benign. The second wave was so bad, MS yanked them within a day.

Otherwise known to MS Updates veterans as the Sweet Spot. Sad, really.

-- rc primak

Reply | Quote

b, I have to agree with Woody regarding the following:

b wrote:

woody wrote:
Just remember that if you hit an error 0x8000FFFF when installing the Win7 Monthly Rollup, it isn’t your fault.

… except that you did fail to install a Critical update for two years.

Yes b, if KB 3177647 update was always listed as being “Critical”, you could blame the end user. This update, however was listed according to my notes as important (not critical) as of 11/15/2016. In addition, a colleague just emailed me and told me his notes indicated that the KB3177647 was found under optional windows updates. There are others in Woody’s forum documenting this patch as being listed as important on Woody’s site even months after the update came out. There were people still asking in Woody’s forum in Jan 2017 if they should install KB3177647 or not. https://www.askwoody.com/2017/has-microsoft-finally-solved-the-windows-7-slow-update-problem/
Also when installing Windows 7 from scratch, Woody had a post discussing  not getting offered KB3177647. https://www.askwoody.com/2017/installing-win7-from-scratch-kb-3177467-kb-3020369-and-kb-3172605/
When a patch is listed as important and possibly even found under optional updates, you can’t blame the end user for hiding it. I did install patch KB3177647 but might have easily hid the patch myself, since I was not having issues with slow updates. It would have never occurred to me that not installing this patch would have severe consequences two years later. Yes currently the update is categorized as Critical, but it has not been listed as a Critical for 2 years. I suspect the status changed from important to critical after recent serious problems surfaced.

5 users thanked author for this post.

Microfix, SueW, Demeter, satrow, woody

Reply | Quote

“September patches are as baked as they’re gonna get”

Seems optimistic to me.  After all, there are still 8 days left before October’s Patch Tuesday!

2 users thanked author for this post.

Myst, OscarCP

Reply | Quote

Well not much to report really:
Win8.1×64 Office 2016 bumper crop for all of Sept, no worries, then again is it ever? with 1.04GB’s download.
Win10x64 no misery there, Still on Augs awaiting Sept’s with deferrals set we have all that to come, yet.
Win7x86 Office 2010 no worries all of Sept again at 225MB’s
Win7x64 x2 Office 2010 and 2016 Sept all 355MB’s download, well yeah hit the problem @woody outlined in his article, I guess I should have waited but “Fools rush in where Angels fear to tread” this got the 0x800FFFFF error, so if its not in your list of installs, you can find it here: https://www.catalog.update.microsoft.com/Search.aspx?q=3177467
Didnt get bitten on the 2nd Win7x64 Machine though 😉
Now the waiting begins again, quite nice though seeing the Win 7 Update Screen/Window all Green again and not a sign of the <oem.inf> error and full connectivity in the network on all machines concerned.

1 user thanked author for this post.

Microfix

Reply | Quote

Windows 7:
Prior to installing KB4457145 or KB4457144, you must install KB3177467. Pick the correct bit-size for your computer and download it and install it:
https://support.microsoft.com/en-us/help/3177467/servicing-stack-update-for-windows-7-sp1-and-windows-server-2008-r2-sp

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

1 user thanked author for this post.

BobbyB

Reply | Quote

I actually got at the point that all those ridiculous updates don’t make me angry anymore. They just make me feel sad. I lost many nights on repairing the damage they introduced. I am self employed, up to 2015 I was happy with my work. Nowadays, I realize that besides doing my work and running my business, I also have to be a full time system administrator. It costs me a lot of extra time I NEVER wanted to invest in my work. Before Windows 10, I had the feeling I was in control of my computers. Now, every day I wonder what nice surprises Microsoft will push on me this time, what troubles will lie ahead. The involved stress and wasted time are not healthy for family life. Neither are they good for work quality. A computer should just be a tool, under control of its owner. Nothing more, nothing less. If I would be a carpenter (I really should have chosen that profession) I don’t have to worry every day if my hammer will work. Or if some sneaky thief in the night changes something on this tool that might make it unusable. Why do we pro users accept this malware-like behavior of Windows any longer? :-/

3 users thanked author for this post.

Charlie, Spiral, Myst

Reply | Quote

Been running the Win 7 updates since September 18. Zero problems.

-Noel

5 users thanked author for this post.

dgreen, jburk07, Myst, BobbyB, geekdom

Reply | Quote

I have KB4464218 and KB4100347 hidden in WUShowHide on a Win10 Home v1803 (17134.228) system.

Today I turned off metered WiFi connection to apply updates, per MSDefCon 3. When I went to Windows Update page of settings screen, it proceeded to download and start installing KB4464218 and KB4100347.

I went back into WUShowHide and confirmed these updates are still “hidden.”  Despite that, Windows Update says they are being installed.

Apparently John Wilcox has volunteered to be my system administrator.

Reply | Quote

How did it end up?

Reply | Quote

Please read this post about clearing the Windows Update queue between using wushowhide and opening Windows Update. If you don’t do this, the unwanted updates are still in the queue even after you have hidden them with wushowhide, and they will install in spite of the fact that you think they are hidden.

4 users thanked author for this post.

walker, Myst, Laptop Boy, woody

Reply | Quote

so, for group b, i’m following 2000003:

windows 7:
Sep 2018 KB 4457145
Sep 2018 (IE11) KB 4457426
Sep 2018 (IE11) KB 4463376
reboot (twice?)

windows 8.1:
Sep 2018 KB 4457143
Sep 2018 (IE11) KB 4457426
Sep 2018 (IE11) KB 4463376
reboot

and then all the office 2010, flash, msrt, .net updates… right so far?

3177467 is installed already, so this should be no problem…

PC: Windows 7 Ultimate, 64bit, Group B
Notebook: Windows 8.1, 64bit, Group B

Reply | Quote

@honx…

I’m not dead positive here and hopefully a knowledgeable source (PKCano?) can clear this up but it’s my understanding that if you didn’t already install KB4457426 you can just install KB4463376.

The later is slightly larger in file size so I’m guessing it also contains the former?

2 users thanked author for this post.

Laptop Boy, honx

Reply | Quote

You can install:
Win7 Sep 2018 KB 4457145, Sep 2018 (IE11) KB 4463376
Win8.1 Sep 2018 KB 4457143, Sep 2018 (IE11) KB 4463376

There is no need to install two IE11 patches. The later one is sufficient.

5 users thanked author for this post.

walker, Laptop Boy, SueW, honx, Ed

Reply | Quote

thanx!

i installed these and after reboot i installed available updates for office 2010, .net, msrt, flash, … this time there was only one update available for excel 2010, no other office updates…

and now i understand why i i have to reboot twice after windows update: today i noticed, that windows update doesn’t release ram after its closed. according to process explorer there are 600-800mb physical memory less. and on a small system with only 6gb ram this really becomes noticeable!

and something weird, another reason that made me reboot once again: despite having working internet connection (i was able to use browser), internet status icon in taskbar showed broken status (small red cross).

PC: Windows 7 Ultimate, 64bit, Group B
Notebook: Windows 8.1, 64bit, Group B

Reply | Quote

After Windows Update completes and you reboot for the first time, I may take the installer another 20 minutes to complete it’s tasks. That’s why it doesn’t release the memory. Your second reboot just interrupts the process and it will have to complete eventually. It’s a good chance your problem with the icon was due t the fact that the install hadn’t completed.

After Windows Update and reboot, try not to use your computer for 15-20 minutes and let it complete the install process.

9 users thanked author for this post.

walker, OscarCP, Myst, Demeter, Laptop Boy, jburk07, SueW, honx, geekdom

Reply | Quote

thx, i’ll consider that in future. for septemper patches it’s now too late, obviously. 🙂

you can delete my anonymous post. for whatever reason i was logged out again…

PC: Windows 7 Ultimate, 64bit, Group B
Notebook: Windows 8.1, 64bit, Group B

Reply | Quote

“There is no need to install two IE11 patches. The later one is sufficient.”  I’m sorry to have to bother you again this month with this but:

The Sept. IE-11 KB 4457426 is marked as a Security Update and its rating is Critical.

The Sept. IE-11 KB 4463376 is only marked as an Update and its rating is Unspecified.

As a Group B person should I (we) be concerned about this and installing “Security Only” Updates in proper security date sequence?

It seems that MS has a nasty habit of releasing a revised update, but not revising/updating the pertinent information about it.  Again I’m just asking to be sure.

Being 20 something in the 70's was so much better than being 70 something in the insane 20's

1 user thanked author for this post.

Microfix

Reply | Quote

Nothing to be concerned about. IE11 patches are cumulative. Just follow PKCano’s advice which makes sense, whereas MS’s patch explanations frequently don’t.

Windows 10 Home 22H2, Acer Aspire TC-1660 desktop + LibreOffice, non-techie

1 user thanked author for this post.

Charlie

Reply | Quote

See my post with regards to clearing up any confusion:

post-217699

Microfix wrote:

kb4457426 is the initial IE11 security fix released 11th Sept 2018 that whilst addressing security issues, also creates a performance degradation in IE11 (integral to both W7 and W8.1)

kb4463376 is the latest IE11 Security fix released 14th Sept 2018 that fixes the performance degradation as well as overwrites kb4457426 OR can be installed without the need for kb4457426.

So, kb4463376 IS a security fix for both SO and SQMR patches irrespective of whether you use IE or not.

Windows - commercial by definition and now function...

1 user thanked author for this post.

Charlie

Reply | Quote

PKCano: ” You can install:
Win7 Sep 2018 KB 4457145, Sep 2018 (IE11) KB 4463376 ”

First I looked at the list of installed updates to see if I had KB3177467. I did. Then I installed the checked updates offered through Windows Update for Office 2010, the big multi-version .NET patch and the MS Malware Removal Tool. Then created a restore point and installed the September Security Only and the cumulative IE 11 patch PKCano has mentioned (above). Restarted, tested my most valued applications and also IE11 to see if they were still working as usual, and all was well. At that point, and rather surprisingly, an update for Adobe’s Flash for Win 7 showed up (so, this time did not not have to go and dig it up from Adobe’s site) and I installed that as well.

I restarted the PC a second time, just for the devil of it: once more, everything I checked again worked normally.

Bottom line: Nothing bad to report.

Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).

MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV

Reply | Quote

@OscarCP…

According to Adobe’s Flash site (link below) the most recent version of Flash available for Windows 7 is version 31.0.0.108. This version shows as being installed on all of my Windows 7 computers almost a month ago on September 11th.

https://get.adobe.com/flashplayer/

1 user thanked author for this post.

SueW

Reply | Quote

Like some of the other people I am having trouble getting KB4457144  to install.  I am getting error 8000FFFF .  Maybe this is something Woody could weigh in on and give us some simple step by step instructions as to what to do.

Reply | Quote

Prior to installing KB4457145 or KB4457144, you must install KB3177467. Pick the correct bit-size for your computer and download KB3177467 and install it.

The link for KB3177467 is here:
https://support.microsoft.com/en-us/help/3177467/servicing-stack-update-for-windows-7-sp1-and-windows-server-2008-r2-sp

Then install KB4457145 or KB4457144.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

2 users thanked author for this post.

walker, woody

Reply | Quote

Please read this thread on 0x800FFF.

2 users thanked author for this post.

walker, woody

Reply | Quote

See https://www.computerworld.com/article/3305762/microsoft-windows/error-0x8000ffff-in-win7-phantom-patch-for-win10-1803-theres-a-solution.html

Reply | Quote

I m sure glad that Microsoft thinks that I don t have anything else to do but try to figuire out what  I should do when KB4457144 doesn t want to install.

If they new that I would have to install KB3177467 first before KB4457144 they should have setup the update that way.

I guess they think I don t have anything else to do with an hour of my time.

 

1 user thanked author for this post.

woody

Reply | Quote

Reporting in:
Installed kb4457144 rollup (already had kb3177467 in installed updates)
Install went smoothly. No issues.

waited about 30 minutes

Installed kb4457918 (.net rollup)
Install went smoothly. No issues.

Dell Inspiron 660 (new hard drive installed and Windows 7 reloaded Nov. 2017)
Windows 7 Home Premium 64 bit SP 1 GROUP A
Processor: Intel i3-3240 (ivy bridge 3rd generation)
chipset Intel (R) 7 series/C216
chipset family SATA AHCI Controller -1 E02
NIC Realtek PCLE GBE Family Controller

MSE antivirus
Chrome browser

dgreen———–out

3 users thanked author for this post.

Myst, jburk07, Microfix

Reply | Quote

KB4457918 (.NET Rollup)??

2 users thanked author for this post.

walker, dgreen

Reply | Quote

PKCano wrote:

KB4457918 (.NET Rollup)??

PKCano
Yes, sorry that’s the one I installed.
Will fix my post above.

UPDATE:
I don’t have an “edit” option on my above post. Why is that?
PKCano can you fix my post with the correct .net rollup KB4457981?

Reply | Quote

Now amended 🙂

@dgreen FYI the edit button only lasts for a certain period of time on each post.

Windows - commercial by definition and now function...

1 user thanked author for this post.

dgreen

Reply | Quote

Many thanks once again to Woody, et. al.  Reporting in as well:

1 – imaged my disk with Macrium Reflect

2 – downloaded Updates KB4457145 (Sept. SO) & KB4463376 (IE11 Sept. Cumulative)

3 – installed each Update and then rebooted; waited 15 minutes

4 – checked “Windows Update” => 5 Important: 2 Office 2010 [Excel (KB4227175) and Office (KB4092436)] and 3 Win 7: all checked; 2 Optional: both unchecked

5 – unchecked and hid “Important” update KB4457144 (Sept. Rollup)

6 – hid the 2 unchecked “Optional” updates (KB4457139 – Sept. Preview Rollup and KB4458611 – Sept. Preview .NET)

7 – checked “Windows Update” again => 4 Important: 2 Office 2010 and 2 Win 7: all checked; 0 Optional

8 – unhid any hidden updates to install (none)

9 – installed 4 Updates: 2 Office 2010 (KB4227175 & KB4092436), KB4457918 (Sept. Security and Quality Rollup for .NET Framework) and KB890830 (MSRT)

10 – rebooted; waited 40 minutes (until the hard drive light stopped flashing)

So far . . . so good . . .

Note: NIC = Realtek PCIe GBE Family Controller

Win 7 SP1 Home Premium 64-bit; Office 2010; Group B (SaS); Former 'Tech Weenie'

3 users thanked author for this post.

walker, jburk07, Microfix

Reply | Quote

SueW:

obtain latest Realtek PCIe GBE Family Controller driver from Realtek’s web site.

Version 7.121 for Windows 7 released 9/26/2018

2 users thanked author for this post.

jburk07, SueW

Reply | Quote

@EP, thank you for the link — that’s hot off the press 😉

Win 7 SP1 Home Premium 64-bit; Office 2010; Group B (SaS); Former 'Tech Weenie'

Reply | Quote

Win7 user here, on plan A. Worked fine. Still weird seeing it remake my desktop every time and showing a black screen for such a long time. But I’ve grown to expect that.

What’s different this time is that TrustedInstaller kept running for a long time afterwards, and it tripped Chrome’s built-in malware scanner, all of which made my computer useless for 10-15 minutes after I got a desktop.

Reply | Quote

A month ago, we (I’m Win7 64bit) were warned about KB2952664 and KB315053 as items to avoid, but now we’re only being warned about the first, and not the second, in the “Woody on Windows” article in Computerworld. Unless I’m missing something. =?

Reply | Quote

Win 7 Group A 64 bit Windows Home Premium user. Already had KB3177467 installed. I installed KB4457144 September roll up and the MSRT first since I’ve noticed in the past installing the .NET at the same time can cause problems. All the updates went ok. Last month when I installed all the security updates (for August) I saw an error code 80200010. This appeared when the KB4343900 August monthly roll up failed. The .NET roll up worked then though. When I installed KB4343900 the second time it worked ok. I know this error isn’t related to the 0x8000FFFF error since I already have KB3177467 installed. But I don’t know why the August security roll up failed with error code 80200010. The only somewhat useful reference I can find for this error is here:
https://answers.microsoft.com/en-us/windows/forum/windows_other/windows-7-error-code-80200010/90c9c817-1a4e-4522-b419-8d166b127cd9

Sorry for mixing apples and oranges with my rambling!

2 users thanked author for this post.

jburk07, Myst

Reply | Quote

Group B, Windows 7 / Windows 8.1 (and now Windows Server 2008).

Ever since I have my Windows 7 and 8.1 systems patched to June 2018 level after waiting almost 6 months from January 2018 when Meltdown / Spectre first broke, I have not patched my machines at all. My Windows systems are still running well.

Part of me is lazy, and part of me has found no urgency to do so. My experience since the Meltdown / Spectre patch problems is that it is better to wait (months if necessary) just to see if there are any belated problems that may arise. I think someone has already said something similar to this before but I shall repeat it :

The danger of clobbering your Windows machine (be it running Windows 7, 8.1 or 10) via a Microsoft Security Update is currently much greater than the risk of an “attack”.

Hope for the best. Prepare for the worst.

Reply | Quote

I’ve today installed the monthly quality rollup (I really should report that name to Trading Standards) and the .Net Framework rollup updates on my first Windows 7 x64 desktop, no problems so far. I have hidden the MSRT and a couple of optional preview updates.

If all goes well for the next day or two then I’ll install the same updates on the other machine along with the Office 2010 updates depending on what is offered, that machine is still on “Never check” at the moment.

Thanks as always to Woody and the team for staying on top of things.

2 users thanked author for this post.

jburk07, Myst

Reply | Quote

Group B here.
Just installed IE sep KB4457426 and SO sep KB4457145, no .net or other updates.
All seems fine.

Not clear if I have to install IE KB4463376…? (I don’t use IE as a browser)

 

Reply | Quote

KB4463376 contains fixes for bugs in the 2018-09 IE11 Cumulative Update. Even though you do not use IE, IE is integral to the OS and this patch will need installing to be on the safe side.

Windows - commercial by definition and now function...

Reply | Quote

Thanks @Microfix, I know Windows System does.

I will install KB4463376 too.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

YOu may not use IE, but the Windows system does. If you do not update it, you leave your computer vulnerable because it is a part of the OS.

2 users thanked author for this post.

walker, geekdom

Reply | Quote

Thank you too (always) @PKCano!

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

KB4463376 installed just fine.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

LTL the 4457426 is the security cumulative and the 4463376 is not specifically a security update but a sluggishness fix for “roaming”, etc.

Yes you do need to keep IE up to date since the OS uses shared DLLs.

The 4463376 will not hurt anything. I do not plan to install it unless I see an IE ‘sluggishness” that appears from nowhere.

That fix will be applied to the next IE cumulative update for October, available in a few days for those that do not wait like they should.

I will get that fix later in October’s update when Woody says to proceed.

Even if you do not use IE11, it comes with the OS and it is always good to have an emergency backup Web Browser in case the one you normally use fails.

Reply | Quote

Windows 10 Home
64 Bit
Version 1709 build 16299.611

Background:  So far I have not a found specific list of Windows 10 Home updates okay to install for 1709.

I am assuming Woody suggests we not go forward to update to version 1803, now hidden

I think once again, as in August, I was not offered the September Cumulative update.

1.  What Cumulative KB update number do I need for September if not listed below?

2.  For the following list, I will not list MSRT, adobe Flash or KB4023057–The evil update assistant.

I was offered the following updates.  Which ones should I install?
KB 4056254
KB 4023814
KB 4090007

Thank you so much for your help!

Reply | Quote

What you need:
KB4457142 The Sept Patch Tuesday Cumulative
KB4464216 patch for Intune and VPN only if offered through Windows Update.
The Update or Flash Player (it will have Flash in the name)
The MSRT

None of these: KB 4056254, KB 4023814 (to do with upgrading), KB 4090007 (Intel microcode – hold off on this for now)

2 users thanked author for this post.

walker, Irene

Reply | Quote

Dear PK Cano-  Thank you so much for the reply.

I don’t understand why I am not being offered the cumulative updates, but it may be MS way of getting me to update to newest version.  Clearly not your issue or job to figure out why, just my wondering.

I will get  KB4457142 The Sept Patch Tuesday Cumulative Update from the MS Catalogue.

I was not offered KB4464216.  I do not know what Intune is and that probably is a bad thing–will look it up. Due to Windows 10, for the most part I have become a Mac user, but need a Windows for work and old work things.

I use a private VPN-Tunnel Bear.

I so appreciate your help!

I am sure someone else will be able to use the information.

Thanks!

 

Reply | Quote

Also installed KB890830 and .NET KB4457918 without any problems.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

Win7 x64 sp1 Just tried to install Sept quality rollup by itself (kb4457144) and after it rebooted got error code 80070490 and it reset back. First time I have ever gotten an error code. Do I try again later or is this a problem? Looked on the internet and it looks like it could be a problem

Reply | Quote

Please read this thread on 0x800FFF.

1 user thanked author for this post.

walker

Reply | Quote

Before I tried to install the rollup I checked to be sure I had kb 3177467 and it was showing as installed in 2016. Now after the failure to install the Sept rollup it doesn’t show kb 3177467 as an installed update but when I try to install it the message comes up as it is already installed. Huh? I don’t get it

Reply | Quote

Also looking up that error code it say a file or setting in the CBS (Component Based Servicing) manifest is corrupted or damaged. I’m lost

Reply | Quote

Try the troubleshooter first. Cleaning out the datastore is more complicated.

Reply | Quote

OK, From what I read on that error, I am going to recommend you try the Windows Update Troubleshooter.

Reply | Quote

Cleaning up the Windows update queue steps,  is that we need to do it every time we power up the pc before checking the window update? 

Reply | Quote

When you run wushowhide and hide updates, they are not removed from the Windows Update queue automatically. If you hide them in wushowhide, then go immediately to Windows Update in Settings, they will still be in the queue unless you first clear the queue. Since they are still in the queue, they will be downloaded and installed with the other pending updates, even though you thought you hid them.

So, this sequence:
Run wushowhide.
If you do not hide updates, you can safely go directly to WU.
If you hide updates, then clear the WU queue before you go to WU.

1 user thanked author for this post.

walker

Reply | Quote

Thanks for the info.  After the first time going through all the steps,  finishing the download and the windows update service has set to Manual.   My question is next time when the computer boots up, am I still required to go through all the steps to disable and stop the service after hiding any KB using wushowhide?

Reply | Quote

You need to go through the procedure between using wushowhide if your intention is to go directly to Windows Update. Once you hide an update, it is a good idea to clear the queue before going to WU so you don’t install patches you think you have just hidden.

It is not something you have to do each time you boot the computer.

1 user thanked author for this post.

walker

Reply | Quote

Windows 7 SP1 64bit, with Broadcom network card. Group B.

Installed September’s updates; IE11 KB4457426, Security Only KB4457145.

Installed from main .NET KB4457914 update the kb4457055 SO – the one for 3.5.1.

From the catalog; Installed IE11 first, Windows SO 2nd, .net 3rd, and last from WU the MSRT.

Installed one at a time. Rebooted in between.

No network issues. No oddities. However I did see a lot of hard drive activity and waited about 2 minutes after each install before rebooting (or clicking Restart).

Manually ran .net image compiler (NGEN). http://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx

Rebooted 3 times and let it sit for several minutes.

I would recommend people on the last reboot to go to the desktop and let it sit 45 to 60 minutes to Process Idle Tasks and let the trusted installer (as per PKCano) do its thing.

No Problems.

Thanks to all here.

Reply | Quote

There was an update issued 9/14 for the IE11 CU KB4457426 to fix a problem with a process decrease using roaming profiles or not using MS Compat List . The patch was KB4463376 if you want to install it.

1 user thanked author for this post.

walker

Reply | Quote

Windows 7 SP1 64bit, with Broadcom network card. Group B.

PKCano, Thank you for your suggestion. I was not going to install KB4463376 since it deals with roaming and non use of compatibility list issues with IE11 and it did not apply to me.

However, I did end up installing it. Here is why.

Yesterday I installed IE11 KB4457426 and opened a web page and it was fine (or so it seemed). I continued with the installs of the above patches mentioned. All seemed well.

Today I went to a site in IE and it crashed. I tried a few more times and the same. IE would not open the site it had a popup message that it crashed and should be closed.

After much research, it turned out to be Web of Trust (WOT) for IE11. I have had it for years and it worked well. It was a June of 2015 dated file or install. Disabling WOT stopped the crashes.

So anyone using WOT in IE that has a new crash that happened after the September updates please take note.

Thank you.

Reply | Quote

You probably need to update the WOT add-on for IE11 to it’s current version.

1 user thanked author for this post.

walker

Reply | Quote

PKCano, that is an excellent point. You are wise. However, when I went to do that there wasn’t a new version or download for IE any more. All but IE is shown, even though it has an IE icon in its list of supported browsers. Going there in Firefox or IE, it only wanted to install for android, right then with a download button.

Reply | Quote

Hi, i’m sorry if this has been covered already, but I keep getting
Windows 7-.NET Framework 4.7.2 as checked these few months…
I understood previously that 4.7.2 would not be beneficial
for Windows 7 to install, is this the ongoing thought?

I install the Security and Quality Rollup updates for .NET Framework,
and it gives me the 4.6.1 updates. Is this enough?
Thanks.

Reply | Quote

I would hold off on installing .NET 4.7.2 on Win7 at this time unless you are using a program that requires it. If you right click on it in Windows Update and hide it, it will be available if you want to install it in the future.

The .NET Rollups delivered through Windows Update will detect the version(s) of .NET installed on your computer. That should be enough.

3 users thanked author for this post.

walker, SueW, jburk07

Reply | Quote

My laptop is on win 1803 home edition, and the windows update service has set to Manual as suggested.  Using wushowhide I find there is flash update for Sept. is available.  Going to the setting,  update and security tab,  I didn’t find the flash update is being offered, it said my system is up to date, and the last check was three days ago.  Since the window update service is now to set Manual, do I need to click the check for update button every time to order to find any further new updates?  I don’t want to be the seeker also for win 1809.

Reply | Quote

The 1809 Feature Update has been pulled by Microsoft because it is buggy. It is no longer waiting to catch “Seekers.”  So, run wushowhide to be sure there are no other patches that you don’t want. If there are, hide them, then go ahead and update the IE Flash.

Tomorrow is Patch Tuesday, and there is no guarantee MS won’t release 1809 then. But for today you should be safe.

1 user thanked author for this post.

walker

Reply | Quote

Thanks, with the window update set to Manual, I have to click the check for update button every time I need to see if there is any new updates offer to the system, the window will not automatically check the update anymore?  Also once Microsoft  releases the 1809, click the check for update button will become an seeker again?

Reply | Quote