Microsoft denies that patches caused black screens

Microsoft has completed an investigation into reports that its November security updates caused some customers to experience so-called "black screens of death" and determined that the software giant's patches are not to blame.

The investigation comes after British security firm Prevx reported the issue on its blog, saying Microsoft's recent security fixes triggered the problem.

"The symptoms are very distinctive and troublesome," said David Kennerley, a Prevx support technician. "After starting your Windows 7, Vista, XP, NT, W2K, W2K3 or W2K8 PC or server, the system appears normal. However, after logging on there is no desktop, task bar, system tray or side bar. Instead you are left with a totally black screen and a single My Computer Explorer window."

He said the issue appears related to recent Windows updates that changed the way registry keys are handled due to new access control list (ACL) rules.

It is unclear how many Windows users were impacted, but Kennerley said the company determined there are at least 10 different scenarios "which will trigger the same black screen conditions."

But Christopher Budd, security response communications lead at Microsoft, said in a blog post today that the company has concluded the November security fixes -- six were distributed for 15 vulnerabilities -- are not the culprit.

"That investigation has shown that none of these updates make any changes to the permissions in the registry," he said. "Thus, we don't believe the updates are related to the 'black screen' behavior described in these reports."

Microsoft said that its November security updates made no change to registry permissions.

The issue may be related to a trojan, such as Daonol, which can result in black screens as part of its payload, Budd said. Even so, the problem does not seem to be affecting a broad base of customers.

"Because these reports were not brought to us directly, it's impossible to know conclusively what might be causing a 'black screen' in those limited instances where customers have seen it," he said.

See original article on scmagazineus.com