Replies

Thanks for the explanation so that I and others will hopefully avoid this happening in the future.

Ok, what happened? My reply to Dave was somehow “swallowed up” by the forum software. It was post number 130789, which I edited once to clarify the reply.

Hi Dave!

So sorry for the lack of any kind of reply, got totally swamped at work. At least you were in great hands with @MrBrian helping out with this thread/topic.

I have just tried to get to the catalog site in IE11. Mind you, I have IE11 with Win7 SP1 x64, so your mileage may differ. The exact steps I just used were:

1. Start IE11 from the icon pinned to the taskbar.

2. Go into Internet options within the browser, NOT from the Control Panel.

3. Select the checkbox labeled “Enable DOM Storage from the list under Security on the “Advanced” tab.

4. Double check that my cookie settings were set to override automatic cookie handling, and then checked to make sure first party cookies were set to “Accept” and third party cookies were set to “Block”.

5. Clicked “OK” button at bottom of Internet Options dialog box.

6. Proceeded to MS Update Catalog site by typing it into the address bar, and it came right up. A search for KB4025252 (as a brief test to see if the site would function properly) produced many results to explore and download, should I have wanted to.

Any additional thoughts to help out, MrBrian? It appears my installation of IE might be slightly different in some way from Dave’s.

NOW, to totally blow everyone out of the water, I just tried to get to the MS catalog site by clicking a link from a Google search for the update catalog. This was using Firefox 55.0.3 x32. Clicking the link provided by Google brought up the site, and I was able to perform the search I just mentioned above successfully. HOWEVER, this was with both cookies and DOM storage DISABLED within Firefox. This goes against what I posted in the thread I used to start this topic!! I double checked to see if Firefox was storing ANY cookies from ANY MS domain, and it wasn’t and still isn’t as of this writing.

Perhaps the folks in Redmond have modified the site’s behavior to work better with browsers. But, if they have, then why are MrBrian and you still having to use workarounds to get to the site??

3 users thanked author for this post.

Pepsiboy, BobbyB, MrBrian

For those Windows 7 users who are trying to make all the changes Noel listed in the screenshots above for disabling the Search and Indexing services, please remember that File Explorer in Windows 7 is actually called “Windows Explorer”. THAT’S where you’ll find the entry about turning off the Library Features.

In other words, for Windows 7, the place to look is User Configuration/Administrative Templates/Windows Components/Windows Explorer. Just click once on the Windows Explorer title and you’ll see the settings show up in the right hand pane. You’ll probably find the “Turn off Windows Libraries features…” setting listed about halfway down the list in the right hand pane without having to scroll down at all.

1 user thanked author for this post.

AJNorth

anonymous wrote:

Would disabling the Windows Search service work too? Or are the regedits necessary to stop this?

You don’t need to edit the registry to stop nor to disable the Windows Search service. Simply go into the “Services” tool of the “Administrative Tools” choice from the Control Panel (Win7). To see the Administrative Tools choice, however, you need to be in an administrator-level account or, if you choose to, run “services.msc” from the “Run” dialog box on the Start menu and simply select to run it as an Administrator.

Once you’re in the services snap-in, scroll all the way down to the listing for “Windows Search”. Double clicking on it will bring up its Properties dialog box, showing the page  where you can change the startup type to “Disabled”, as well as stop the service from currently running (click the “Stop” button below the startup type drop-down box) all at once. Just make sure to click OK when you’re done making changes. Now, reboot the computer to make them effective immediately.

A word of warning if you do use the search service or have an application that uses the search service routinely: The steps above completely disable the service and will render the program(s) that use the service either somewhat or completely useless until you apply this month’s patch that fixes the vulnerability. Also, you will have to remember to re-enable the service once the patch is applied, probably, so take note of the startup type before disabling the service so you know what to set it back to after patching.

I hope this helps!

2 users thanked author for this post.

HiFlyer, AJNorth

BrianL wrote:

I guess that I will settle on the minitool. It seems to work. I am being as careful as I can with my limited experience.

@BrianL, please read the last sentence from @PKCano’s first reply to you quoted below:

PKCano wrote:

  Once you understand Windows Update and supercedence, that is the time for Win minitool.

In other words, you may be doing yourself a disservice by using the minitool. Even @PKCano has admitted to stumbling (mis-stepping) by using the minitool instead of the built-in Windows Update.

To quote him in his first reply to you, ” I stumble with it, especially now that MS has made so many changes.”

BrianL wrote:

@ Bob99 & PKCano – I have had a pecular thing happening :I try to install an update that is obsolete or modified, the windows 7 will not except it and gives references to find the exact update no explanation why.

That’s probably because of the supersedence issue that @PKCano has mentioned in his first reply to you. You’re probably trying to install a superseded update, which is also why he strongly suggested using the built-in Windows Update tool instead of the mini tool you’ve been using.

To quote @PKCano’s earlier post, “With the older patches that show up in Windows Update, if they are not needed (have been superceded or replaced), Windows Update Agent will “know” and they simply won’t get installed. Or if they are needed, they will be installed in the proper order.”

Just curious why you’re using a freeware tool available on Majorgeeks instead of the built-in Windows Update tool? The freeware tool uses, by its own description on Majorgeeks, the same systems/files that the built-in windows Update uses.

Aside from that, I’d be very careful about trying to install the older updates you’ve encountered, since MS has been editing the updates for which one succeeded which other older one, and you might wind up messing that up by trying to install an older patch. I’m sure that @PKCano can shed some light on the succession issue, as well as provide a great answer to your original question!

I have been able to duplicate your experience (typing in the KB number in the search box), but get the error code again if I don’t have DOM storage enabled. All in all, really weird what you’re experiencing.

All I can think of to help others reading this post/thread is to purge IE’s cache and cookies, close and then restart IE after making the settings changes described above.

For those who already have those settings enabled, boy what a head scratcher. However I do indeed hope @dgreen’s stated workaround also works for you. If anyone else has any suggestions, feel free to post them here. The Update Catalog is going to become a vital tool for those of us who will be in need of (or simply desire) an individual patch or security update without the entire monthly roll-up fed to us from Windows Update/Microsoft update (or other services).

Canadian Tech wrote:

By the way, Woody, I blacklist websites that open with blasting sound. If I run into it, I send an email to the organization and tell them that I object. I am surprised at how many have changed this policy. Zdnet is on my blacklist.

What works great for me is to surf the site with tracking protection enabled to the Strict Protection setting within Firefox. No video whatsoever, just a blank, black box with no controls. All blocked via tracking protection. I don’t surf this way for all sites, just some that tend ot be “in your face” with instantly playing ads or videos. Firefox lets you customize blocking by adding certain sites or turning it off for individual sites. By Mozilla’s own admission within the settings for tracking protection, setting it to Strict will “break” some legitimate sites one deals with daily, so better to set it on a site by site basis.

2 users thanked author for this post.

SueW, HiFlyer

anonymous wrote:

I tried it first in IE11, but all I got was a momentary glimpse of the download links and then got error number 8DDD0020. But it worked fine in Chrome and got the download there. Any idea what causes that error number in IE11? I searched for an explanation, but nothing seems to resolve it. Thanks much.

Here’s your answer: In IE, you need to enable BOTH first party cookies and DOM storage. However, this advice also applies to anyone using Firefox (as I primarily do) or other browsers as well.

In IE, click the”gear” looking icon in upper right corner of browser and select “Internet options” from the drop-down menu. Now, click the “Privacy” tab at the top of the new box. Move the slider to the Low setting and click Apply at the bottom of the box. I’ve tried other higher settings (“Medium”, etc.) and the page won’t load with anything higher than “Low”.

If you have custom cookie settings, then just click the “Advanced” button in the “Privacy” tab and then check to make sure the heading under “First party Cookies” is set to “Accept”, then click “Apply” at the bottom of the box. If it’s already set, then just proceed with the next paragraph’s step.

Now, click the “Advanced” tab at the top of the Internet options box, and scroll all the way down the settings until you get to the heading labeled “Security”. It will have a padlock icon next to it. Under that heading, click the box next to the entry labeled “Enable DOM Storage”, which should place a check mark in the box. Now click “Apply” at the bottom of the box and then “OK” at the bottom of the box and you should be all set!

To be sure, clear the browser’s cache out so you get a fresh reload of the page PKCano referenced in his post above, #126684.

I hope this helps!

1 user thanked author for this post.

MrBrian

However, in the comments below the review, there is an anonymous poster who supposedly had problems with the tool when it tried updating itself:

“WARNING! Downloaded it from chip.de, installed it in a VM. After I launched it, it told me that there is an update and asked me if I want to install it. When I confirmed, it installed the update — and Avast popped up, telling me that it prevented the .exe from starting since it is infected with a virus. Great tool… (And I’m talking about Avast.)”

The above comment was posted on June 7th of this year. Granted, the basic executable from chip.de could’ve somehow been infected and the bug was just waiting for the right time to spring into action, or his settings within Avast could’ve just not liked what DISM++ was trying to do in the background.

Another poster (on Sept. 19th of last year) above the one quoted also stated that Virus Total ” Didn’t find much on it, but the file appears in numerous adware/malware packages.”. They also gave VirusTotal’s checksum for the package as well. I can see how the program could be flagged as malware by some programs due to the nature of what it can help you with at the system level, and how it probably goes about it

Either way, with what this program can do, it’s best to tread lightly so as to avoid problems with potentially bricking one’s system, and be careful of which site you download it from, getting it only from a site you trust implicitly.

Uh, maybe not so fast…here’s a quote from a user who downloaded it, let it update itself, and then got an unwelcome surprise:

“WARNING! Downloaded it from chip.de, installed it in a VM. After I launched it, it told me that there is an update and asked me if I want to install it. When I confirmed, it installed the update — and Avast popped up, telling me that it prevented the .exe from starting since it is infected with a virus. Great tool… (And I’m talking about Avast.)”

That was posted on the GHacks.net Website on June 7th of this year as a comment to a review of DISM++ on the site. Granted, the package he(she) got from chip.de might’ve been infected, just waiting for the right time to spring into action, but there is a post above the one quoted above that makes reference to VirusTotal’s checksum of the program and how it has shown up in other “numerous adware/malware packages”. Also granted, the poster’s name was shown as Anonymous, so that has to be taken into account as well.

anonymous wrote:

… I was kind of concerned it could represent a source of SMB vulnerabily in my home network, even though, the printer is not always on, pretty much I only turn it on when I’m actually going to print something, I don’t leave it in standby ever, mainly because I want to avoid having any undesired communication in the network and the fewer devices, easier it is to manage this task…

Your printer model isn’t listed anywhere in the document from HP about SMB1 and SMB2 dependent printers/devices. This could very well mean that your printer doesn’t use SMB to communicate but, as you found out by reading the printer’s documentation, it may use DHCP instead.

lurks about wrote:

My complaint with the list is its misleading nature. Many older printers and scanners can only use v.1 but which ones. It is not as if all HP, Lexmark, etc. printers and scanners are vulnerable. Including an unqualified ‘HP’ or ‘Lexmark’ implies all their products are vulnerable.

As stated by anonymous in post #123799, follow the listed links for each manufacturer and the literature or documents at each will tell you. For example, the link listed for HP contains a .pdf which lists the printers/multi function machines that still need SMB1 and those that do not need SMB1. After looking over the list, I found that the multi function machine attached to one of our computers needs SMB1 to fully function, so I will need to re-enable SMB1 on that computer.

HP seems to have done a halfway decent job identifying the SMB1-dependent hardware, but not all companies will do so, I’m afraid.

1 user thanked author for this post.

Kirsty