Internet Explorer ActiveX compatibility patch for Mshtml.dll

The update that this article describes has been replaced by a newer update. To resolve the problem that this article describes, install the most current cumulative security update for Internet Explorer. To install the most current update, visit the following Microsoft Web site: For more technical information about the most current cumulative security update for Internet Explorer, visit the following Microsoft Web site: This article is intended for IT professionals. Home users can visit the following Microsoft Web site for information about the symptoms that they may experience:

Microsoft is releasing a compatibility patch that will disable the behavior of the Microsoft Internet Explorer ActiveX patch that was originally released on February 28, 2006. The Internet Explorer ActiveX patch is also included in Internet Explorer security update 912812 (Microsoft Security Bulletin MS06-013). The update affects the following products:

• Windows XP Service Pack 2 (SP2)
• Windows XP Professional x64 Edition
• Windows Server 2003 Service Pack 1 (SP1)
• Windows Server 2003, x64-based versions
• Windows Server 2003 with SP1, Itanium-based versions

Note The update does not apply to Windows Vista.

This update was discussed in Microsoft Security Advisory (912945): Non-Security Update for Internet Explorer. For more information, click the following article number to view the article in the Microsoft Knowledge Base: The compatibility patch includes the following updates:

• Compatibility Patch for Internet Explorer for Windows XP SP2
• Compatibility Patch for Internet Explorer for Windows Server 2003 SP1
• Compatibility Patch for Internet Explorer for Windows Server 2003 SP1, Itanium-based versions
• Compatibility Patch for Internet Explorer for Windows Server 2003, x64-based versions
• Compatibility Patch for Internet Explorer for Windows XP Professional x64 Edition

Re-release information

The compatibility patch was re-released on April 20, 2006. If you have already deployed the original release of this compatibility patch and you are not experiencing any issues, you do not have to re-deploy this compatibility patch.

This re-released compatibility patch resolves a display issue for ActiveX controls that were developed by using Microsoft Visual Basic. Security update 912812 (Microsoft Security Bulletin MS06-013) may prevent a VBScript script from controlling the visibility of these ActiveX controls. For example, if the ActiveX control was originally hidden by using the visibility:hidden DHTML element attribute, and then later the attribute property is set to visibility:visible by a script, the ActiveX control does not display.

This display issue for ActiveX controls that were developed by using Microsoft Visual Basic is currently under review and a fix for this issue could be included in a future security update for Internet Explorer.

When you deploy this patch, it disables the behavior of the Internet Explorer ActiveX patch that is contained in update KB912812. The security updates that are contained in update KB912812 are still present and are still functional. Only the Internet Explorer ActiveX patch behavior that is described in update KB912945 is disabled. For more information about the KB912812 update, click the following article number to view the article in the Microsoft Knowledge Base: This compatibility patch can only be installed on systems that are running the Internet Explorer April Cumulative Update (KB912812). If you try to install this patch on systems without update 912812, the installation will fail.

We strongly recommend that this compatibility patch be deployed only to systems that are affected by the new functionality that is introduced by the Internet Explorer ActiveX update. Affected systems are those where the user depends on a Web page or on an application that has been affected by the Internet Explorer ActiveX update. For more information about how Web pages or applications can be affected, click the following article number to view the article in the Microsoft Knowledge Base: We encourage our partners to test and to redesign affected Web applications. Owners of applications that require user interaction with ActiveX controls can use technologies to avoid user activation. For information about these technologies, visit the following MSDN Web site:

Testing

For testing, there is a feature control registry subkey that turns on the Internet Explorer ActiveX behavior. This registry subkey and its value are as follows: You must replace <process_name.exe> with the name of the process for which you want to enable the ActiveX update behavior. For example, to enable the ActiveX update behavior for Internet Explorer, you would replace <process_name.exe> with iexplore.exe.

Deployment

We strongly recommend that you apply this patch only to computers where there is a compatibility problem between an existing application and the new behavior that is introduced in update 912945 and described in Microsoft Knowledge Base article 912812. This section lists several, but not all, deployment options. You should follow the standard hotfix deployment process for your environment. This article contains some details that are specific to deployment. However, this article is intended as a reference for some, but not all, deployment options.

The deployment process consists of the following steps:

1. Identify applicable computers.
2. Apply the update to those computers.

Restart requirement

Installation of this compatibility patch may require a restart if the Mshtml.dll file is being used during installation.

Identifying applicable computers

Microsoft Knowledge Base article 917425 (KB917425) can be applied to a computer where Internet Explorer ActiveX behavior has a compatibility problem with an application on the computer. To determine whether KB917425 applies to a computer programmatically, you must have a guaranteed method of determining whether a computer has the affected ActiveX software. Work with the software application’s vendor to determine that method. To manually determine whether KB917425 applies to a computer, use the following methods.

• Use Active Directory organizational units
  If an environment is supported by the Active Directory directory service and if an existing Active Directory organizational unit contains all applicable computers, apply a Microsoft Systems Management Server (SMS) software update package to the organizational unit.
  
  Note SMS Active Directory discovery must be enabled to use this method.
• Use SMS Software Inventory to create a custom collection
  For environments that use SMS to deploy software to computers, an administrator can create a custom collection that is based on any number of factors. These factors include a query of computers that have the affected software package. This query can be based on the results of SMS Software Inventory. For information about how to implement software inventory that includes creating custom collections, visit the following Microsoft Web site:
  http://technet.microsoft.com/en-us/library/cc180952.aspx

  (http://technet.microsoft.com/en-us/library/cc180952.aspx)
• Create a custom detection tool that identifies applicable computers
  Create a script or a small executable program that determines whether the computer has the affected software package. This tool can run as part of a logon script, can be delivered as a SMS Software Update Package, or can be put on an internal network share that users can access.

Applying the update to applicable computers

How to use SMS

If you are using Active Directory organizational units or SMS Software Inventory to identify computers to update, you can use SMS 2.0 and SMS 2003 to deploy the 917425 package to affected computers. To do this, use the SMS software distribution feature. To see a high-level walk-through of the process, visit the following Microsoft Web site: For more information, see the Systems Management Server 2003 Operations Guide. To view this guide, visit the following Microsoft Web site:

Package definition file

To help customers use SMS to deploy the 917425 package, we are including the contents of a sample SMS package definition file (PDF) that can be used to create the software distribution package and the programs in the SMS Administrator console.

To use the sample PDF, copy the following text to a Notepad file, and then save the file as KB917425.SMS. Copy this file to the same directory where the download update was saved. After the PDF and the update packages have been saved to the same directory, follow these steps:

1. Run the Create Package from Definition Wizard. To do this, right-click any existing package, click All Tasks, and then click Create Package from Definition.
2. Import the PDF to create the package and the programs that you want to use for deployment.

Notes

• 64-bit client deployments are only supported by SMS 2003 SP2 and later versions. If you have any earlier versions of SMS, you must delete the last two sections (WS03IA64, WinXPWS03x64) in the PDF. You must also remove WS03IA64 and WinXPWS03x64 from the "Programs=" line in the "[Package Definition]=" section.
• If you use SMS to deploy any one of the localized versions of this patch, you need a separate version of the PDF for each language. To create a PDF for another language, replace the “CommandLine” value in the sample PDF with the name of the actual language specific package. For example, for the German version of Windows XP SP2 (x86) , use the following value.

  CommandLine=WindowsXP-KB917425-DEU.exe /quiet /norestart

For detailed information about how to create and deploy packages, see the Microsoft Systems Management Server 2003 Operations Guide.

How to use a custom method to apply the 917425 package

Assume the script or the executable program that you developed to determine whether the 917425 package is applicable has found an affected computer. At this point, the script or executable program could:

• Run the 917425 package from an internal network share where you have saved the package.
• Download the 917425 package from a Microsoft download site. In this case, the user must allow the package to run.
• Point the user to the 917425 package download location to install manually.

Download information

The following files are available for download from the Microsoft Download Center:

Compatibility Patch for Internet Explorer for Windows XP Professional with Service Pack 2 (SP2) and for Windows XP Home Edition with SP2 Compatibility Patch for Internet Explorer for Windows Server 2003 SP1 Compatibility Patch for Internet Explorer for Windows Server 2003 SP1, Itanium-based versions Compatibility Patch for Internet Explorer for Windows Server 2003, x64-based versions Compatibility Patch for Internet Explorer for Windows XP Professional x64 Edition Release Date: April 11, 2006

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
Internet Explorer for Windows Server 2003 SP1, Itanium-based versions
Internet Explorer for Windows XP SP2
Internet Explorer for Windows Server 2003, x64-based versions
Internet Explorer for Windows Server 2003 SP1

Technical support for x64-based versions of Microsoft Windows

If your hardware came with a Microsoft Windows x64 edition already installed, your hardware manufacturer provides technical support and assistance for the Windows x64 edition. In this case, your hardware manufacturer provides support because a Windows x64 edition was included with your hardware. Your hardware manufacturer might have customized the Windows x64 edition installation by using unique components. Unique components might include specific device drivers or might include optional settings to maximize the performance of the hardware. Microsoft will provide reasonable-effort assistance if you need technical help with a Windows x64 edition. However, you might have to contact your manufacturer directly. Your manufacturer is best qualified to support the software that your manufacturer installed on the hardware. If you purchased a Windows x64 edition such as a Microsoft Windows Server 2003 x64 edition separately, contact Microsoft for technical support.

For product information about Microsoft Windows XP Professional x64 Edition, visit the following Microsoft Web site: For product information about x64-based versions of Microsoft Windows Server 2003, visit the following Microsoft Web site: