BSOD from this weeks MS updates

[PtBetsie]

Since reading this afternoon the piece on the BSOD's caused by Microsoft with their updates for WIN XP, I have become a bit nervous on what I'm going to find at the center on Tuesday. Assuming any of the pc's has been updated automatically, and now has a big problem, what's my first step to undo the damage?

[saphalline]

So far M$ has found that the BSOD's are on the extreme end of the spectrum and that the major problems involve the Atapi.sys driver in relation to malware infestations. They have not ruled out other possibilities, but that is the common thread that they have found as of yesterday.

If you fear a problem with your system using this latest round of updates, simply uninstall KB977165 and wait until a re-issue occurs.

To avoid such a problem in the future, it would be wise to set a schedule for your updates that checks on the Thursday or Friday after a Patch Tuesday. ;) When problems are found, such as this one, the patch(es) involved is (are) usually removed from the M$ update service by Wednesday or Thursday.

[PrntRhd]

Well said Saphalline.

The XP PCs that are blue screening after the update are mostly ones that had already been compromised by malware, meaning they should not be trusted in this condition anyway.
Microsoft has pulled the update until they figure out a way to harden the PCs and remove the malware without risking disabling the PCs.

If you have the blue screen cycle of death you can recover if you have a Windows CD:

1. Boot from a clean source (e.g. Windows CD)

2. Locate the infected partition, which is normally the boot partition

3. Replace atapi.sys in \%Windir%\system32\drivers with the clean backup copy

4. Reboot

The rootkits can infect other drivers instead of atapi.sys, like iaStor.sys or nvata.sys so you should consider checking those too.

You can do a md5checksum of the files and if they do not match the clean version you can suspect a rootkit.

[trapper]

I did not get a BSOD but system got sluggish ---XP Home SP3.
So, after a System Restore I went back into Windows Updates and reinstalled them, minus the KB977165 culprit.
Microsoft reprtedly suspect that a Rootkit is the cause of the problem with the Update; but I am skeptical of that as my system came up Clean on:
Antivir, Spybot, Malwarebytes, ESET online Scan, as well as Windows Software Removal Tool.

I am awaiting further word from Microsoft.