Shell32 Security Patch Disables TweakUI Function

The new Microsoft security patch for the Windows shell that replaces the shell32.dll file (Q313829) also disables the function of TweakUI for removing shortcut arrows on Desktop icons.

Has anyone heard or read about Microsoft issuing a fix, or a new Buffer Overrun Windows Shell32 security patch?


Ramona

 

Ramona: I began a new thread in the Windows 98 forum a few minutes ago because I downloaded that patch this morning and then found my icons messed up. Not only were many of them suddenly graced with that dumb arrow, but one of them was changed from its original unique appearance to a generic icon. Shortly after submitting that post, I was directed by Zephyr to this thread. I sure wish I'd seen your warning before I installed the patch.

I guess the only thing to do now is to wait for a patch for the patch. * sigh *

 

Hi BOBBO,

Darn! Sorry you missed my post. More of a warning than anything, but I also had hoped that someone may have heard of a workaround.

There are several threads on the microsoft.public.win98.gen_discussion Newsgroup, relating to this patch. If I hear of either a MS fix or workaround, I will be sure to post it here.

Ramona

 

I'll be watching for it, Ramona. I'm looking forward to getting rid of those dopey little arrows.

 

Possible Fix

BOBBO reports a possible fix HERE

Good luck all.

 

Hey, Ramona, I found a solution! It was provided by Zephyr in a thread I started yesterday in the Windows 98 forum. It involves deleting two lines from the Registry, so the usual precautions and care are needed as whenever editing the Registry, but his solution worked for me.

To Remove shortcut icon arrows:

- Delete [HKEY_CLASSES_ROOT\LNKFILE\IsShortcut]
- Delete [HKEY_CLASSES_ROOT\PIFFILE\IsShortcut]

I've encouraged Zephyr to check your thread in this forum and post his idea and the rationale behind it. He deserves the credit.

 

Hi BOBBO,

Thanks for posting Zephyr's fix on this thread. I am keeping up with the Windows 98 thread as well.

I would be very interested in the importance of the two Registry keys which Zephyr suggested deleting... and which worked for you! Will they in any way negate the security patch, or does this step accomplish the same thing as the TweakUI removal of the arrows in this key:

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons

I ask, because PCForrest has posted a fix on his site:

Shell32 Critical Update

Update (14/03/2002)
The March 7th Critical Update appears to corrupt shell32.dll, causing shortcut arrows to remain on screen, regardless of which setting you use. To restore this file, run SFC and replace it with the copy on the Windows 98 CD. A reboot is required.
----

This fix, however, would again leave you vulnerable to the Shell32.dll buffer overrun.

Ramona

 

Just another small bit of information from the Newsgroup, via a cyber buddy, on Zephyr's Registry edit:

That's one of the solutions that has been discussed at the Win 98 group. It's a different way of killing shortcut arrows than what TweakUI used to do, which was to substitute a different icon, such as a transparent icon or a light arrow icon, for shell32.dll #29, the big arrow. Basically the "delete IsShortcut" approach is instead telling Windows that .lnk and .pif files aren't even shortcuts, so no overlays are drawn at all. It does preserve the functionality of the security update, but unfortunately it can have side effects, such as duplicate right-click menu entries and problems navigating in Microsoft Office programs.

FWIW,

Ramona

 

Ramona: Aarrgggghhh! I deleted the two lines from my Registry, as I mentioned earlier. Now I'm wondering if I've done more harm than good. I've gotten rid of all the little arrows on the icons, and everything seems to work OK as far as I can tell so far. I just now attempted to copy the Shell32.dll file from my Win98 Upgrade CD, thinking that would return the Shell32.dll file to its original condition, but a Find search couldn't locate the file on the CD. How come? I know there are Web sites that have dll's for download. Should I try that, or should I put those two lines and their values back in my Registry, or am I better off leaving well enough alone?

 

Hi BOBBO,


If you're having no problems with duplicate right-click menu entries or problems navigating in Microsoft Office programs, leave it alone. My motto is: "when in doubt do nothing ". In your situation that's exactly what I would do... nothing! MHO is that I wouldn't mess with the original shell32.dll from the CABS. You no doubt backed up the Registry keys that you deleted, so you're O.K. there.

Hopefully either MS or the TweakUI Team will come up with a fix for everyone. If there's one thing I've learned about the Security or Critical updates, it is to wait at least a week for installing them. This gives you time to check around the NG's and BBS' to see if there are any problems, or if MS does a followup on the Security Bulletin.

I didn't intend to create panic here, just to inform users. This is by no means a criticism of Zephyr's workaround either. I just wanted to share the information that I discovered.

So relax, and be !



Ramona

 

Good advice Ramona.

One should always wait before installing any updates as you say.

BOBBO, If you have a serious case of remorse, copy the following script to your Clipboard and paste it into Notepad. Save it as c:\windows\desktop\zephyr.reg Then exit Notepad and double click the resultant file you find on your Desktop. That will merge the line you deleted back into your Registry and get you back to where you were. Refresh the Desktop by pressing f5 and all the arrows will return.

--------------------------begin copy----------------

REGEDIT4

[HKEY_CLASSES_ROOT\lnkfile]
"IsShortcut "=" "

[HKEY_CLASSES_ROOT\piffile]

"IsShortcut "=" "

---------------------end copy--------------------------


Now, if you want to replace the shell32.dll with a copy from your Win98 disk, you'll find it in Win98_38.cab in the Win98 folder of your install disk. You'll need Winzip or some other Unzipping utility to extract it of course. Extract it to your C:\ root for ease of finding later in DOS. Exit Windows to a native DOS session and from the C:\ prompt type the following text, pressing enter after each line:

ren c:\windows\system\shell32.dll shell32.pch
copy c:\shell32.dll c:\windows\system\

That should get you back like you were before the patch was downloaded and TweakUI should be functioning normally now. Boot up and check your icons. If the arrows are still there you may now need to set TweakUI properly again by untagging the proper box.

If all is well, you can delete the Desktop files created and also the shell32.dll file found in your c:\ root.

Then if you really don't think you'll want to change back to the patch again, you can also delete the Windows\System\shell32.pch file.

Incidentally, this arrow hiding does not work on Desktop shortcuts to Web sites so don't be alarmed if you have some of those and they didn't change.

Edit If you don't feel you have the necessary DOS skills, post back and I'll give you a batch file script to automate it for you.

 

Zephyr: Since everything APPEARS to be working OK now, I think I'll leave everything the way it is for the time being and, as Ramona wisely advises, play it

 

Hi Zephyr,

BOBBO is having a serious case of "I wish to Hades I hadn't messed with that blasted update "! (Just had to josh you a little BOBBO.)

Thanks for all the addition information, in case anyone wants to reverse their situation.


Ramona

 

Good enough.

I can't blame you. I'm big on leaving well enough alone. It'll all be here waiting for you when the dust settles in case you do need it.

I wanted to follow through with it to the end so that the post would be complete for others to use. I wasn't trying to press the issue.

ciao

 

UPDATE

I bounced the deleting of registry keys idea off PCForrest and I'll share his response with all.

I suppose the method of restoring the shell32.dll may get to be the most popular choice now.

 

Excellent follow through!

Zephyr,

Thank you for nailing down the true effects of the Registry edit for this MS fiasco. I really appreciate your sharing PC Forrest's response to your inquiry.

Ramona

 

My pleasure Ramona.

It was your mention of the possible consequences that prompted me to inquire of Peter Forrest so a pat on the back goes to you as well.

This may not be the end of this issue, since even Peter Forrest can be mistaken, but he makes a lot fewer gaffes than I do.

Best regards,

Zephyr

 

Arrow short cuts w/ tweak UI

Thanks, Bobbo, Zephyr, and Ramona. Wish I had seen Ramona's post and this thread before I updated Windows. I thought something was wrong with Tweak UI, uninstalled it and installed the "newer" tweak UI. I just might leave it alone, but I prefer the light or no arrows. Replacing the shell32.dll sounds like the best choice, but will it cause other problems. A while back my send to stopped working for items that I had added to it, and I vaguely remember it also having something to do with shell32.dll

 

oops!! posted to the wrong thread

Posted to wrong thread, this should go with the thread discussing the Tweak UI arrow problems caused by the new MS security patch downloads.

Sorry,

Marvin

 

tweak UI arrows ?

Thanks for your responses to my guestion. Wish I had seen this thread and/or Ramona's warning about the security windows98 update which caused this problem. I decided to save the shell32.dll of 12-06-01, to a floppy and rename it and install the shell32.dll from the Win98SE cab, even though I still have Win98OE w/most critical updates.

I now have the 1.33 ver of Tweak UI and I can now again change to the light arrows.

Marvin