Certain VB controls no longer display on web pages after installing KB960715
Hi everyone,
This is Shahinur again and I wanted to write about an important issue that could affect many of you who are hosting legacy VB controls on your web page.
After installing the security update that released in February 2009, KB960715 (Update Rollup for ActiveX Kill Bits), certain VB controls might no longer display on a web page. A red “x” is displayed in the place of where the control would normally load. This is because some of the known VB controls have been kill-bitted by this update:
{1E216240-1B7D-11CF-9D53-00AA003C9CB6} Microsoft Animation Control, version 5.0 (SP2)
{3A2B370C-BA0A-11d1-B137-0000F8753F5D} Microsoft Chart Control 6.0 (SP6) (OLEDB)
{B09DE715-87C1-11d1-8BE3-0000F8754DA1} Microsoft Animation Control 6.0 (SP6)
{cde57a43-8b86-11d0-b3c6-00a0c90aea82 } Microsoft DataGrid Control 6.0 (SP6) (OLEDB)
{6262d3a0-531b-11cf-91f6-c2863c385e30} Microsoft FlexGrid Control, version 6.0 (SP6)
{0ECD9B64-23AA-11d0-B351-00A0C9055D8E} Microsoft Hierarchical FlexGrid Control 6.0 (SP6) (OLEDB)
{C932BA85-4374-101B-A56C-00AA003668DC} Microsoft Masked Edit Control, version 6.0 (SP6)
{248dd896-bb45-11cf-9abc-0080c7e7b78d} Microsoft WinSock Control, version 6.0 (SP6)
You can find more information about kill-bits here, KB240797 (How to stop an ActiveX control from running in Internet Explorer).
Just to give some background information, when a control is kill-bitted, the value of the Compatibility Flags DWORD under the following registry hive gets set to 0x00000400.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\<CLSID of the ActiveX control>
Often an alternate control is released in place of the old unsafe control and the CLSID of this new control gets added under the AlternateCLSID string of the same registry hive.
The challenge we face with the KB960715 update is that although it kill-bitted certain commonly used VB controls, no alternate CLSIDs were provided for those controls.
However, there is remedy to this problem. Since these are Visual Basic Controls, a VB cumulative update released in December 2008 did have new controls that replaced the kill-bitted controls.
For a list of all the controls that were updated with this roll-up see, KB957924.
In order to get a hold of these controls, you would need to have at least one development machine where you have the Visual Basic 6 IDE installed. You should then install the following updates on that machine:
This will update your system with the new controls, which you can host on your web page. However, there is still one more step you need to follow to get this to work. All of the kill-bitted controls are licensed controls. You need a license file for them to work. The existing LPK file you would have on your page would only contain licenses for the old controls.
Typically, you can use the LPK Tool to create a license package. Unfortunately, you cannot do so in this case because the new CLSIDs for the kill-bit/phoenixbit are hidden on your development machine. Only the legacy CLSIDs are available. In this case, you would need to contact Microsoft Support to generate an LPK file for you.
There has been discussion around doing some work on IE’s License Manager so that it knows how to instantiate a new control even with an old license. We will keep you posted on the outcome of that effort…
Thank you,
The IE Support Team