Since weekend update, small files up to 4096 bytes get corrupted

[Guest]

Yes.

Although we only tried very small text files - so another theory was that it
was just too small since it seemed to always effect files close to 4096 bytes
or a multiple thereof. (Of course, that was "anecdotal evidence" and may or
may not have been a conincident.)

 

[martin.vogel]

" Further more, the issue only occurs on files which containing

Hexadecimal codes."

If I have a look inside my files, all of them contain hexadecimal codes


It seems as if only non-compressible files with a (filesize modulo
4096) of about 3600 to 4095 became victims of the fatal bug. The list
of my damaged files contains mostly JPG-Files and archives. In detail
one 7z-files, eight exe-files (packed?), one bz2-file, five gz-files,
one tif-file, 116 .jpg-files and nine zip-files were partially
overwritten with the ßßßßßßß-sequence.

I cannot believe that the "raw" file on the disk is unharmed, as stated
by the microsoft employee above, for even Ubuntu Linux, when bootet
from CD at the same machine, read the same garbage out of the files as
Windows 2000 either with the patch deinstalled or installed.

 

[Mark V]

If I have a look inside my files, all of them contain
hexadecimal codes

Yep, a "good one".

It seems as if only non-compressible files with a (filesize
modulo 4096) of about 3600 to 4095 became victims of the fatal
bug. The list of my damaged files contains mostly JPG-Files and
archives. In detail one 7z-files, eight exe-files (packed?), one
bz2-file, five gz-files, one tif-file, 116 .jpg-files and nine
zip-files were partially overwritten with the ßßßßßßß-sequence.

In my testing here I found no existing (pre-KB920958) files
suffered corruption within +C directories. Setting -C succeeded in
decompressing all those files without damaging any.

I tested with a thousand random GIF and JPG files copying them into
a test directory set +C. Approximately 12% became corrupted. ALL
of the files damaged were in a range of
<even cluster value here>.89
to

I cannot believe that the "raw" file on the disk is unharmed, as

Neither can I (for new files).

stated by the microsoft employee above, for even Ubuntu Linux,
when bootet from CD at the same machine, read the same garbage
out of the files as Windows 2000 either with the patch
deinstalled or installed.

I suspect the files are corrupted (post KB920958) when copied into
a +C location. End of story after that.

 

[Adam Piggott]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In microsoft.public.win2000.file_system wrote:

In my testing here I found no existing (pre-KB920958) files
suffered corruption within +C directories. Setting -C succeeded in
decompressing all those files without damaging any.

I tested with a thousand random GIF and JPG files copying them into
a test directory set +C. Approximately 12% became corrupted. ALL
of the files damaged were in a range of
<even cluster value here>.89
to


Neither can I (for new files).


I suspect the files are corrupted (post KB920958) when copied into
a +C location. End of story after that.

I have a compressed, corrupted binary file that is damaged on disk but is
OK in a backup (which is also compressed via NTFS). After removing KB920958
the original is still damaged if read as compressed or decompressed;
confirming that the raw data is indeed damaged.

Cheers,

Adam Piggott, Proprietor, Proactive Services (Computing).
http://www.proactiveservices.co.uk/

Please replace dot invalid with dot uk to email me.
Apply personally for PGP public key.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)

iD8DBQFFCEyR7uRVdtPsXDkRArnZAJsEGIfMZYPLNwYQ1aMwbPdX/sdgBQCfUk50
5GqZ08qPDG5+ytb5RMy74XM=
=stBG
-----END PGP SIGNATURE-----

 

[Mark V]

In microsoft.public.win2000.file_system

Hi,

I have two different servers (different models and manufacturing
years), but both of them running Windows 2000 server with
software mirrored NTFS drives, which suddenly corrupt small
image thumbnail files after an hour or two.

[ ]

Sep 15, 2006

http://support.microsoft.com/kb/920958 (MS06-049)

Article ID : 920958
Last Review : September 15, 2006
Revision : 2.0

MS has updated the article, to acknowledge the problem with
potential file corruption.

While the KB920958 file has not yet been re-released, MS is
offering a Hot Fix as detailed in
http://support.microsoft.com/kb/925308
==========================================
To resolve this problem immediately, contact Microsoft Product
Support Services to obtain the hotfix. For a complete list of
Microsoft Product Support Services phone numbers and information
about support costs, visit the following Microsoft Web site:
==========================================

US anyway: 1-800-936-4900, opt. 1 and
"Article ID : 925308"
"Compressed files that are larger than 4 kilobytes may be
corrupted when you create or update the files"
"Windows 2000"
Etc.

No charge.

Note that the original fix, Windows2000-KB920958-x86-ENU.EXE
will be updated eventually. This Hot Fix is subject to further
testing and so on...

 

[Mark V]

In microsoft.public.win2000.file_system

Hi,

I have two different servers (different models and manufacturing
years), but both of them running Windows 2000 server with
software mirrored NTFS drives, which suddenly corrupt small
image thumbnail files after an hour or two.

[ ]

Sep 15, 2006

http://support.microsoft.com/kb/920958 (MS06-049)

Article ID : 920958
Last Review : September 15, 2006
Revision : 2.0

MS has updated the article, to acknowledge the problem with
potential file corruption.

While the KB920958 file has not yet been re-released, MS is
offering a Hot Fix as detailed in
http://support.microsoft.com/kb/925308
==========================================
To resolve this problem immediately, contact Microsoft Product
Support Services to obtain the hotfix. For a complete list of
Microsoft Product Support Services phone numbers and information
about support costs, visit the following Microsoft Web site:
==========================================

[ ]

Following up:
The HotFix (HOT-FIX_287398_ENU_i386_zip.exe for
Windows2000-KB925308-x86-ENU.EXE) appears here to have entirely
resolved the file corruption issue. No test files copied into, out
of, or edited in-place (in +C location) suffered any damage
whatsoever. "Test files" includes files known to corrupt pre-
HotFix. Recall that in all probability any files damaged pre-
HotFix will remain damaged (not specifically tested here).

Installed HotFix on W2K Pro, NTFS, SP4+ and without uninstalling
Windows2000-KB920958-x86-ENU.EXE (MS06-049)

FWIW and YMMV

 

[Marc Kupper]

While the KB920958 file has not yet been re-released, MS is

offering a Hot Fix as detailed in
http://support.microsoft.com/kb/925308

As a FYI - I have written a scanner that will list files that seem to
be corrupted by KB920958. It's available from
http://marc.kupper.googlepages.com/scandf

This utility can't repair your files though it's possible enough
information was written to disk that Microsoft will be able to issue an
update that allows for reading the original file data.

Marc

 

[Mark V]

As a FYI - I have written a scanner that will list files that
seem to be corrupted by KB920958. It's available from
http://marc.kupper.googlepages.com/scandf

In case it is not otherwise known, that mentioned HotFix was publicly
released (same files) on the 20th as
KB-925308
http://support.microsoft.com/kb/925308/

This utility can't repair your files though it's possible enough
information was written to disk that Microsoft will be able to
issue an update that allows for reading the original file data.

I doubt that is possible. Damaged files were literally stored in
that condition in the file system...data irreparably lost, restore
from clean backup.

 

[Marc Kupper]

Earlier I had written:
Mark V replied:

I doubt that is possible. Damaged files were literally stored in
that condition in the file system...data irreparably lost, restore
from clean backup.

I'd tend to agree and late last night had another thought in that it's
possible a data block for the last block was not allocated/written to
at all. I'm basing this thought on that it's always the last block
that's lost plus a comment on slashdot iirc where someone got a file
size mismatch error when they tried to load up a corrupted file using
some sort of raw disk editor (where they'd see whatever is actually
written to disk).

One of the first things I did though when I realized files were getting
corrupted was to run chkdsk which did not find any problems.

Initially I had been thinking that *something* was written to disk but
that its structure was not recognized by the decompression code which
then spun out the DF bytes in it's place.

Marc

 

[Mark V]

In microsoft.public.win2000.file_system

Hi,

I have two different servers (different models and manufacturing
years), but both of them running Windows 2000 server with
software mirrored NTFS drives, which suddenly corrupt small
image thumbnail files after an hour or two.

[ ]

Microsoft Security Bulletin MS06-049
Vulnerability in Windows Kernel Could Result in Elevation of
Privilege (920958)
Published: August 8, 2006 |
Updated: September 26, 2006
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
================== excerpt ======================
V2.0 (September 26, 2006): The update has been revised and re-
released for Microsoft Windows 2000 Service Pack 4 to address
issues identified in Microsoft Knowledge Base Article 920958.
=====================================================

http://www.microsoft.com/technet/security/Bulletin/MS06-049.mspx
This is the patch (v1) for W2K that caused corrupt files in on-disk
Compressed files.

First MS issued a HotFix for W2K 2006-09-15
Then issued those same files via KB-925308 2006-06-20
And finally they have incorporated the files
for W2K back into the "049" package for W2K.

W2K users should apply one of the "corrected files" packages if
they ever installed MS06-049, (920958) version 1.
W2K users that store Security pkg. files locally should update
their stored copy to "version 2".
Windows2000-KB920958-v2-x86-ENU.EXE 1,603,560 bytes
MD5: 09f6b7733eca534b2620549e1e184f7d

All three sources of "corrected files" contain the same 5 updated
files.

 

[pavo5026]

Hi,

I have two different servers (different models and manufacturing years), but
both of them running Windows 2000 server with software mirrored NTFS drives,
which suddenly corrupt small image thumbnail files after an hour or two.

No larger file sizes seem to be effected. The file content is set to all
binary 0xdf.

If we replace those files with valid copies, then those files will appear to
be correct for a while (probably read back from cache) but after some time
they will "revert" back to all 0xdf.

I have since been in contact with another customer who has the exact same
problem with his Windows 2000 server also since around the past weekend. In
the days prior we did install recent security fixes and Microsoft product
updates that were released in the past month.

Is there anyone else out there with the same problem?