IE CRITICAL UPDATE: Disable ADODB.Stream object

http://support.microsoft.com/default.aspx?kbid=870669

An ADO stream object represents a file in memory. The stream object contains several methods for reading and writing binary files and text files. When this by-design functionality is combined with known security vulnerabilities in Microsoft Internet Explorer, an Internet Web site could execute script from the Local Machine zone. This behavior occurs because the ADODB.Stream object permits access to the hard disk when the ADODB.Stream object is hosted in Internet Explorer.

Any line-of-business Web application that requires a file to be loaded or to be saved to the hard disk may use the ADODB.Stream object in Internet Explorer. For example, if an intranet server hosts a form that an employee must download and fill out, the ADODB.Stream object is used to obtain the file and to save the file locally. After the user edits the file locally and submits the file back to the server, the ADODB.Stream object is used to read the file from the local hard disk and to send the file back to the server.

Microsoft has provided two methods that you can use to disable the ADODB.Stream object from Internet Explorer. Only the ADODB.Stream object in Internet Explorer will be affected. No other ADO objects are affected by this change.

HOW TO DOWNLOAD THIS REGISTRY PATCH:

Select this link if you use W/2000 or XP

CAUTION: I've seen a few reports of Intranet applications breaking. From a corporate perspective, TEST, TEST, TEST ...

Hopefully, problem areas for this update will be few and far between. So far, I haven't seen widely reported issues, as most Internet and Intranet applications should continue to work properly. Still, I would recommend some quick testing of applications to avoid manually repairing workstations.

This update could impact users when older or poorly written Intranet based web apps break. The documentation notes there are no workarounds and implies "the application must be rewritten to avoid the ADODB.Stream vulnerability". If it's a critical application that breaks, then you may have to skip the update.

On the "breaking of applications" issues, MS has updated their site with backout instructions (you can't uninstall this update which basically scripts in a registry entry). To backout you will need to edit the registry to restore prior values:

http://support.microsoft.com/default.aspx?kbid=870669

This update which first appeared for Windows 2000 and XP users, it is now available for Windows 98. I applied this yesterday and no issues have surfaced so far in my own testing.

Critical Update for ADODB.stream (KB870669)
http://support.microsoft.com/default.aspx?kbid=870669

Click this link to install:
http://windowsupdate.microsoft.com/

Hi all.
Hope this is the right place to ask this.
Should I be worried? I use Firefox for everything except looking for MS updates. On July 2nd the Adodb.stream patch came through automatically. Today after the automatic d/load of the recent critical updates I found a desktop file that looked like a backup file. I tried unsuccessfully to open it, R clicked for properties, and found it was the adodb.stream file. I scanned with AVG, and then deleted it.
I have the following protecetion: ZApro, PestPatrol, Spyware Blaster, IE spyad, Spyware Guard, Adaware and AVG.
How would I know whether it was still lurking around, and where did it come from?
I'd be very grateful for any advice!

Cheers
Luci2a

This may have been the removal tool to scan and remove it from your computer. I believe it was on the MS page, though not in the critical update.
Regards,
John

What was the name of the file exactly? Do you reember?

On the desktop it just had the little squiggle that I think is called a tilde. I think this is usually associated with backups? When I tried to open it, then clicked on properties, there was no information. I scanned it with AVG, then selected Firefox to try to open it, as I had recently enabled backup of my Firefox bookmarks, and wondered if it was that, which I haven't been able to find anyway. It was then that I thought I saw adodb.stream in the filename. FF could not open it anyway; I declined to save it, and deleted the whole thing.
It was only when reading the above thread later that I noticed the reference to adodb and started worrying!
I am really not 100% sure about the filename, so this may be an unnecessary panic, for which I apologise!

I am not a computer expert - just very grateful for advice for keeping safe!

Cheers
Luci2a

Sorry John, forgot to reply to you. The MS updates yesterday came down automatically - would it have been in those if it had been the removal tool you mentioned? It was not there after the July 2nd update which addressed the adodb problem.

thanks for all help.

Luci2a