Microsoft KB Archive/918165

= You may experience problems in Windows Explorer or in the Windows shell after you install security update MS06-015 =

Article ID: 918165

Article Last Modified on 10/11/2007

-

APPLIES TO

 Microsoft Windows Server 2003 R2 Standard x64 Edition Microsoft Windows Server 2003 R2 Datacenter x64 Edition Microsoft Windows Server 2003 R2 Enterprise x64 Edition Microsoft Windows Server 2003 R2 Standard Edition (32-bit x86) Microsoft Windows Server 2003 R2 Datacenter Edition (32-Bit x86) Microsoft Windows Server 2003 R2 Enterprise Edition (32-Bit x86) Microsoft Windows Server 2003, Standard x64 Edition Microsoft Windows Server 2003, Datacenter x64 Edition</li> Microsoft Windows Server 2003, Enterprise x64 Edition</li> Microsoft Windows Server 2003 SP1, when used with: <ul> Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems</li></ul>

<ul> Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems</li></ul>

<ul> Microsoft Windows Server 2003, Standard Edition (32-bit x86)</li></ul>

<ul> Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)</li></ul>

<ul> Microsoft Windows Server 2003, Enterprise Edition</li></ul>

<ul> Microsoft Windows Server 2003, Web Edition</li></ul> </li> Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems</li> Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems</li> Microsoft Windows Server 2003, Standard Edition (32-bit x86)</li> Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)</li> Microsoft Windows Server 2003, Enterprise Edition</li> Microsoft Windows Server 2003, Web Edition</li> Microsoft Windows Small Business Server 2003 Premium Edition</li> Microsoft Windows Small Business Server 2003 Standard Edition</li> <li>Microsoft BackOffice Small Business Server 2000 Service Pack 1</li> <li>Microsoft Windows XP Professional x64 Edition</li> <li>Microsoft Windows XP Service Pack 2, when used with: <ul> <li>Microsoft Windows XP Home Edition</li></ul>

<ul> <li>Microsoft Windows XP Professional</li></ul> </li> <li>Microsoft Windows XP Service Pack 1, when used with: <ul> <li>Microsoft Windows XP Home Edition</li></ul>

<ul> <li>Microsoft Windows XP Professional</li></ul> </li> <li>Microsoft Windows XP Media Center Edition 2005</li> <li>Microsoft Windows XP Media Center Edition 2002</li> <li>Microsoft Windows XP Tablet PC Edition 2005</li> <li>Microsoft Windows XP Tablet PC Edition</li> <li>Microsoft Windows 2000 Service Pack 4, when used with: <ul> <li>Microsoft Small Business Server 2000 Standard Edition</li></ul> </li> <li>Microsoft Windows 2000 Advanced Server</li> <li>Microsoft Windows 2000 Datacenter Server</li> <li>Microsoft Windows 2000 Professional Edition</li> <li>Microsoft Windows 2000 Service Pack 4</li> <li>Microsoft Streets & Trips 2006</li> <li>Microsoft Streets & Trips 2005 Standard Edition</li> <li>Microsoft Works 8.0</li> <li>Microsoft Works 7.0</li> <li>Microsoft Works Suite 2006</li> <li>Microsoft Works Suite 2005</li> <li>Microsoft Digital Image Suite 10</li> <li>Microsoft Digital Image Suite 9</li> <li>Microsoft MapPoint 2006 Standard Edition</li> <li>Microsoft MapPoint 2004 Standard Edition</li> <li>Microsoft Picture It! Photo 2002 Standard Edition</li> <li>Microsoft Digital Image Standard 2006</li> <li>Microsoft Digital Image Starter Edition 2006</li> <li>Microsoft Digital Image Suite 2006</li> <li>Microsoft AutoRoute 2006</li> <li>Microsoft Autoroute Europe 2005 Europe</li> <li>Microsoft Picture It! Premium 10</li></ul>

-

<div class="notice_section">

Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry

<div class="symptoms_section">

SYMPTOMS
After you install security update 908531 (security bulletin MS06-015), you may experience one or more of the following problems:
 * You cannot access special folders such as &quot;My Documents&quot; or &quot;My Pictures.&quot;
 * Microsoft Office applications stop responding when you try to save or to open Office files in the &quot;My Documents&quot; folder.
 * Office files that are located in the &quot;My Documents&quot; folder cannot be opened.
 * If you open a file by clicking Open on the File menu, the application stops responding.
 * When you type an address in the Address box in Microsoft Internet Explorer and you then press ENTER or you click Go, nothing happens.
 * When you right-click a file and then click Send To, nothing happens.
 * When you expand a folder in Windows Explorer, nothing happens.
 * Some third-party applications stop responding when you open or save data in the “My Documents” folder.

To see security bulletin MS06-015, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/bulletin/ms06-015.mspx

<div class="cause_section">

CAUSE
Security update 908531 (MS06-015) installs a new program, Verclsid.exe. The Verclsid.exe program validates shell extensions before they are instantiated by the Windows shell or by Windows Explorer. On some computers, the Verclsid.exe program stops responding. The following conditions can cause the Verclsid.exe program to stop responding: <ul> <li>Hewlett Packard (HP) Share-to-Web software is running. You have not installed the new version of security update 908531 (MS06-015) that released on April 25, 2006.

There have been reported issues where software that was previously distributed by Hewlett Packard (HP) causes the Verclsid.exe program to stop responding. The specific component that causes problems is the Share-to-Web namespace daemon (Hpgs2wnd.exe). This software is no longer distributed by HP, but was previously included with the following items: <ul> <li>HP PhotoSmart software</li> <li>Any HP DeskJet printer that includes a card reader</li> <li>HP scanners</li> <li>Some HP CD-RWs and HP DVD-RWs</li> <li>HP cameras</li></ul>

The Share-to-Web namespace daemon can be found in the following folder:

C:\Program Files\Hewlett-packard\Hp share-to-web\Hpgs2wnd.exe

Share-to-Web software is automatically started when you start the computer. The software may also be started by using the Start menu.</li> <li>NVIDIA display drivers earlier than or including version 61.94 are installed. You have not installed the new version of security update 908531 (MS06-015) that released on April 25, 2006.

This problem occurs if certain NVIDIA shell extensions are running.</li> <li>The Verclsid.exe program is blocked by your firewall program.

For example, the Verclsid.exe program is flagged by some versions of Kerio Personal Firewall from Sunbelt Software. For more information about Kerio Personal Firewall, visit the following Sunbelt Software Web site:

Sunbelt Kerio Personal Firewall

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

This software flags any attempt by one application to start another application and asks for the user's approval. Kerio Personal Firewall flags an attempt by Internet Explorer to start the Verclsid.exe program.</li></ul>

<div class="resolution_section">

Add HP Share-to-Web software or NVIDIA shell extensions to the Verclsid.exe &quot;allow list&quot;
To do this automatically, install the new version of security update 908531 (MS06-015) that released on April 25, 2006. This new update is available from Windows Update, from Microsoft Update, and from Automatic Updates if the identified third-party Component Object Model (COM) controls are installed. This new update is also available from the Microsoft Download Center. For more information and deployment options, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/bulletin/ms06-015.mspx

If you cannot install the new version of security update 908531 (MS06-015) that released on April 25, 2006, you must manually add the HP Share-to-Web software or the NVIDIA shell extensions to the &quot;allow list&quot; by using the steps in the &quot;More Information&quot; section.

Configure your firewall to let the Verclsid.exe program run
Follow the steps for your firewall program to let the Versclid.exe program run, or click to allow the Versclid.exe program to stop running until you click through Kerio Personal Firewall's notification dialog box. You can configure Kerio Personal Firewall so that the Versclid.exe program runs without any prompts.

<div class="moreinformation_section">

MORE INFORMATION
Security update 908531 includes an &quot;allow list.&quot; The Verclsid.exe program does not scan any file that has an extension that appears in this list. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

908531 MS06-015: Vulnerability in Windows Explorer could lead to remote code execution

Other third-party COM controls or shell extensions may also cause this problem. If the steps that are described in this article do not solve the problem, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS

Note If other third-party COM controls or shell extensions cause this problem, you can manually add the appropriate shell extension to the &quot;allow list.&quot; In this case, you must know the registry keys that correspond to the shell extensions.

How to manually add HP Share-to-Web or NVIDIA shell extensions to the registry if you cannot install the new version of security update 908531 (MS06-015) that released on April 25, 2006
Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry

Manual steps to add HP Share-to-Web software to the &quot;allow list&quot;
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To resolve this problem if you cannot install the new version of security update 908531 (MS06-015) that released on April 25, 2006, you can manually add the HP shell extension to the list. To you do this, you must follow these steps to modify the registry: <ol> <li>Log on to the computer by using an account that has administrative credentials.</li> <li>Click Start, click Run, type regedit, and then click OK.</li> <li>Locate and then right-click the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached

</li> <li>Point to New, and then click DWORD Value.</li> <li>For Microsoft Windows 2000-based computers, type the following:

{A4DF5659-0801-4A60-9607-1C48695EFDA9} {000214E6-0000-0000-C000-000000000046}

For Microsoft Windows XP-based or Microsoft Windows Server 2003-based computers, type the following:

{A4DF5659-0801-4A60-9607-1C48695EFDA9} {000214E6-0000-0000-C000-000000000046} 0x401

</li> <li>Right-click the value that you just created, and then set the Value data to 1.</li> <li>Exit Registry Editor.</li> <li>Use Task Manager to close the Verclsid.exe program or to restart the computer.</li></ol>

Manual steps to add NVIDIA shell extensions to the &quot;allow list&quot;
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To manually enter NVIDIA shell extensions in the registry if you cannot install the new version of security update 908531 (MS06-015) that released on April 25, 2006, follow these steps: <ol> <li>Log on to the computer by using an account that has administrative credentials.</li> <li>Click Start, click Run, type regedit, and then click OK.</li> <li>Locate and then right-click the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached

</li> <li>Point to New, and then click DWORD Value.</li> <li>For Microsoft Windows 2000-based computers, type the following:

{1e9b04fb-f9e5-4718-997b-b8da88302a47} {000214e8-0000-0000-c000-000000000046}

{1e9b04fb-f9e5-4718-997b-b8da88302a48} {000214e8-0000-0000-c000-000000000046}

{1cdb2949-8f65-4355-8456-263e7c208a5d} {000214e6-0000-0000-c000-000000000046}

For Microsoft Windows XP-based or Microsoft Windows Server 2003-based computers, type the following:

{1e9b04fb-f9e5-4718-997b-b8da88302a47} {000214e8-0000-0000-c000-000000000046} 0x401

{1e9b04fb-f9e5-4718-997b-b8da88302a48} {000214e8-0000-0000-c000-000000000046} 0x401

{1cdb2949-8f65-4355-8456-263e7c208a5d} {000214e6-0000-0000-c000-000000000046} 0x401

</li> <li>Right-click the value that you just created, and then set the Value data to 1.</li> <li>Exit Registry Editor.</li> <li>Restart the computer.</li></ol>

For the NVIDIA download page, visit the following NVIDIA Web site:

http://www.nvidia.com/Download/index.aspx?lang=en-us

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

Additional query words: shell security update patch security_patch freeze hang

Keywords: kbsecurity KB918165

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.