Latest Microsoft Patches Cause Black Screen of Death

Microsoft's latest round of security patches appears to be causing some PCs to seize up and display a black screen, rending the computer useless.
http://www.pcworld.com/article/183335/

Black Screen woes could affect millions on Windows 7, Vista and XP
http://www.prevx.com/blog/140/Black-Screen-woes-could-affect-millions-on-Windows--Vista-and-XP.html

Hi Pondus,

Problems like this could also be solved by reloading Windows. Some language versions were not affected by the patch, like Dutch versions of Windows.

These are some of the 140.000 links you can google on this issue now:

http://www.computerworld.com/s/article/9141594/Microsoft_investigates_Windows_black_screen_of_death_?taxonomyId=1
http://www.tomshardware.com/news/Microsoft-Windows-Black-Screen-Death,9171.html
http://www.informationweek.com/news/windows/security/showArticle.jhtml?articleID=221901431
http://news.softpedia.com/news/Windows-7-Black-Screen-of-Death-Free-Fix-Available-for-Download-128441.shtml

polonus

I posted this here earlier today :wink:
http://forum.avast.com/index.php?topic=51519.0

Hi Logos,

You have beaten us to it again. Hope you weren’t troubled. Were the “francophone” versions affected someway?

polonus

I posted this here earlier today http://forum.avast.com/index.php?topic=51519.0
aarrrrggggg........now you tell me....... ;D

can’t tell about the others but my Win7/64 hasn’t been affected so far…hmm, I’m running a US version :wink: … I hardly post on French forums…except, sometimes, on a Linux one so, I don’t know :slight_smile:

edit: also the latest update I’ve had in Windows was related to time zones; can’t tell if that belongs to what caused that disaster. I didn’t have any security patch from MS for a while now…

edit again: I can’t see anything related to “Access Control List” in my latest updates. Would be nice to have a KB number at least…

just found that, but they don’t give the source:

Microsoft says 'Black Screen Of Death' complaints were 'inaccurate'
http://www.ibtimes.com/articles/20091201/microsoft-says-black-screen-death-complaints-were-inaccurate.htm

read this:
http://newsvote.bbc.co.uk/mpapps/pagetools/print/news.bbc.co.uk/2/hi/technology/8388253.stm?ad=1

and that:
http://blogs.technet.com/msrc/archive/2009/12/01/reports-of-issues-with-november-security-updates.aspx

We’ve received questions about public reports that customers might be experiencing system issues with the November Security Updates (which some are referring to “Black Screen” issues). We’ve investigated these reports and found that our November Security Updates are not making changes to the system that these reports say are responsible for these issues.

While these reports weren’t brought to us directly, from our research into them, it appears they’re saying that our security updates are making permission changes in the registry to the value for the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell key.

We’ve conducted a comprehensive review of the November Security Updates, the Windows Malicious Software Removal Tool, and the non-security updates we released through Windows Update in November. That investigation has shown that none of these updates make any changes to the permissions in the registry. Thus, we don’t believe the updates are related to the “black screen” behavior described in these reports.

We’ve also checked with our worldwide Customer Service and Support organization, and they’ve told us they’re not seeing “black screen” behavior as a broad customer issue. Because these reports were not brought to us directly, it’s impossible to know conclusively what might be causing a “black screen” in those limited instances where customers have seen it. However, we do know that “black screen” behavior is associated with some malware families such as Daonol.

This underscores the importance of our guidance to customers to contact our Customer Service and Support group any time they think they’re affected by malware or are experiencing issues with security updates. This enables us to determine what might be happening and take steps to help customers by documenting new malware families in our MMPC malware encyclopedia or documenting known issues in our security bulletins and the supporting Knowledge Base articles.

I hope this helps to clarify,

Christopher

Not really a W7 issue; I had the problem on Vista Ultimate. Restore did not fix it, so involved something not saved there. An image prior to the installation of the Updates did fix it. And ran the Prevx patch later just in case, which their latest blog http://www.prevx.com/blog/141/Windows-Black-Screen-Root-Cause.html says will still fix the problem, but doesn’t really address the root problem anymore. Stay tuned. :wink:

just realizing, my wife’s laptop is running a French version of Vista and nothing happened…

edit again: I can't see anything related to "Access Control List" in my latest updates. Would be nice to have a KB number at least...

The conditions under which the actual black screen is triggered are spasmodic. Some test systems always trigger the condition, others are less consistent. The windows patches which seem common to the issue arising are listed below:

KB915597 and KB976098

When the issue occurs the WinLogon Shell entry for Explorer.Exe becomes invalidated. The entry exists perfectly in the registry but is unusable/inaccessible and is therefore ignored by the OS resulting in the desktop and task bar not being loaded. This entry is frequently the target of malware so tightening access to it is probably a good thing. However, the black screen condition is the only sign of the problem, leaving non technical users with a major challenge.

Hope this helps you.

Prevx Support

OK thanks Pondus, this will help to check more precisely :wink:

OK so the first patch is the one I mentioned in my post above, related to time zones, and the second one is just a windows defender update…

this BLACK SCREEN happened to me twice just goes black nothing else had to pull power and power up but nothing not since Saturday, and i reported it in the beta forum Avast IS WOW SO MICROSOFT CAUSED THIS

there’s a thread here on Technet:
http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/5b94b775-992e-4f48-b3ff-c89b3cf45e82

Hello

Microsoft says it isn’t because of the patches but because of malware.

nmb

No one is confessing, but only Prevx is trying to provide any assistance. Malware? I was running current Prevx and Avast! in real time, had just run MBAM and SAS a couple of days previously, don’t visit risky sites, use OA “run safer” mode with lowered privileges. But the speculation goes on and we wait for something real to come out of this. At lest it hasn’t recurred with the Prevx patch. :slight_smile:

check this guys:
http://www.thewindowsclub.com/windows-7-black-screen-of-death-a-non-issue
http://www.prevx.com/blog/141/Windows-Black-Screen-Root-Cause.html

Having narrowed down a specific trigger for this condition we've done quite a bit of testing and re-testing on the recent Windows patches including KB976098 and KB915597 as referred to in our previous blog. Since more specifically narrowing down the cause we have been able to exonerate these patches from being a contributory factor.
We apologize to Microsoft for any inconvenience our blog may have caused. This has been a challenging issue to identify. Users who have the black screen issue referred to can still safely use our free fix tool to restore their desktop icons and task bar.

I thought 100% the patches (I gave the details above) couldn’t have triggered the issue… at least not the win defender update ;D

may be off topic here, not sure:

adding, I’ve had an issue on 7 for a while now, just wondering now if it’s related to this registry issue. Thought it was related to dual-booting with Linux, 'cause it stopped happening when I removed Linux, and it happened again and often recently: I’m logged in to a temporary profile. I have just to log out and back in and things are OK.
Also another issue, quite new: while attempting to log in, I get the message that the profile failed to load, logging off screen appears, and then I can login.
There’s no question about my profile being corrupted, it has happened again and again with new Windows installs new profiles. I reported that on TechNet but nobody seems to know there. they keep talking about corrupted profiles ::slight_smile: It has happened to others I’m sure, there were a few posts with no answer either earlier this year.

http://social.answers.microsoft.com/Forums/en-US/vistaappearance/thread/682a0c05-3ae1-491b-a09b-7a5e39f832b4?prof=required

http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/f0cdd7d1-630b-426b-a22e-2710aa4231de
(this last link is the thread I started)

Just to connect both treaths about this issue:

And the fix from Prevx only addresses the following Reg Code:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “Shell”=”explorer.exe”

See here.

Like Ramesh Kumar says: it’s a bit of a non-issue.

In case you should quickly need the fix, I’ve added it under ‘Cool fixes’ in my List of Av and As Uninstallers.