HolidayBuyer's Guide

Computer Help forum

General discussion

Deleting Microsoft's update KB908531

by stinkyda / May 13, 2006 3:49 AM PDT

Hello, I have reason to believe that Microsoft's update KB908531 prevents certain software programs from intstallation and or functioning properly.

When Norton reported 49 files infected by, what they call, a PWSteal.Bancos virus, quarantined and asked if I want to delete them I opted yes. Windows XP then asked if I want to delete shared files but doesn't say which and how they are shared with, again I opted yes. Result: Quicken and other programs didn't function anymore. After more than a month of wasted time on email and discussions with various customer support technicians I decided to utilize System Restore which didn't fix the problem. Finally I used Destructive Recovery. Then I reinstalled Windows XP updates including SP2. Thereafter Quicken worked but other programs like Webster's Dictionary and Adobe Photo Deluxe etc. could not be reinstalled or don't function. Eventually I found someone on HP's support staff who suggested to delete the KB908531 update file. The problem is that Add/Remove programs cannot remove that file even not in Safe Mode. Is there a way of removing that file without going through the Destructive Recovery ordeal again?
It appears that files which worked before the hard disk has been reformatted should be installed before Microsoft's updates are installed.

Discussion is locked
You are posting a reply to: Deleting Microsoft's update KB908531
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Deleting Microsoft's update KB908531
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Update issue
by tomron / May 13, 2006 6:14 AM PDT

To remove windows update KB908531, do the following:

Go to Control Panel, then select "Add or Remove Programs".

Be sure the "Change or Remove Programs" is active / highlighted (at top left of window).

Then look at "Show updates" checkbox (at top). Make sure it is selected (ticked).

Once the display is populated, scroll down to "Security Update for Windows XP (KB908531)". It should be near the bottom of the list.

Click on that item. You'll see a Remove button. Click on it if you wish to have it removed.

** Before you use Add-Remove Programs, be very sure you close all your open user programs (after saving any unsaved work). After this change takes effect, and IF this does not ask for a restart, then you should do a logoff and restart of Windows.


Removing the update WILL leave your system vulnerable. Until a newer update is released, you can take some steps to mitigate the situation.
See section titled "Workaround for Windows shell vulnerability" in
http://www.microsoft.com/technet/security/Bulletin/MS06-015.mspx


ALSO:
Tweak your settings for Automatic Updates:
I'd advise, if you are using automatic updates, you configure it to "Notify me but don't automatically download or install them". e.g. do not have it on "full auto".

To get to your settings, highlight / single click My Computer on your desktop > do a RIGHT-Click > select Properties.
Then click on the Automatic Updates tab.


Tom

Collapse -
AWW, There Is A New Version Of That Update Available
by Grif Thomas Forum moderator / May 13, 2006 12:59 PM PDT

The KB908531 update caused a fair number of problems with computers that run Nvidia graphics cards and had HP scanner or camera software installed. It also created problems with a few other programs as well. As a result, a "version 2" of the update has been released. Clicking on the link below and downloading, the manual installer should allow you to correctly run the programs you are concerned with.

http://www.microsoft.com/technet/security/Bulletin/MS06-015.mspx

After installing Version 2 of the update, if your programs still don't function correctly, you should then be able to uninstall it from the "Add/Remove Programs" section AS LONG AS you have the "Show Updates" box CHECKED in the upper part of the window.

In addition, you can always use System Restore back to a time when the machine ran correctly. It's not "destructive" restore process but simply takes you back to an earlier time when the update hasn't been installed.

Hope this helps.

Grif

Collapse -
Your Reply to my KB908531 Issue
by stinkyda / May 18, 2006 12:58 AM PDT

Thank you Grif and Tom, for your responses concerning my KB908531 issue. Unfortunately, KB908531 changes the BIOS and therefore cannot be removed via Add/Remove in the control panel. Grif?s link opens Microsoft?s article ID# 918165. According to that KB908531 installs Verclsid.exe, a binary program, which validates shell extensions before they are instantiated by the Windows shell. But, Security update 908531 also includes an "allow list." That means the Verclsid.exe program does not scan any file that has an extension that appears in this list. The list can be changed in the registry. The problem, however, is that the change for the list given by the Microsoft bulletin is only for HP third party COM controls or shells extensions such as ?Share to Web? found in printer or scanner programs etc. In my case the programs, which are blocked are Adobe Photo Deluxe, Webster?s Dictionary and others. Unfortunately I don?t know the lines required for changing that in the registry.

The Version 2 of the update I have not found yet. That leaves still System Restore providing I have a restore point on that time span.

Werner

Collapse -
Re Version2 of the KB908531 update
by Tufenuf / May 18, 2006 1:25 AM PDT
Collapse -
Thank you Tufenuf
by stinkyda / May 21, 2006 12:42 AM PDT

Yes the Version2 of the KB908531 update is available, I found and installed it. Same story in my case it doesn't work. Also kb908531, once installed, it cannot be removed by Add/Remove from the Control Panel.

All I can say: If Gates would have to pay for the countless hours his companie's customers have to spent and the grief and frustration caused by the crap his company releases he would be broke instead of enjoying a billionaire's life.
Werner

Collapse -
Aww, You're Mistaken
by Grif Thomas Forum moderator / May 18, 2006 1:48 AM PDT

First, the link I provided DOES NOT ''open Microsoft?s article ID# 918165''. It opens ''Microsoft Security Bulletin MS06-015'' but does provide a sublink which will take you to Knowledgebase article 918165. The Security Bulletin provides a great deal of information which should solve most of your issues.

Second, the update doesn't change the BIOS. (It does change the Windows Shell though.) Please read closely about the vulnerability details and the sections about what the update does.

Next, the Security Bulletin MS06-015link I provided you earlier DOES include version 2 of the update. (You'll note the version number at the top of the article indicates ''Version: 2''.) Reading the FAQ link within the document indicates: ''Microsoft updated this bulletin today to advise customers that revised versions of the security update are available for all products listed in the ?Affected Software? section.'' Indeed, the downloaded file name now indicates ''v2'' in it's name.

I've installed the ''v2'' file on about 10 computers and registry checks show this update correctly edits the registry with the changes needed. (It only corrects registry entries for those items listed in the article.)

As I suggested earlier, there are no guarantees here, but installing the second version of the update which can be downloaded from the Security Bulletin page should place the update in the ''Add/Remove Programs'' section where it can be uninstalled. (I've currently installed it on about 25 machines and EACH ONE had it listed in the 'Add/Remove Programs'' section.)

And most importantly, if for some reason it's still not listed in the ''Add/Remove Programs'' section, there are other methods mentioned in the Bulletin to remove the update such as: System administrators can also use the Spuninst.exe utility to remove this security update. The Spuninst.exe utility is located in the %Windir%\$NTUninstallKB908531$\Spuninst folder.

Or you can simply use System Restore. It's not destructive and simply takes you back to a time when things were good.

Hope this helps.

Grif

Collapse -
another update ?
by WOODS-HICK / May 18, 2006 11:53 AM PDT
In reply to: Aww, You're Mistaken

I once tried to remove kb913446 because it was mentioned as possible solution to missing cdrom(code 39). I downloaded second update for manual install. when I tried to remove 3446 I got message warning: removing this update will not allow programs x,x,x,& x. not to work properly. 4 unrelated programs installed prior to 3446. they did not require cdrom. so I did not remove it after finding a regedit solution for code 39 at ms kb.

any thoughts on this? have not found any info so far.

Collapse -
Woods, It's Common...
by Grif Thomas Forum moderator / May 18, 2006 2:21 PM PDT
In reply to: another update ?

Shared files for updates may be affected by the removal of a previously installed update. In those cases, it's generally safe to remove the original update in question, then remove the other updates and reinstall those updates that might be affected. They will then install correctly, including all registry entries, and not have any problems..

The most common issue of this type is the most recent Windows Installer 3.1 V2. If any updates are installed AFTER the new Windows Installer is on the machine, you'll get the message you've mentioned. (Obviously, without the new 3.2 VS installer, you wouldn't be able to uninstall them correctly.) In that case, it's a good idea to uninstall all of the affected updates, then reinstall them. Once they're installed they should work fine.

Hope this helps.

Grif

Collapse -
re: update ?
by WOODS-HICK / May 19, 2006 12:34 AM PDT
In reply to: Woods, It's Common...

thanks, I know understand the shared files involvement. I don't know what v of win inst I have. update kb893803 shows only win inst 3.1, no v number. I searched with win explorer, incl hidden, but only found the update#. add/rem in cp, lists win inst 3.1 no version#. where is this exe found? I am sure I have latest v since I have installed all sp2 updates. anyway I am not experiencing any problems now, so pc will remain as is. but if you could point me to that exe it would be appreciated. thanks again.

Collapse -
re: previous ?
by WOODS-HICK / May 19, 2006 12:47 AM PDT
In reply to: re: update ?

ok, I went to ms kb, should have done this first. so I have the win inst 3.1 v2 but I still want to know where it is.

Collapse -
Windows Installer 3.1 V2- Where It Is...
by Grif Thomas Forum moderator / May 19, 2006 6:26 AM PDT
In reply to: re: previous ?

As far as I know, the Windows Installer is a "group" of various files, not just one.. The download location, should you ever need to reinstall it, is at the link below:

http://www.microsoft.com/downloads/details.aspx?familyid=889482FC-5F56-4A38-B838-DE776FD4138C&displaylang=en

In addition, you can generally tell if the V2 version of an update is installed from the Windows Update site by opening the C\Windows folder and looking at the "$NTUninstallXXXX" files. The Knowledgebase will be listed in the X's section and for V2 issues, there will be a V2 indicated at the end of the folder name. It should look something like "$NTUninstallKB893803_v2$".

Hope this helps.

Grif

Collapse -
(NT) (NT) found it -thanks
by WOODS-HICK / May 19, 2006 9:32 AM PDT
Collapse -
Thank you very much Grif
by stinkyda / May 21, 2006 12:55 AM PDT
In reply to: Aww, You're Mistaken

You are right, I was mistaken. The Add/Remove, however, even on kb908531 V2, carries the "cannot be removed" note. I will now try the Spuninst.exe according to your recommendation.
Thanks again, Werner

Popular Forums
icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

HOLIDAY GIFT GUIDE 2017

Cameras that make great holiday gifts

Let them start the new year with a step up in photo and video quality from a phone.