MS04-011 Security patch causing blue screens STOP 0x0000001E

[Brent_34]

We have had this error on a few of our machines after installing the latest microsoft security patch MS04-011 just released on April 13 2004.

We booted the systems to safe mode and removed the update KB835732 and everything returned to normal.

[Michael Matthews_1 · Accepted solution]

We have traced this issue down to the remote desktop component of McAfee Anti-virus. If you remove that component, and resintall the hotfix, you should find that you do not get the 1E and everything will work fine.

Contact McAfee, and/or Microsoft to find a permanent resolution to this problem.

If you are having this problem, but do not have any McAfee products installed, or you continue to have the problem after removing this component, please let me know.

Thanks,
Mike

[Brent_34]

Bravo

[Max Kelfer]

Do you have any more details you can provide me...like type of hardware, OS (NT 4.0, W2K, W2K3) that Blue-Screened?

[Sean Valentine_1]

We had a similar problem on some of our systems. Instead of backing out the entire patch, we were able to replace the ntoskrnl.exe with the old version. This allowed our systems to operate normally.

Not sure what impact this has on the system or what vulnerabilities it leaves in place..

[Michael Matthews_1]

I still maintain my previous recommendation on this, but if there is a compelling reason to keep the remote desktop component installed, you might try rolling back Umandlg.dll instead of the entire kernel. Umandlg.dll is the Microsoft plug and play manager, and seems to be directly related to the problem. We had multiple successes with rolling back that file before McAfee was identified as being part of the problem.

There is still no conlusion as to which of the components are doing something wrong, but we at least have it narrowed down to a very small scope.
We will continue to analyze the problem until we are certain that it is not caused by any HP components.

[Eric Descheneaux]

I have 5 omnibook Xe3 laptop, when the KB835732 update is install the laptop can't reboot in any mode in windows. Win2000 is install.