Certain VB controls no longer display on web pages after installing KB960715

Hi everyone,

This is Shahinur again and I wanted to write about an important issue that could affect many of you who are hosting legacy VB controls on your web page.

After installing the security update that released in February 2009, KB960715 (Update Rollup for ActiveX Kill Bits), certain VB controls might no longer display on a web page. A red “x” is displayed in the place of where the control would normally load.  This is because some of the known VB controls have been kill-bitted by this update:

{1E216240-1B7D-11CF-9D53-00AA003C9CB6}     Microsoft Animation Control, version 5.0 (SP2)

{3A2B370C-BA0A-11d1-B137-0000F8753F5D}     Microsoft Chart Control 6.0 (SP6) (OLEDB)

{B09DE715-87C1-11d1-8BE3-0000F8754DA1}     Microsoft Animation Control 6.0 (SP6)

{cde57a43-8b86-11d0-b3c6-00a0c90aea82 }     Microsoft DataGrid Control 6.0 (SP6) (OLEDB)

{6262d3a0-531b-11cf-91f6-c2863c385e30}       Microsoft FlexGrid Control, version 6.0 (SP6)

{0ECD9B64-23AA-11d0-B351-00A0C9055D8E}    Microsoft Hierarchical FlexGrid Control 6.0 (SP6) (OLEDB)

{C932BA85-4374-101B-A56C-00AA003668DC}    Microsoft Masked Edit Control, version 6.0 (SP6)

{248dd896-bb45-11cf-9abc-0080c7e7b78d}      Microsoft WinSock Control, version 6.0 (SP6)

You can find more information about kill-bits here, KB240797 (How to stop an ActiveX control from running in Internet Explorer).

Just to give some background information, when a control is kill-bitted, the value of the Compatibility Flags DWORD under the following registry hive gets set to 0x00000400.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\<CLSID of the ActiveX control>

Often an alternate control is released in place of the old unsafe control and the CLSID of this new control gets added under the AlternateCLSID string of the same registry hive.

The challenge we face with the KB960715 update is that although it kill-bitted certain commonly used VB controls, no alternate CLSIDs were provided for those controls.

However, there is remedy to this problem. Since these are Visual Basic Controls, a VB cumulative update released in December 2008 did have new controls that replaced the kill-bitted controls.

For a list of all the controls that were updated with this roll-up see, KB957924.

In order to get a hold of these controls, you would need to have at least one development machine where you have the Visual Basic 6 IDE installed. You should then install the following updates on that machine:

• Service Pack 6 for VB6
• Microsoft Visual Basic 6.0 Service Pack 6 Cumulative Update

This will update your system with the new controls, which you can host on your web page. However, there is still one more step you need to follow to get this to work. All of the kill-bitted controls are licensed controls.  You need a license file for them to work. The existing LPK file you would have on your page would only contain licenses for the old controls.

Typically, you can use the LPK Tool to create a license package.  Unfortunately, you cannot do so in this case because the new CLSIDs for the kill-bit/phoenixbit are hidden on your development machine. Only the legacy CLSIDs are available. In this case, you would need to contact Microsoft Support to generate an LPK file for you.

There has been discussion around doing some work on IE’s License Manager so that it knows how to instantiate a new control even with an old license.  We will keep you posted on the outcome of that effort…

Thank you,

The IE Support Team

Comments

• Anonymous
  February 22, 2009
  But what about those customers that are the end users of these applications?  They won't have access to VB6 on their workstations?  
• Anonymous
  February 23, 2009
  Hi !I'm using the Microsoft Animation Control 6.0 (SP6) in my web application in order to retrieve a drop file path.I have installed the KB960715 and, of course, my application is not working.To use my application, every user have to install my ActiveX. Is it possible to get a new and distributable version of the IAnimation control in order to integrate it in my ActiveX CAB ?Thank you in advance for your answer.
• Anonymous
  February 26, 2009
  Does this explain why these updated VB6 controlswill not work in VBA ? Because updated licenses werenot provided for the replacement controls?When will Microsoft issue a new license package that will allow these controls to be used in VBA applications, such as Office 2007???
• Anonymous
  March 02, 2009
  At last, someone else who can give me a lead on the Winsock control.  I could see it was a licensing problem, since my hta page worked on my development machine, but not on a test machine.Why didn't microsoft just offer a lpk download with the VB6 update?
• Anonymous
  March 06, 2009
  I have received a tool from Microsoft Developer Support allowing me to unhide/re-hide the new CLSID for these controls.  This allowed me to successfully create a new license file for the mswinsck.ocx.Please refer to the solution for support case SRQ090303600331.
• Anonymous
  March 06, 2009
  Thank you for this valuable information. The IE is not the only application that is affected by this patch. I'm using the MSFlexGrid within a VBA user form in Excel 2003 and the control was removed.
• Anonymous
  March 10, 2009
  Question : How do I contact microsoft support to generate a LPK file for me?Thanks
• Anonymous
  May 18, 2009
  The comment has been removed
• Anonymous
  July 01, 2009
  Thank you, this helped us a lot.
• Anonymous
  July 17, 2009
  Thanks a lot for all these details. As an Excel VBA developer, I have  the same problems with a VBA form including Msflxgrd.ocx. The Msflxgrd object no longer exist on  the form and the VBA macro cannot be executed as an error occurs.Is ther any way to correct this problem if xe DO NOT have the Visual Basic 6 IDE?ThanksPatrick
• Anonymous
  April 24, 2010
  The comment has been removed