RSSSecurity firm: Windows patches not responsible for 'Black Screen of Death'
By Scott M. Fulton, III | Published December 1, 2009, 9:49 PM
When Betanews reported last June about occurrences of the infamous "Black Screen of Death" (KSoD) in Windows Vista, a reader wrote to suggest to us that we might have only considered the matter so important this late in the game because suddenly it happened to us. A similar opinion may be appropriate for British security firm Prevx, which now says it has "exonerated" last month's set of Patch Tuesday updates from Microsoft as the cause of what it called last night a "crop" of KSoD incidents.
Early Tuesday evening, Prevx director of malware research Jacques Erasmus reported on his company's blog that he and his team have made "significant progress in determining specific triggers of the black screen event." Specifically, it determined that a side-effect accidentally discovered over three years ago by none other than SysInternals' Mark Russinovich (now with Microsoft), led to instances where Windows' product activation inadvertently triggered the black screen. When a System Registry entry of String type is supposed to be terminated by a null character (0) but isn't, the result is that the entry itself may disappear from REGEDIT, Windows' well-known Registry Editor. Such an entry may also trigger KSoD conditions.
But that much has been public knowledge for as long as Russinovich has been distributing his "cool" registry key hider tool. Nevertheless, Prevx now has come around to believing that non-terminated Registry entries to be the cause of KSoD problems, not some strange and allegedly unpublicized change in the "rules" for Access Control Lists that a patch may not have followed.
Erasmus may have had some help in reaching this conclusion from Microsoft. In a statement to Betanews late this afternoon, security response communications lead Christopher Budd told us, "Our comprehensive investigation has shown that none of the recently released updates are related to the behavior described in the reports. While we were not contacted by the organization who originally made these reports, we have proactively contacted them with our findings."
So if Prevx wasn't really sure that ACLs were at the root of the KSoD problem, exactly what does its free fix tool, released yesterday, do? This evening, Erasmus suggested that at the very least, it does nothing bad. "We apologize to Microsoft for any inconvenience our blog may have caused," he wrote. "This has been a challenging issue to identify. Users who have the black screen issue referred to can still safely use our free fix tool to restore their desktop icons and task bar."
Prevx's earlier story led to the BBC reporting a rash of KSoD incidents afflicting specifically Windows 7. The evidence of such a rash may have just disappeared, which doesn't exactly mean the problem has gone away. It does mean we can reset the panic button now.
I've never heard of a KSOD, neither has Wikipedia. I know what a BSOD is but have never heard of KSOD. Why not call it a LSOD, or ASOD, or CSOD while we're at it?! Changing an old familiar acronym like BSOD is way too easy to remember!
Score: 1
|The BSOD is the "Blue Screen of Death," referring to the crash screen that Windows puts up, with details as to the nature of the crash. The Black Screen is a different order of beast altogether. Just because Wikipedia doesn't classify it doesn't mean it's not real.
-SoD.F.3
Score: 0
|Sn0wflake:
Learn to Google.
http://en.wikipedia.org/...ter_versions_of_Windows
Thank you.
Score: 0
|To be fair, while that Wikipedia entry does indeed cover the 'Black Screen of Death', it makes no mention whatsoever of the 'KSoD' acronym or its origins, which is what sn0flake specifically referenced.
'KSoD' is generally accepted as meaning 'BlacK Screen of Death'... though I've no idea who first coined it.
Though the Black Screen of Death has been around since Windows 3.x (as the Wiki article PC_Tool linked points out), the currently-used acronym used to describe it seems to be fairly new.
Score: 0
|That's why I said he needs to learn to Google. Even a junior-googler knows that if the acronym doesn't bring anything up, you spell it out.
Sheesh...
Score: 0
|Honestly all this crap and nothing to show for it. Honestly i havent even heard of a actual black screen of death happening in real life. I use Microsoft Security Essentials which honestly seems to stop stuff my other anti never even knew about. I never heard of Prevx, and i guess i know why now.
Score: 1
|Prevx had been disabled on my Windows 7 machine some days back, puzzled I enabled it, a day or so later it had once again been disabled, and not by me, was it Prevx ?
Score: 0
|I'm inclined to think you have caught a rootkit/trojan. Disabling the antivirus is the first thing they would want to do. The best solution is to scan your HD with a clean OS (preferably booted from CD or DVD).
Score: 0
|I question why anyone would run security software from a company that doesn't seem to know WTF it is doing.
Score: 0
|"I question why anyone would run security software from a company that doesn't seem to know WTF it is doing."
Clearly. The past article had them saying it was caused by Windows Update and dated back as far as Windows NT...
...
Note to other readers: If you are not current asking, "WTF?" with regards to that statement, read it again and ask yourself what Windows OS first had Windows Update.
Score: 0
|Sturgess: Obviously, it's the Opera installation. duh... :p
Score: 0
|melkor "I'm inclined to think you have caught a rootkit/trojan"
First thing that came to mind, but Prevx is just one in a myriad of stuff to keep me safe. I did all the scans known to man and they found nothing, plus Prevx which seems to be working again found nothing. So I'm down to checking my bank balance on an hourly basis, and keeping my fingers crossed.
Score: 0
|mjm01010101 "I question why anyone would run security software from a company that doesn't seem to know WTF it is doing."
Have a look at the superb reviews it gets, you may change your mind.
Score: 0
|PC_Tool "Obviously, it's the Opera installation"
They're are easily upset, and slow to forgive I've found.
Score: 0
|I'm surprised this one issue has received so much press. I've encountered innumerable issues that cause Black Screens on Vista, several clearly related to Windows Updates (prior to update, system fine; post update, black screen; system restore to point before update, fine -- and I'm not talking about Optional driver updates). I've encountered innumerable problems with Windows Updates that will not install with Vista despite using all of Microsoft's published fixes, tools, third party fixes, reg cleaners, WU reinitialization scripts, removing all malware and AV software, common problem software like HP printer software, etc...and numerous other fixes... Likewise, problems with various versions of .Net not properly installing updates on ALL versions of Windows. Trust me, I have tried just about every solution out there and often many of them work... but likewise, after exhausting all of these solutions and wasting numerous hours just trying to get Windows doing what Microsoft wants me to be doing with it, still having to resort to the classic Microsoft Fix: backup, reinstall, reload docs and apps, repeat. Whether or not this problem is partly caused by malware specifically or third party software generally, it is an old, persistent, and seemingly never-ending problem... In fact, it happened today about 10 minutes after reading all these stories. I checked and it wasn't the registry entries identified by Prevx and the MS Fixit ResetWindowsUpdate tool worked this time -- but these problems are all too frequent, nothing new about this particularly well publicized scenario.
Score: -3
|Oops, meant for that comment to be in Joe's post bout the ramifications for Microsoft whatever the cause of the problem.
Score: 0
|If this was such a widespread issue, I am pretty sure we'd hear about it (given this is rolled out on a corporate level). Problem is, we have no idea what other factors are involved with your machine like did you do a fresh install or did you upgrade from a previous OS, are you using esoteric or "warez" software, non-standard/esoteric warez anti-virus, stock or factory video/chip-set drivers, old or outdated scanner or scsi drivers, possible flaky or failing hard drive, third party OS optimization tools, do you have admin accounts for other family members who are click-install happy, etc.
I have never encountered such problems, and I'm not doing anything special, just fresh install of windows, latest drivers from video card and chip-set makers, freeware and legit software, AVG free anti-virus, and using no other third party cleaning tools except crap cleaner freeware. And I give limited (non-admin) rights to my family member's windows profile. It has worked so well liek this for YEARS day in and day out, and lots of windows updates later.
So while you may have lots of problems, there's millions happily computing just fine. I suggest you may want to start from scratch (not using factory restore disc but base install) and slowly add software only (no third party prevx/registry cleaner/etc) and try and isolate the real problem.
Otherwise there's always Apple Mac/OSX if Windows is not your cup of tea.
Score: 2
|First of all, the "registry cleaning" sends an alarm off in my mind. There is no reason to ever "clean" the Windows registry. You will not gain speed performance. You will almost certainly break something, at some point. If you can point to a Microsoft-authored article advising registry cleaning, I'd be happy to change my stance on the issue. Microsoft once released a utility only to pull it soon after because of the havoc it caused on users' systems.
Secondly, I have managed hundreds of Windows desktops, totaling over 250 applications, and have never seen this "black screen" you say occurs frequently. Is there *any* chance that some action you are doing could be causing this? Because trust me if this happened even once on a system I manage it would drive me up a wall until I discovered the *exact* cause.
Score: 2
|Windows for blinds
Score: 0
|Why do I get, yet again, the feeling that a lot of security firms/consultants out there are mostly attention wh**es, who will go to any length just to get publicity, including spreading FUD with no verified facts to back up their claims? How hard would it had been for them to compare the ACLs of a registry hive before, and after all of MS's recent patches? In the end, they got the online medias' attention on them for 24 hours, and made their name known amongst people who never heard of them before. All in all their marketing department must call this a "positive result" - a few months from now people will have forgotten how badly they goofed, but they will remember having seen the name before.
Score: 2
|