Certain VB controls no longer display on web pages after installing KB960715


Hi everyone,

This is Shahinur again and I wanted to write about an important issue that could affect many of you who are hosting legacy VB controls on your web page.

After installing the security update that released in February 2009, KB960715 (Update Rollup for ActiveX Kill Bits), certain VB controls might no longer display on a web page. A red “x” is displayed in the place of where the control would normally load.  This is because some of the known VB controls have been kill-bitted by this update:

{1E216240-1B7D-11CF-9D53-00AA003C9CB6}     Microsoft Animation Control, version 5.0 (SP2)

{3A2B370C-BA0A-11d1-B137-0000F8753F5D}     Microsoft Chart Control 6.0 (SP6) (OLEDB)

{B09DE715-87C1-11d1-8BE3-0000F8754DA1}     Microsoft Animation Control 6.0 (SP6)

{cde57a43-8b86-11d0-b3c6-00a0c90aea82 }     Microsoft DataGrid Control 6.0 (SP6) (OLEDB)

{6262d3a0-531b-11cf-91f6-c2863c385e30}       Microsoft FlexGrid Control, version 6.0 (SP6)

{0ECD9B64-23AA-11d0-B351-00A0C9055D8E}    Microsoft Hierarchical FlexGrid Control 6.0 (SP6) (OLEDB)

{C932BA85-4374-101B-A56C-00AA003668DC}    Microsoft Masked Edit Control, version 6.0 (SP6)

{248dd896-bb45-11cf-9abc-0080c7e7b78d}      Microsoft WinSock Control, version 6.0 (SP6)

You can find more information about kill-bits here, KB240797 (How to stop an ActiveX control from running in Internet Explorer).

Just to give some background information, when a control is kill-bitted, the value of the Compatibility Flags DWORD under the following registry hive gets set to 0x00000400.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\<CLSID of the ActiveX control>

Often an alternate control is released in place of the old unsafe control and the CLSID of this new control gets added under the AlternateCLSID string of the same registry hive.

The challenge we face with the KB960715 update is that although it kill-bitted certain commonly used VB controls, no alternate CLSIDs were provided for those controls.

However, there is remedy to this problem. Since these are Visual Basic Controls, a VB cumulative update released in December 2008 did have new controls that replaced the kill-bitted controls.

For a list of all the controls that were updated with this roll-up see, KB957924.

In order to get a hold of these controls, you would need to have at least one development machine where you have the Visual Basic 6 IDE installed. You should then install the following updates on that machine:

This will update your system with the new controls, which you can host on your web page. However, there is still one more step you need to follow to get this to work. All of the kill-bitted controls are licensed controls.  You need a license file for them to work. The existing LPK file you would have on your page would only contain licenses for the old controls.

Typically, you can use the LPK Tool to create a license package.  Unfortunately, you cannot do so in this case because the new CLSIDs for the kill-bit/phoenix bit are hidden on your development machine. Only the legacy CLSIDs are available. In this case, you would need to contact Microsoft Support to generate an LPK file for you.

There has been discussion around doing some work on IE’s License Manager so that it knows how to instantiate a new control even with an old license.  We will keep you posted on the outcome of that effort…

 

Thank you,

The IE Support Team

Comments (11)

  1. Susan says:

    But what about those customers that are the end users of these applications?  

    They won’t have access to VB6 on their workstations?  

  2. Pierre says:

    Hi !

    I’m using the Microsoft Animation Control 6.0 (SP6) in my web application in order to retrieve a drop file path.

    I have installed the KB960715 and, of course, my application is not working.

    To use my application, every user have to install my ActiveX. Is it possible to get a new and distributable version of the IAnimation control in order to integrate it in my ActiveX CAB ?

    Thank you in advance for your answer.

  3. VBA Developer says:

    Does this explain why these updated VB6 controls

    will not work in VBA ? Because updated licenses were

    not provided for the replacement controls?

    When will Microsoft issue a new license package that will allow these controls to be used in VBA applications, such as Office 2007???

  4. Nicolas says:

    At last, someone else who can give me a lead on the Winsock control.  I could see it was a licensing problem, since my hta page worked on my development machine, but not on a test machine.

    Why didn’t microsoft just offer a lpk download with the VB6 update?

  5. Nicolas says:

    I have received a tool from Microsoft Developer Support allowing me to unhide/re-hide the new CLSID for these controls.  This allowed me to successfully create a new license file for the mswinsck.ocx.

    Please refer to the solution for support case SRQ090303600331.

  6. Thank you for this valuable information. The IE is not the only application that is affected by this patch. I’m using the MSFlexGrid within a VBA user form in Excel 2003 and the control was removed.

  7. Yasir says:

    Question : How do I contact microsoft support to generate a LPK file for me?

    Thanks

  8. Jens Olsson says:

    Any news on this issue? We have an old webapp with MSFlexGrid and MSHFlexGrid that stopped working when KB060715 was released and uppgrading to the new components doesn’t help.

  9. Andrew says:

    Thank you, this helped us a lot.

  10. Thanks a lot for all these details. As an Excel VBA developer, I have  the same problems with a VBA form including Msflxgrd.ocx. The Msflxgrd object no longer exist on  the form and the VBA macro cannot be executed as an error occurs.

    Is ther any way to correct this problem if xe DO NOT have the Visual Basic 6 IDE?

    Thanks

    Patrick

  11. sanpo says:

    How does LPK work? …. Is it that the licenses file (.lic) should be distributed along with the components?

    Any LPK now available for licensing the kilbitted controls?