MS14-045 Security update for kernel-mode drivers August 12, 2014

MS14-045 Security update for kernel-mode drivers August 12, 2014

Mitigations

1.                   Restart the computer in safe mode:

§Windows 7

(http://windows.microsoft.com/en-us/windows/start-computer-safe-mode#start-computer-safe-mode=windows-7)

§Windows 8 and Windows 8.1:

a.                   If you have installation media for Windows 8.1 (such as a DVD or USB), start your computer by using the installation media. Insert the DVD or USB flash drive, and restart the computer. If you see a message that asks you to "Press any key to boot from DVD," do this. If you do not receive the message, you may have to change the restart order in your computer's BIOS settings so that the computer first starts to the DVD or USB. When you reach the Install Windows page, you should click Repair your computer to start the Windows Recovery Environment.

b.                  If you do not have media, you should use the power button to restart your computer during the startup process three times. This should start the Windows Recovery Environment. 

c.                   As soon as your computer starts in the Windows Recovery Environment, tap or click Troubleshoot on the Choose an option screen. If you do not see the Startup Settings option, tap or click Advanced options.

d.                  Tap or click Startup Settings., and then tap or click Restart.

e.                   On the Startup Settings screen, select the startup setting that you want. (Press 4 for safe mode.) 

f.                    Sign in to your computer by using a user account that has administrator rights.

2.                   Delete the fntcache.dat file. To do this, type the following command at command prompt

(http://windows.microsoft.com/en-us/windows/command-prompt-faq#1TC=windows-7)

, and then press Enter:

del %windir%\system32\fntcache.dat

3.                   After you delete fntcache.dat, restart the computer. The computer should now start successfully.

4.                   Click Start, click Run, type regedit in the Open box, and then click OK.

5.                   Locate and then click the following subkey in the registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Fonts\ 

6.                   Right-click the Fonts registry subkey, and then click Export.

7.                   Type a name for the exported reg file, and select a location to store the file. You will use this file later to restore the font registration that you will remove in the following steps. 

8.                   After you save the reg file, find any registry values under the Fonts registry subkey for which the data field meets the following criteria:

§Contains a full file path (not just a file name)

§The full file path ends in an ".otf" extension. (This indicates an OpenType font file.) 

9.                    Delete the fntcache.dat file again. (It will have been re-created.) To do this, type the following command at command prompt, and then press Enter:

del %windir%\system32\fntcache.dat

10.               Open the Programs and Features item in Control Panel, and then click View installed updates. Find and then uninstall any of the following update that are currently installed:

§KB2982791

§KB2970228

§KB2975719

§KB2975331

11.               Restart the computer. 

Find the reg file that you saved earlier, right-click the file, and then click Merge to restore the font registry values that you previously removed.

Note It’s safe to re-add these registry values now that the offending updates have been removed. 

Attachments:
29935721.png