Spyware, Viruses, & Security

General discussion

kb891711.exe

by phil66 / March 9, 2005 7:26 AM PST

I received two update from microsoft today.

The kb8971711.exe version 4.10.2222 has placed and entry in my start-up folder in misconfig.

I have scanned the knowledge base articles recommended by the forum and still don't know any more than before I started looking.

This is the first time in all the years I have recieved updates this has occured.

Could some one please advise if this is a correct procedure for this update.

Thanks in advance

Dell 800mhz
Windows ME

Ray

Post a reply
Discussion is locked
You are posting a reply to: kb891711.exe
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: kb891711.exe
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Hi Ray
by roddy32 / March 9, 2005 7:42 AM PST
In reply to: kb891711.exe

You may have already read this article but you may not have either. It's got a bunch of expandable + marks in the "General Information" section of it. The update was released January 11th but this article was revised yesterday. I can NOT check my computer for to see if I have the same entry in my startup folder because I have XPSP2, which according to this article did not need this update/ Hopefully you can find an answer on it though.
http://www.microsoft.com/technet/security/bulletin/MS05-002.mspx

Collapse -
Hi Roddy
by phil66 / March 9, 2005 7:58 AM PST
In reply to: Hi Ray

Thanks for the reply

I have read KB's and articles until my glasses fogged up

I have never seen this type of entry from an update

All I need is another entry in my start-up folder

Maybe someone running ME wil see this and respond

Thanks again
Ray

Collapse -
does this have anything to do with some generic
by dawillie / March 9, 2005 8:18 AM PST
In reply to: Hi Roddy

updates for ME and Win 98SE?

david williams

Collapse -
Windows Me Kb in my startup too
by madmaof4 / March 17, 2005 7:25 PM PST
In reply to: Hi Roddy

I have Windows Me too. I noticed after my update that I have KB in my startup too. I hit Alt Control Delete and it is running. I am curious too.
Julie

Collapse -
Gates Gotcha? KB891711
by nuts2windows / March 18, 2005 8:05 AM PST
In reply to: Hi Roddy

My old Windows ME recently crashed after updating McAfee, Windows & a couple of antispyware programs. I reinstalled windows & all the programs & got the same result. After deleting the KB891711 from my startup in msconfig, along with all Mcafee entries & antispyware entries, I had no trouble.
The problem may be that Microsoft thinks it is a pirated version, since I replaced the hard drive with one from a defunct machine. Evidently, reading between the lines in Microsofts one-way-street statements, you should bury the operating system when the machine dies, you cannot transfer it to another computer or, heaven forbid, put in a new motherboard.
May I suggest getting Xandros 2.0.1 OCE (from linuxcd.org et al) & using it instead. You'll have to get a hardware moden (NOT a Winmodem) & may not be able to use your currant ISP (Netzero does have a Netzero.deb package that works) with dialup.

Collapse -
KB891711.exe
by gailstar / March 14, 2005 1:44 AM PST
In reply to: Hi Ray

I have win Me and that installed into my start up folder and I have major problems with everything now I am wondering about this as I am getting alot of errors and faults since. I am using a different pc to send this message it is not win me.

Collapse -
Take KB891711.exe OUT of startup!!!
by Marianna Schmudlach / March 14, 2005 5:04 AM PST
In reply to: KB891711.exe

go to run and type msconfig > startup and take the check mark for KB891711 out - reboot.

Collapse -
After taking out of msconfig
by Marianna Schmudlach / March 14, 2005 6:40 AM PST

you could UNINSTALL it via add\remove - it shows up as:

Windows Millenium Edition KB891711 Update.

Collapse -
Thanks
by Maljudges / March 30, 2005 7:00 PM PST

You have solved my problem :-}

Mal

Collapse -
This worked for me - Win98SE
by kmacd / March 18, 2005 8:00 AM PST

After downloading kb891711 I had huge problems starting InternetExplorer. Every time, windows crashed. To fix, I had to start Windows in safe mode then run msconfig.exe, go to the Startup tab and uncheck kb891711. Everything worked OK for me after that. HOWEVER . . . who knows if my machine is now vulnerable? But then, how vulnerable is a machine which doesn't work, anyway? I could find no mention of this problem on the Microsoft knowledge base site - do they monitor sites like this?

Good luck to Scotland in tomorrow's Calcutta Cup - we'll need it!!!

Collapse -
KB891711.exe & Win 98SE
by AnAngelLady / March 27, 2005 1:04 AM PST

Thank you Marianna for a tip that works. I did exactly as you said and now no more blue screens. Bless you!
May Angels Watch Over You!
Linda

Collapse -
Hi Ray .....
by Marianna Schmudlach / March 9, 2005 10:05 AM PST
In reply to: kb891711.exe
Collapse -
Hi Marianna
by phil66 / March 9, 2005 11:24 AM PST
In reply to: Hi Ray .....

I also got it in start-up got a notice from Win Patrol then went to misconfig and found it.

That is my question why is it there.
First time I have ever seen this.

I don't need any more things in start-up I am trying to understand Why

I am assuming that if I delete start-up it will not protect?

After reading all the KB"s and the other articles the forum suggested and the ones I found myself I still don't under stand why it is in start-up.

Thanks
Ray

Collapse -
Hi Ray
by Marianna Schmudlach / March 9, 2005 1:02 PM PST
In reply to: Hi Marianna

I couldn't find anything either WHY it should run at startup - I took it out via msconfig - it's a patch - so, why shouldn't it be enough as it is installed?? I leave it OUT of startup Wink

Collapse -
Goodmorning Marianna
by phil66 / March 9, 2005 11:24 PM PST
In reply to: Hi Ray

Thanks for the reply

I am going to take it out of start-up until M$ gives me a reason to have it in there.

Once again thanks for the help it is much appreciated

Ray

Collapse -
Good Morning Ray :)
by Marianna Schmudlach / March 10, 2005 1:59 AM PST
In reply to: Goodmorning Marianna

I looked through ALL the M$ write-ups - there is NOwhere to be found it should run at startup - it stays OFF at startup here Wink

You Are Very Welcome - have a great day Happy

Collapse -
Hi Marianna.....
by Ken Deyell / March 10, 2005 12:55 AM PST
In reply to: Hi Ray

I have been reading this "thread" with interest,as I had the same question as Ray.As you commented it is a "patch" however, it is entered in there as a ".exe" which would make one wonder if there is a purpose for it running.Surely Msft.could clarify this once and for all.

Collapse -
Hi Ken
by Marianna Schmudlach / March 10, 2005 1:39 AM PST
In reply to: Hi Marianna.....

I can't find anything why this exe should be run in startup as it is a "Recommendation: Customers should apply the update immediately." Since when do updates have to run at startup - doesn't make sense to me.....

Collapse -
I have..
by Ken Deyell / March 10, 2005 5:13 AM PST
In reply to: Hi Ken

never went wrong following your advice,so I am going to "uncheck" it from my startup list.

Collapse -
Way to go Ken .......
by Marianna Schmudlach / March 10, 2005 5:49 AM PST
In reply to: I have..

I do NOT have any trouble not running that "thing" at startup Happy

and my WinMe runs and runs and runs - like the old VW Beetle LOL

Collapse -
I unchecked it KB891711.exe
by gailstar / March 14, 2005 1:50 AM PST
In reply to: Hi Marianna.....

when i unchecked it and rebooted my screen went to 16 bit , ilost my control panel files, my i e icon says it cannot find iexplore, so i am on my son's pc which is win98 to find out what is going on but my Me pc is messed up now and all since this Kb891711 thing downloaded to my pc yesterday or day before not sure, my system restore won't work either

Collapse -
SHOCKING RESULTS ABOUT KB891711.EXE
by xtremerunner / April 16, 2005 1:49 PM PDT
In reply to: Hi Marianna.....

It seems that a lot of people are having problems with this so called patch. Myself being one of them. I'm running Windows 98 SE. When I would bootup my computer 30 seconds later it would freeze up. I figured that I might have a virus but my Norton Anti-virus program would no longer work. I remembered that Norton has a web site that you can go to that will run a virus scan on your computer. For all those interested it is: http://security.symantec.com. Now check out the result that I got after this scan, remembering that this is a Norton web based site. The scan flagged the file: KB891711.exe as a virus and also that it had adware attaced to it. Now if this file is suppose to be a patch why would the company that created the patch have a site that flags it as a virus. I think that maybe thats just what it is, "a virus", especialy since I removed this patch/virus from my computer I've had no more problems. I'm going to contact Norton to ask them about this. I hope this is helpful information and will update you on the answer I get from Norton about this issue but until then I would suggest that everyone treat this file as a "VIRUS". Amad

Collapse -
This is scarry; but I haven't had any more trouble!
by zeebell / April 16, 2005 3:09 PM PDT

(Gateway 400 Select PC; Windows 98SE; 160MB RAM; IE 6 SP1

I hope others respond to your post because I did re-download the patch a few days ago and have been fine. It even let me do scandisk and defrag which the original one would not.

I did do a control, alt, delete immediately after downloading and it did show KB891711.exe as running in the background. It has since disappeared from that list, but does show up in my add/remove programs list as well as my Startup list when doing msconfig. This in itself is a bit unnerving for me because it seems odd for it to show up there.

When downloading the original version, it never disappeared from my control, alt, delete list. I had to physically go in and uncheck it under msconfig to be able to accomplish scandisk and defrag. With the new patch, it no longer appears in the programs running in background list.

I have not had any problems, at least that I'm aware of at this point since re-downloading the patch.

Heaven forbid, does this need to come off once again?

Julea

Collapse -
it's a patch
by bob b / March 11, 2005 6:06 AM PST
In reply to: Hi Ray

The thing finally showed up for my w98 sys.

It shows as an exe in startup.

Where did you see it's a patch for winme/w98.

I can see it's a patch for other OS's but not these old OS's.

I'm wondering if kb891711 with it's exe. in startup is not a patch for these old OS's but rather a ride on top prog.

Collapse -
It came down the pike as a critical update.
by zeebell / April 17, 2005 6:01 AM PDT
In reply to: it's a patch
Collapse -
Here's the link for this
by PudgyOne / March 9, 2005 5:57 PM PST
In reply to: kb891711.exe
Collapse -
Hi Pudgy One
by phil66 / March 9, 2005 11:31 PM PST

This KB is a magnificent piece of work from M$
But it does not answer why a patch needs to have an entry in the start-up folder

Would you please provide a paragraph where you found it states the reason for having an entry in start-up I have not been able to locate

Tia
Ray

Collapse -
Some clarification from Microsoft
by dehayd / March 10, 2005 11:01 PM PST
In reply to: Hi Pudgy One

I've noticed the same thing running in the background on my WIN98 machine, and ran across this thread looking for info. Since nobody seemed to have a definitive answer, I decided to call their security support line.

Got with a tech support guy fairly quickly (!) and he explained that the KB891711 patch was not required for WIN98, even though the Windows Update service called it a critical update. He had me uncheck it in the Startup list on msconfig, and also remove it from the registry: Run Regedit, export a registry file to the desktop as a backup, go to HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/Current Version/

He had me look in both the "Run-" folder and "RunServices-" folders. KB891711 was in "RunServices-". Right-click and hit "delete." (As a bonus, I also noticed an entry for a piece of spyware in the same folders, and killed that, too.) Did a restart, and now it's no longer showing up in the Task Manager. Best MS tech support experience I've ever had. Now we just need to get them to update their online documentation to explain this more clearly.

Hope this info helps,
Alamo Dave

Collapse -
Microsoft claims KB891711 is required for Win98 and WinME...
by mbpetersen / March 11, 2005 12:27 AM PST

The link below from microsoft indicates that the cursor/icon vulnerability does exist on Win98 2nd Edition and WinME systems...to review the FAQ details. ...
Here is the response in FAQ:
Are Windows 98, Windows 98 Second Edition, or Windows Millennium Edition critically affected by any of the vulnerabilities that are addressed in this security bulletin?
Yes. Windows 98, Windows 98 Second Edition, and Windows Millennium Edition are critically affected by this vulnerability. A Critical security update for these platforms is available and is provided as part of this security bulletin and can be downloaded only from the Windows Update Web site. For more information about severity ratings, visit the following Web site.

Microsoft link describing this patch:
http://www.microsoft.com/technet/security/bulletin/MS05-002.mspx

While there is some vague language the statement above appears wuite specific that Win98/ME are exposed to this security leak.

Thoughts ??

Collapse -
Thoughts ??
by bob b / March 11, 2005 4:31 AM PST

Ya I have a thought.

It's all part of the MS MASTER PLAN of how to force the users of these old OS's to go to XP.(drive them loony)

I use w98se.

I got a notice of that update over a month ago.
When I read the bulletin it said it applied to my OS and to get it from WINUPD.

A visit to WINUPD said...NOPE.
A visit a few days later said...NOPE.
A visit a few days later said...NOPE.

So I chased it around the web for a while...NADA

As far as I can tell it's not installed on this machine and it's sure not in my start-up group and WINUPD still says I don't need it.

So the msg is..switch to XP and all this non-sense goes away. Happy

Popular Forums
icon
Computer Help 47,885 discussions
icon
Computer Newbies 10,322 discussions
icon
iPhones, iPods, & iPads 3,188 discussions
icon
Security 30,333 discussions
icon
TVs & Home Theaters 20,177 discussions
icon
HDTV Picture Setting 1,932 discussions
icon
Phones 15,713 discussions
icon
Windows 7 6,210 discussions
icon
Networking & Wireless 14,510 discussions

Tech Tip

Know how to save a wet phone?

It's not with a dryer and it's not with rice. CNET shows you the secret to saving your phone.