RE: [Declude.JunkMail] OT: Disk pattern 0xDF in files -> Microsoft confirms KB920958 bug!
Microsoft re-released MS06-049 outside of their regular patch cycle, along with a patch to the VML/vgx.dll issue. http://www.microsoft.com/technet/security/Bulletin/MS06-049.mspx Andrew. > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Colbeck, Andrew > Sent: Monday, September 18, 2006 9:33 AM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] OT: Disk pattern 0xDF in > files -> Microsoft confirms KB920958 bug! > > And it made its appearance over at the SANS Internet Storm > Center handler's log: > > http://isc.sans.org/diary.php?storyid=1711 > > In short, Microsoft has admitted that there is a problem and > updated their advisory and also provided a hotfix. > > Andrew. > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > > Heimir Eidskrem > > Sent: Tuesday, September 12, 2006 7:16 AM > > To: declude.junkmail@declude.com > > Subject: Re: [Declude.JunkMail] OT: Disk pattern 0xDF in files -> > > Microsoft confirms KB920958 bug! > > > > Andy, > > > > Not sure if you saw it but this issue was brought up on Slashdot > > yesterday, so it got some exposure. > > > > Heimir > > > > > > Andy Schmidt wrote: > > > > > > Hi, > > > > > > I finally was able to get a confirmation from Microsoft Support > > > yesterday afternoon (case: SRZ060911001854) > > > > > > "We are aware the issue you are experiencing. A > > corresponding bugcheck > > > request is currently open, and the develop team is working > > on this issue. > > > However, the hotfix for this issue is not ready. > > > > > > 0xDF is the data pattern that NTFS returns when it has problem to > > > decompress the file (eg. the compression fragments are > > corrupted and > > > can't be decompressed). Based on my research, the actual > > raw data on > > > the disk is not changed, it shows as 0xDF because the > system cannot > > > decompress the file and display the data correctly. So the > > corrupt is not permanent. > > > > > > Further more, the issue only occurs on files which containing > > > Hexadecimal codes." > > > > > > Apparently, Microsoft decided not to warn people about this > > problem - > > > no comment has been added to KF920958 warning people which system > > > configurations will cause data loss (who cares if it's not > > permanent > > > if you can't use your data for a few months). > > > > > > Best Regards > > > Andy Schmidt > > > > > > Phone: +1 201 934-3414 x20 (Business) > > > Fax:+1 201 934-9206 > > > > > > > > > -Original Message- > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of > > > Heimir Eidskrem > > > Sent: Thursday, August 24, 2006 03:21 PM > > > To: declude.junkmail@declude.com > > > Subject: Re: [Declude.JunkMail] OT: Disk pattern 0xDF in files -> > > > KB920958 may be bad! > > > > > > Answers below. > > > > > > Andy Schmidt wrote: > > > > > >> Hi Heimir: > > >> > > >> I've been running a number of tests, am in contact with a third > > >> Microsoft customer and some pattern seems to emerge. I > also have a > > >> "lead" to a questionable Hotfix, but I'm trying to qualify > > that first. > > >> > > >> Can we first compare your systems to see what's the same > > (and may be > > >> relevant) and what's different: > > >> > > >> A) Disks are defined as "dynamic" > > >> > > >> > > > Dynamic > > > > > >> B) Disks are software mirrored using Win2k Disk Administration > > >> > > >> > > > no > > > > > >> C) The folders with the "problem" files have the "compression" > > >> attribute set! > > >> > > >> > > > yes. > > > > > >> D) Did the problem occur at some point after KB920958 was > > installed? > > >> > > >> > > > yes, I think so. > > > > > >> E) Do the corrupted files have a content of all 0xDF (it looks a > > >> little like an uppercase "B",
RE: [Declude.JunkMail] OT: Disk pattern 0xDF in files -> Microsoft confirms KB920958 bug!
And it made its appearance over at the SANS Internet Storm Center handler's log: http://isc.sans.org/diary.php?storyid=1711 In short, Microsoft has admitted that there is a problem and updated their advisory and also provided a hotfix. Andrew. > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Heimir Eidskrem > Sent: Tuesday, September 12, 2006 7:16 AM > To: declude.junkmail@declude.com > Subject: Re: [Declude.JunkMail] OT: Disk pattern 0xDF in > files -> Microsoft confirms KB920958 bug! > > Andy, > > Not sure if you saw it but this issue was brought up on > Slashdot yesterday, so it got some exposure. > > Heimir > > > Andy Schmidt wrote: > > > > Hi, > > > > I finally was able to get a confirmation from Microsoft Support > > yesterday afternoon (case: SRZ060911001854) > > > > "We are aware the issue you are experiencing. A > corresponding bugcheck > > request is currently open, and the develop team is working > on this issue. > > However, the hotfix for this issue is not ready. > > > > 0xDF is the data pattern that NTFS returns when it has problem to > > decompress the file (eg. the compression fragments are > corrupted and > > can't be decompressed). Based on my research, the actual > raw data on > > the disk is not changed, it shows as 0xDF because the system cannot > > decompress the file and display the data correctly. So the > corrupt is not permanent. > > > > Further more, the issue only occurs on files which containing > > Hexadecimal codes." > > > > Apparently, Microsoft decided not to warn people about this > problem - > > no comment has been added to KF920958 warning people which system > > configurations will cause data loss (who cares if it's not > permanent > > if you can't use your data for a few months). > > > > Best Regards > > Andy Schmidt > > > > Phone: +1 201 934-3414 x20 (Business) > > Fax:+1 201 934-9206 > > > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > > Heimir Eidskrem > > Sent: Thursday, August 24, 2006 03:21 PM > > To: declude.junkmail@declude.com > > Subject: Re: [Declude.JunkMail] OT: Disk pattern 0xDF in files -> > > KB920958 may be bad! > > > > Answers below. > > > > Andy Schmidt wrote: > > > >> Hi Heimir: > >> > >> I've been running a number of tests, am in contact with a third > >> Microsoft customer and some pattern seems to emerge. I also have a > >> "lead" to a questionable Hotfix, but I'm trying to qualify > that first. > >> > >> Can we first compare your systems to see what's the same > (and may be > >> relevant) and what's different: > >> > >> A) Disks are defined as "dynamic" > >> > >> > > Dynamic > > > >> B) Disks are software mirrored using Win2k Disk Administration > >> > >> > > no > > > >> C) The folders with the "problem" files have the "compression" > >> attribute set! > >> > >> > > yes. > > > >> D) Did the problem occur at some point after KB920958 was > installed? > >> > >> > > yes, I think so. > > > >> E) Do the corrupted files have a content of all 0xDF (it looks a > >> little like an uppercase "B", the German special "s", or like the > >> Beta > >> character) > >> > >> > > Yes > > > >> F) Does it appear as if only NEW files are effected? > >> > >> > > no, old files as well. BUT I think defrag ran this weekend and that > > would have moved some files - if that matters. > > > >> G) Does it appear as if only files are effected that are > close to a > >> multiple of 4K? > >> > >> > > Yes. > > > >> I broke the mirrors on my effected two servers and ran > ChkDsk /F. On > >> one server, ONE disk ChkDsk reported errors (including the > files that > >> I knew were corrupted) - virtually all of them were image > file types. > >> I reran the ChkDsk and it did NOT find errors. I then tried the > >> second disk of the mirror and it found no errors at all. I then > >> restablished the mirrors and my client continues
Re: [Declude.JunkMail] OT: Disk pattern 0xDF in files -> Microsoft confirms KB920958 bug!
Andy, Not sure if you saw it but this issue was brought up on Slashdot yesterday, so it got some exposure. Heimir Andy Schmidt wrote: Hi, I finally was able to get a confirmation from Microsoft Support yesterday afternoon (case: SRZ060911001854) "We are aware the issue you are experiencing. A corresponding bugcheck request is currently open, and the develop team is working on this issue. However, the hotfix for this issue is not ready. 0xDF is the data pattern that NTFS returns when it has problem to decompress the file (eg. the compression fragments are corrupted and can't be decompressed). Based on my research, the actual raw data on the disk is not changed, it shows as 0xDF because the system cannot decompress the file and display the data correctly. So the corrupt is not permanent. Further more, the issue only occurs on files which containing Hexadecimal codes." Apparently, Microsoft decided not to warn people about this problem - no comment has been added to KF920958 warning people which system configurations will cause data loss (who cares if it's not permanent if you can't use your data for a few months). Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Heimir Eidskrem Sent: Thursday, August 24, 2006 03:21 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] OT: Disk pattern 0xDF in files -> KB920958 may be bad! Answers below. Andy Schmidt wrote: Hi Heimir: I've been running a number of tests, am in contact with a third Microsoft customer and some pattern seems to emerge. I also have a "lead" to a questionable Hotfix, but I'm trying to qualify that first. Can we first compare your systems to see what's the same (and may be relevant) and what's different: A) Disks are defined as "dynamic" Dynamic B) Disks are software mirrored using Win2k Disk Administration no C) The folders with the "problem" files have the "compression" attribute set! yes. D) Did the problem occur at some point after KB920958 was installed? yes, I think so. E) Do the corrupted files have a content of all 0xDF (it looks a little like an uppercase "B", the German special "s", or like the Beta character) Yes F) Does it appear as if only NEW files are effected? no, old files as well. BUT I think defrag ran this weekend and that would have moved some files - if that matters. G) Does it appear as if only files are effected that are close to a multiple of 4K? Yes. I broke the mirrors on my effected two servers and ran ChkDsk /F. On one server, ONE disk ChkDsk reported errors (including the files that I knew were corrupted) - virtually all of them were image file types. I reran the ChkDsk and it did NOT find errors. I then tried the second disk of the mirror and it found no errors at all. I then restablished the mirrors and my client continues to have problems with new files. On the second server, I broke the mirror, again, the ChcDsk /F repaired a long list of errors. I did NOT reestablish the mirror and did not put that disk back in service. Please contribute to the thread in the Microsoft newsgroup: http://www.microsoft.com/technet/community/newsgroups/dgbrowser/en-us/ defaul t.mspx?dg=microsoft.public.win2000.file_system&mid=d826afe9-2ab1-4b2f- ae11-c c27702f574a Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Heimir Eidskrem Sent: Thursday, August 24, 2006 12:29 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] OT: Disk pattern 0xDF in files Follow up: During the day I did run chkdks with no switch to check the hard drive, it reported errors and could not continue. Last night I did run chkdsk /f on the partition and it did not find any errors this time. i did process a few thumbnails and they worked fine at 12:30am today. At 8:00am they still worked but now 11:27 they dont. This was old photos that I did reprocess again. A couple of new photos that was uploaded yesterday and processed yesterday is still working fine. I can't make much sense out of this. Not sure what to next. I dont think its hardware and I am certain its not our software. So that leaves OS. Heimir Eidskrem wrote: we are having the exact problem on one of our servers. We create small thumbnail pictures about 4k in size. They work fine at first but later they are corrupted. Windows 2000 server. I have no clue what it could be at this time. It started around this weekend I think. Please keep me posted if you find something. H. Andy Schmidt wrote: Hi, I have two older servers (but not same models or same purchase years) running Windows 2000 with mirrored disks (software Raid-1). Two days ag
Re: [Declude.JunkMail] OT: Disk pattern 0xDF in files -> Microsoft confirms KB920958 bug!
Why admit it unless your hand is forced? Since when did most corporations own up to their faults simply to be good netizens? Then there's always the anti-corporate train of thought that believes it is possible that they don't mind such issues existing on old software since it can cause upgrades to occur (see Ipswitch too). Of course that may be borderline schizo thinking. Matt Andy Schmidt wrote: Hi, I finally was able to get a confirmation from Microsoft Support yesterday afternoon (case: SRZ060911001854) "We are aware the issue you are experiencing. A corresponding bugcheck request is currently open, and the develop team is working on this issue. However, the hotfix for this issue is not ready. 0xDF is the data pattern that NTFS returns when it has problem to decompress the file (eg. the compression fragments are corrupted and can't be decompressed). Based on my research, the actual raw data on the disk is not changed, it shows as 0xDF because the system cannot decompress the file and display the data correctly. So the corrupt is not permanent. Further more, the issue only occurs on files which containing Hexadecimal codes." Apparently, Microsoft decided not to warn people about this problem - no comment has been added to KF920958 warning people which system configurations will cause data loss (who cares if it's not permanent if you can't use your data for a few months). Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Heimir Eidskrem Sent: Thursday, August 24, 2006 03:21 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] OT: Disk pattern 0xDF in files -> KB920958 may be bad! Answers below. Andy Schmidt wrote: Hi Heimir: I've been running a number of tests, am in contact with a third Microsoft customer and some pattern seems to emerge. I also have a "lead" to a questionable Hotfix, but I'm trying to qualify that first. Can we first compare your systems to see what's the same (and may be relevant) and what's different: A) Disks are defined as "dynamic" Dynamic B) Disks are software mirrored using Win2k Disk Administration no C) The folders with the "problem" files have the "compression" attribute set! yes. D) Did the problem occur at some point after KB920958 was installed? yes, I think so. E) Do the corrupted files have a content of all 0xDF (it looks a little like an uppercase "B", the German special "s", or like the Beta character) Yes F) Does it appear as if only NEW files are effected? no, old files as well. BUT I think defrag ran this weekend and that would have moved some files - if that matters. G) Does it appear as if only files are effected that are close to a multiple of 4K? Yes. I broke the mirrors on my effected two servers and ran ChkDsk /F. On one server, ONE disk ChkDsk reported errors (including the files that I knew were corrupted) - virtually all of them were image file types. I reran the ChkDsk and it did NOT find errors. I then tried the second disk of the mirror and it found no errors at all. I then restablished the mirrors and my client continues to have problems with new files. On the second server, I broke the mirror, again, the ChcDsk /F repaired a long list of errors. I did NOT reestablish the mirror and did not put that disk back in service. Please contribute to the thread in the Microsoft newsgroup: http://www.microsoft.com/technet/community/newsgroups/dgbrowser/en-us/ defaul t.mspx?dg=microsoft.public.win2000.file_system&mid=d826afe9-2ab1-4b2f- ae11-c c27702f574a Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Heimir Eidskrem Sent: Thursday, August 24, 2006 12:29 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] OT: Disk pattern 0xDF in files Follow up: During the day I did run chkdks with no switch to check the hard drive, it reported errors and could not continue. Last night I did run chkdsk /f on the partition and it did not find any errors this time. i did process a few thumbnails and they worked fine at 12:30am today. At 8:00am they still worked but now 11:27 they dont. This was old photos that I did reprocess again. A couple of new photos that was uploaded yesterday and processed yesterday is still working fine. I can't make much sense out of this. Not sure what to next. I dont think its hardware and I am certain its not our software. So that leaves OS. Heimir Eidskrem wrote: we are having the exact problem on one of our servers. We create small thumbnail pictures about 4k in size. They work fine at first but later they are
[Declude.JunkMail] OT: Disk pattern 0xDF in files -> Microsoft confirms KB920958 bug!
Hi, I finally was able to get a confirmation from Microsoft Support yesterday afternoon (case: SRZ060911001854) "We are aware the issue you are experiencing. A corresponding bugcheck request is currently open, and the develop team is working on this issue. However, the hotfix for this issue is not ready. 0xDF is the data pattern that NTFS returns when it has problem to decompress the file (eg. the compression fragments are corrupted and can't be decompressed). Based on my research, the actual raw data on the disk is not changed, it shows as 0xDF because the system cannot decompress the file and display the data correctly. So the corrupt is not permanent. Further more, the issue only occurs on files which containing Hexadecimal codes." Apparently, Microsoft decided not to warn people about this problem - no comment has been added to KF920958 warning people which system configurations will cause data loss (who cares if it's not permanent if you can't use your data for a few months). Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Heimir Eidskrem Sent: Thursday, August 24, 2006 03:21 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] OT: Disk pattern 0xDF in files -> KB920958 may be bad! Answers below. Andy Schmidt wrote: > Hi Heimir: > > I've been running a number of tests, am in contact with a third > Microsoft customer and some pattern seems to emerge. I also have a > "lead" to a questionable Hotfix, but I'm trying to qualify that first. > > Can we first compare your systems to see what's the same (and may be > relevant) and what's different: > > A) Disks are defined as "dynamic" > Dynamic > B) Disks are software mirrored using Win2k Disk Administration > no > C) The folders with the "problem" files have the "compression" > attribute set! > yes. > D) Did the problem occur at some point after KB920958 was installed? > yes, I think so. > E) Do the corrupted files have a content of all 0xDF (it looks a > little like an uppercase "B", the German special "s", or like the Beta > character) > Yes > F) Does it appear as if only NEW files are effected? > no, old files as well. BUT I think defrag ran this weekend and that would have moved some files - if that matters. > G) Does it appear as if only files are effected that are close to a > multiple of 4K? > Yes. > > I broke the mirrors on my effected two servers and ran ChkDsk /F. On > one server, ONE disk ChkDsk reported errors (including the files that > I knew were corrupted) - virtually all of them were image file types. > I reran the ChkDsk and it did NOT find errors. I then tried the second > disk of the mirror and it found no errors at all. I then restablished > the mirrors and my client continues to have problems with new files. > > On the second server, I broke the mirror, again, the ChcDsk /F > repaired a long list of errors. I did NOT reestablish the mirror and > did not put that disk back in service. > > > Please contribute to the thread in the Microsoft newsgroup: > http://www.microsoft.com/technet/community/newsgroups/dgbrowser/en-us/ > defaul > t.mspx?dg=microsoft.public.win2000.file_system&mid=d826afe9-2ab1-4b2f- > ae11-c > c27702f574a > > Best Regards > Andy Schmidt > > Phone: +1 201 934-3414 x20 (Business) > Fax:+1 201 934-9206 > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Heimir Eidskrem > Sent: Thursday, August 24, 2006 12:29 PM > To: declude.junkmail@declude.com > Subject: Re: [Declude.JunkMail] OT: Disk pattern 0xDF in files > > Follow up: > During the day I did run chkdks with no switch to check the hard > drive, it reported errors and could not continue. Last night I did run > chkdsk /f on the partition and it did not find any errors this time. > > i did process a few thumbnails and they worked fine at 12:30am today. > At 8:00am they still worked but now 11:27 they dont. This was old > photos that I did reprocess again. A couple of new photos that was > uploaded yesterday and processed yesterday is still working fine. > > I can't make much sense out of this. Not sure what to next. > I dont think its hardware and I am certain its not our software. > So that leaves OS. > > > Heimir Eidskrem wrote: > >> we are having the exact problem on one of our servers. >> We create small thumbnail pictures about 4k in size. >> They work fine at first but later they are corrupted. >> >> Windows 2000 server. >> >> I have no clue what it could be at this time. >> It started around this weekend I think. >> >> Please keep me posted if you find something. >> >> H. >> >> >> Andy Schmidt wrote: >> >>> Hi, >>> >>> I have two older servers (but not same models or same purchase >>> years) running Windows 2000 with mirrored disks (software Raid-1). >>> >>> Two days ago a customer noticed that they u
