Oh, wow – sometimes the power of social media, the blogs and the internet can backfire. I guess in the meantime you have seen the claims by Prevx that approx. 80 million of PCs are affected by the Black Screen of Death problems supposedly caused by our November Security Updates. This caused (and still causes) a huge wave of reports about that and one could feel that there is a really big problem out there. On one of the blogs you see a collection of the articles about that: Latest Microsoft patches cause black screen of death, Microsoft looking into Windows 'black screen of death' problem.
Now, there are different worries for me: One is that the post by Prevx as well as the title of the above mentioned blog post state it as a fact that our Security Updates caused that. Additionally Prevx makes a statement about the supposed size of the problem – this statement is approximately as good a guess as you could do by taking any random number between 1 and 480’000’000 (the approx. hitrate on Microsoft Update). And finally – and this is the biggest concern to me – customers are now holding back the deployment of our Security Update because of this.
So, let’s get it straight: We have been looking into this problem (obviously). You can find the official statement quoted in the SeattlePI:
- Microsoft is investigating reports that its latest release of security updates is resulting in system issues for some customers.
- Based on our investigation so far we can say that we're not seeing this as an issue from our support organization.
- The issues as described also do not match any known issues that have been documented in the security bulletins or KB articles.
- As always, we encourage customers to review the security bulletin and related KB articles and test and deploy security updates.
- If customers do encounter an issue with security updates, we encourage them to contact our Customer Service and Support group for no-charge assistance. Customers can contact CSS using the information at http://support.microsoft.com/security.
If we add some additional meat to this: Up to now, we have no evidence at all to validate the concerns. Currently we do not have any support volumes to either support the claims or validate the presence of a growing concern. Additionally, our investigation has shown no evidence at all that our security updates nor the Malicious Software Removal Tool nor the non-security updates make the changes as claimed by the Previx reports.
Looking at that, you should now make your risk assessment and decide which source you want to trust. For me, the ultimate source for information you should build your assessment on is neither Twitter nor your brother’s sister in law’s father's brother (unless he works for Microsoft’s security) but our website.
UPDATED WITH MSRC BLOG POST: http://blogs.technet.com/msrc/archive/2009/12/01/reports-of-issues-with-november-security-updates.aspx
Roger