Microsoft denies blame for 'black screens of death'

Computerworld - Microsoft today denied that its November Windows updates are causing a widespread "black screen" lock-out of users' PCs.

"Microsoft has investigated reports that its November security updates made changes to permissions in the registry that are resulting in system issues for some customers," Christopher Budd, Microsoft's security spokesman, said in an e-mail. "The company has found those reports to be inaccurate and our comprehensive investigation has shown that none of the recently released updates are related to the behavior described in the reports."

The report Budd referred to stemmed from a blog post by U.K.-based security vendor Prevx last week that claimed recent Windows updates changed Access Control List (ACL) entries in the registry, preventing some installed software from running properly. The result, said Prevx, is a black screen, sometimes dubbed "black screen of death" in an allusion to the "blue screen of death" that Windows puts up after a major system crash.

Since that initial report, Prevx has called out a pair of updates, one in late November and the other from last July, as the cause of the black screen lock-out.

"The conditions under which the actual black screen is triggered are spasmodic," admitted Dave Kennerley of Prevx's support team in an update to the original blog post of last week. "Some test systems always trigger the condition, others are less consistent. The windows patches which seem common to the issue arising are & KB915597 and KB976098."

Kennerley's use of the word "spasmodic" is a turn-about from his initial post of last Friday, which was headlined "Black Screen woes could affect millions on Windows 7, Vista and XP."

Searches of Microsoft's support forums by Computerworld have found only one "black screen" thread with posts from last month. Since yesterday, several additional users have reported that their PCs have been afflicted with a black screen.

"Received a patch on Nov 24 or 25. Upon reboot the computer has a totally black screen," said a user identified only as "General Zod" in a message added to the thread around 2:30 p.m. ET today. "Not even the BIOS startup stuff appears."

Kennerley also said that the flaw was in the WinLogon Shell registry entry for Explorer.exe, the name of Windows' file manager. "The entry exists perfectly in the registry but is unusable/inaccessible and is therefore ignored by the OS resulting in the desktop and task bar not being loaded," Kennerley added.

Some outsiders were skeptical today of Prevx's contention that the black screen problem was due to the two updates Kennerley cited. Rafael Rivera, who writes the Within Windows blog -- and most recently took Microsoft to task for lifting code from an open-source project for the company's Windows 7 USB/DVD Download Tool (WUDT) -- said his investigation pointed toward November's Malicious Software Removal Tool (MSRT) update. MSFT, which is upgraded and delivered to users automatically via Windows Update, detects and deletes malware that Microsoft has identified as pervasive and dangerous.