You won’t believe why the Win7 Monthly Rollup, KB 4093118, keeps installing itself

Credit to Author: Woody Leonhard| Date: Fri, 20 Apr 2018 06:14:00 -0700

Yesterday, I talked about the weird bug that makes April’s Win7 Monthly Rollup, KB 4093118, re-install itself over and over, even when Windows Update says that it’s been installed successfully. Windows sleuth abbodi86 has discovered the source of the problem, and it should give you patching pause.

To understand how we got into this mess, you need to understand the bugs that Microsoft introduced in the March Win7 patches and their kludgey patches. Installing either the March Monthly Rollup (KB 4088875) or the March Security-only patch (KB 4088878) may knock your machine off the network. As Microsoft says:

To shore up the problem, Microsoft released the now-infamous KB 4099950, which fixes the NIC and static IP bugs — but only if you run KB 4099950 before you install the March patches. I call it the Carnak the Magnificent patch.

(KB 4099950 isn’t part of the normal patching regimen. It’s so convoluted, modified and poorly documented that patching pros are still trying to figure out how to use it.)

Dutifully, Microsoft’s April Monthly Rollup, KB 4093118, inherited the wayward ways of the March Monthly Rollup.

Microsoft suddenly realized that most Win7 patchers aren’t prescient, so they re-released the April Monthly Rollup, KB 4093118, last week, tacking the KB 4099950 shtick on the front of the Rollup. That way, anyone who installs the April Monthly Rollup automatically runs a routine called PCIClearStaleCache.exe, which clears the path for a non-buggy installation of the April Monthly Rollup.

To summarize, the latest version of the April Monthly Rollup starts by running PCIClearStaleCache.exe, so the Rollup itself won’t clobber NICs and static IP addresses. Got that?

All was suitably confused and barely functional (the re-release of KB 4099950 didn’t help), and then Microsoft released its Monthly Rollup Preview, KB 4093113. That’s the “preview” of non-security patches that are scheduled to appear next month.

Those of you who have witnessed this melodrama before know that you should boo and hiss when you see a Preview. They aren’t for normal people. You should never, ever install them unless you’re adept at bomb disposal.

But, of course, since Microsoft releases the Previews the same way it releases any other kind of patch — all it takes is a wayward click on a box to install a Preview — lots of people went ahead and installed this month’s Monthly Rollup Preview, KB 4093113, anyway.

Which is all well and good, unless you install the Monthly Rollup Preview, KB 4093113, before you install this month’s Monthly Rollup, KB 4093118.

Here’s what abbodi86 discovered:

If you install the Preview Monthly Rollup, KB 4093113, all previous (lower) rollups get marked in Windows Update as “superseded.” But the bundled PCIClearStaleCache.exe with this month’s Monthly Rollup, KB 4093118, does not know or recognize that it has been superseded. It will demand that KB 4093118 gets installed and activated.

Life will out, eh?

Abbodi86 has a gloomy prognosis:

So you will get a loop of KB4093118 re-installations until PCIClearStaleCache.exe realizes it isn’t need any more, or you hide KB 4093118. [Realize that] KB 4093113 is not borked or have anything to do with the issue. The problem lies with how Windows Update works with updates’ metadata.

Will Microsoft break the chain? Or will some Win7 users get stuck in a never-ending re-patch loop?

Ya gotta wonder who tests this stuff.

Thx abbodi86, PKCano, and geekdom.

Help us rearrange the deck chairs on the AskWoody Lounge.

http://www.computerworld.com/category/security/index.rss