cancel
Showing results for 
Search instead for 
Did you mean: 

How-to: Patch Meltdown and Spectre

Khaosd
Level 7
First things first, this guide is assuming the following:

1) You are using the Asus Maximus Hero VIII
2) You are on Windows 10 x64

If you are not using the same mobo, the few links i provided below pointing to the ASUS website will allow you to select your actual mobo's model, which in turn will also let you select the OS you're on. I'll also provide information on the various MS updates below for the various OSes.

As a last resort, things shouldn't be too hard to source for considering how large a scale these two exploits are currently, so google.

Also, take note I update whenever I am aware of the news, hence some steps may be redundant (eg. perhaps BIOS 3703 already updated the ME firmware). However I will follow exactly how I did it from start to end to ensure that it should work for you, like how it did for me.

So here goes:

Miscs.

First I updated Chrome and Firefox. Yep they too have taken measures to defend against meltdown and spectre, I assume the rest of the browsers should have caught on as well by now, so do remember to check for updates.

1. ME firmware + Interface

**The following fixes 8 critical vulnerabilities found in a review right before Spectre and Meltdown was announced, as such, this technically does not address Spectre and Meltdown, but imho, is equally an important fix. (Read more here: http://www.eweek.com/security/intel-patches-management-engine-for-critical-vulnerabilities)

Asus released updates for the ME firmware + Interface, this can be found here: https://www.asus.com/sg/Motherboards/MAXIMUS-VIII-HERO/HelpDesk_Download/

Firmware: http://dlcdnet.asus.com/pub/ASUS/mb/LGA1151/Z170-A/MEUpdateTool_UI_20171103_TP.zip
Interface: http://dlcdnet.asus.com/pub/ASUS/mb/03CHIPSET/Consumer_11.7.0.1040.zip

If you are using a different Mobo, you can just click on 'FIND ANOTHER MODEL >' right below the mobo's name. Once found, go search under Drivers and Tools.

Note the above are not the latest however they should suffice. To verify whether you are protected: https://downloadcenter.intel.com/download/27150?v=t

Just download and run the DiscoveryTool.GUI

2. Windows Update

Windows released a critical update. This should be auto updated if you'd never changed any windows policy or settings. To be sure, you can search for it in your add remove programs to see whether the following has been installed:

**Please note back when this update was released it conflicted with a few Anti Virus programs, you can see where your AV is right now: https://docs.google.com/spreadsheets/d/184wcDt9I9TUNFFbsAVLpzAtckQxYiuirADzf3cL42FQ/edit#gid=0 , it should be Y Y to ensure maximum compatibility.

*** There has been some controversy on how MS is handling the issue with setting the registry keys, however i leave it up to you to do your own research and weigh the consequences.

Windows 10 — KB4056892 (issued 1/3/18)
Windows 8.1 and Server 2012 R2— KB4056898 (issued 1/3/18)
Windows 7 SP1 and Server 2008 R2 SP1 — KB4056897 (issued 1/3/18)


Source & Direct download link if update not found: https://blog.barkly.com/meltdown-spectre-patches-list-windows-update-help#OS-updates

Now if you use AI SUITE 3, installing this update will break all the old versions. You can download the newer version(Beta) that fixes this issue, here: https://rog.asus.com/forum/showthread.php?98800-AI-Suite-3-Beta-Version-3-00-10-user-test-report-thr...

Note: Those who use AI SUITE 3 and have a tendency to update and/or reinstall may be aware it can be a beach to remove it completely. I will provide another guide below on how to do a clean install of AI SUITE 3.

3. Bios

Lastly, Asus release Bios 3703 for the ASUS Maximus Hero VIII, which originally was uploaded wrongly (2018/1/12 was for the Alpha), now I just checked and it seems like the download has been corrected: https://www.asus.com/sg/Motherboards/MAXIMUS-VIII-HERO/HelpDesk_Download/ (it should be dated 2018/1/15)

Regardless, if you are using a different Mobo, you can just click on 'FIND ANOTHER MODEL >' right below the mobo's name. Once found, go search under Drivers and Tools.

FYI, Asus Advisory on the various mobos and bios available: https://www.asus.com/News/V5urzYAT6myCC1o2

Final Check (Windows 10 PowerShell method)

**Although Win7 has PS, the steps to launch it is not so obvious, so I will suggest using a few 'checker' software available out there.

Now once that's done, you should be ready. Next is to do a check on whether everything's green:

1) Right click Start > Windows Powershell (Admin)

2) Type: Install-Module SpeculationControl , if prompted, Y

3) Type: Set-ExecutionPolicy RemoteSigned, if prompted, Y

4) Type: Import-Module SpeculationControl

5) Type: Get-SpeculationControlSettings

After which a bunch of information will show, Not to worry, just make sure that there are no red lines, everything should be green. Once that's done:

6) Type: Set-ExecutionPolicy Restricted

You can close Powershell now.

Post-Notes

Some say the windows update and / or the bios causes a drop in performance (Intel claims an 8% drop for 6 Gen 6700k: https://newsroom.intel.com/editorials/intel-security-issue-update-initial-performance-data-results-c...), I personally don't really feel anything... As a matter of fact, after updating the bios and oc-ing my CPU, I was able to reach 100mhz more on my OC. but yeah, I guess your mileage may vary.

Lastly, everything regarding Spectre and Meltdown as of now is still developing, and my guide is just the first few stepping stones for you. I may or may not update this post in future, considering I'm seeing more and more guides that are more concise and detailed. As such should this guide be not updated, with your experience going through my guide and with a little bit of googlefu, the follow ups should be a piece of cake.

If you still need a hand tho: https://blog.barkly.com/meltdown-spectre-patches-list-windows-update-help

I recommend them since they don't bury you in technical jargons, and most of my research was assisted by reading their article.

Good luck!


Windows 10: How to clean uninstall AI SUITE 3 and install the Beta

**should work on windows 7 as well

***I've encountered issues with AVIRA a few years ago, I suggest disabling it or any antivirus when you are installing the new AI SUITE 3 in step 8, should you encounter any issues.

Ai Suite is useful (to me), but it can be a real sore in the butt to remove and get it to work properly after a reinstall or update, I've personally done alot of research, reformat, re-installation to get to, what I feel is the cleanest and trouble free steps to get AI SUITE working. I now offer it to those who are having issues, although with all its quirks, I won't be surprised if you say my methods don't work. If so, I'm sorry I can't help more:

1) Uninstall the old AI SUITE 3, Restart your computer

2) Ctrl + Shift + Esc > head over to Services tab, sort by Description and, assuming you only have AI SUITE 3 installed, stop EVERYTHING with the word 'ASUS' (2 to 4 services usually), if not, you will have to find out which services are related to AI SUITE 3. Restart your computer

*If you are using Windows 7, you may be getting ALOT of "ATK_CMD stopped working" popups once desktop shows, ignore. (Windows 10 will have this error but it can only be seen in Reliability Viewer)

3) Go to C program files and delete the ASUS folder (assuming you only have AI SUITE 3 installed)

4) Show hidden folders and go to C program data and delete the ASUS folder (assuming you only have AI SUITE 3 installed)

5) Run CCleaner

6) Restart your computer, smash Delete (or any key that goes to BIOS), reset everything to optimized default, save and exit. Power down.

7) open up your case and hit the clr_cmos button, if unsure, check manual.

😎 Restart Computer, hit F1 if prompted, Save and restart computer. download the new AI SUITE beta (Link above), Install USING SETUP.exe INSTALL OF ASUSSETUP.exe!

Now AI SUITE 3 should work without issues, hopefully.
1,045 Views
46 REPLIES 46

Thanks
Please help, what is ME Update tool?
i have rog strix x99, I don’t have this tool

Regards*

ELIESEH wrote:
Thanks
Please help, what is ME Update tool?
i have rog strix x99, I don’t have this tool

Regards*


Indeed, I do not see the updated ME patches for your board. Unfortunately, I'm not able to help more as MS' advise is always to look for the board's manufacturer for ME updates. Your best bet is to check with ASUS direct on why it's not available. Sorry about that.

bcx01 wrote:
Yup done that. No idea why I'm getting two "false" in Powershell. Maybe it's intended? If someone could clarify what those two lines mean, please do.


Should be intended, as I too have both of them on false, and a quick google shows many users using the PowerShell method to have these two on False too.

Also: https://support.microsoft.com/en-sg/help/4074629/understanding-the-output-of-get-speculationcontrols....

If I'm interpreting MS correctly (They can be so unclear sometimes):

BTIDisabledBySystemPolicy and BTIDisabledByNoHardwareSupport are linked to BTIWindowsSupportEnabled

If BTIWindowsSupportEnabled is True, then logically both BTIDisabledBySystemPolicy and BTIDisabledByNoHardwareSupport should be False.

Anyway general consensus if it's all green, you're good, so that's the best advice I can give. Do check with MS direct if you still feel uncomfortable with these two outputs. 🙂

This anything to be concerned about? After finishing up and running Restricted command on Windows 7 powershell:
PS C:\Windows\system32> Set-ExecutionPolicy Restricted

Execution Policy Change
The execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose
you to the security risks described in the about_Execution_Policies help topic at
http://go.microsoft.com/fwlink/?LinkID=135170. Do you want to change the execution policy?
Yes Yes to All No No to All Suspend [?] Help (default is "N"): y
Set-ExecutionPolicy : Windows Po...







ELIESEH wrote:
Thanks
Please help, what is ME Update tool?
i have rog strix x99, I don’t have this tool

Regards*


Hi, I just found my own ME Update tool in the ASUS Bios List, and not in the Chipset List as expected.
For you it's probably also there...

bcx01
Level 7
Maximus VIII Hero, 6700k (standard settings atm), 980 TI, 200GB SSD

Nate152
Moderator
Thank you

1) Download the latest bios file for your motherboard at the ASUS Support Center - https://www.asus.com/us/support/
2) Extract it to a usb flash drive formatted to .FAT32
3) Insert the flash drive into a usb port
4) Go into the bios, go to the Tool tab and select the EZ Flash Utility
5) Select your usb flash drive and you'll see the bios file.
6) Click on it, it will ask you if you want to update, click yes.

Or in EZ Flash select update the bios via the internet and click the earth globe DHCP, this method is super easy and doesn't require a usb flash drive. Don't cut power or do it while there is a thunder storm. It will restart a time or two, just sit back and let it do its thing.

bcx01
Level 7
I've done everything in OP's guide which is updating my BIOS to the latest version, I got two "false" in Powershell. I'm not sure what it means or if it's a positive thing to have.

bcx01
Level 7
Yup done that. No idea why I'm getting two "false" in Powershell. Maybe it's intended? If someone could clarify what those two lines mean, please do.

Nate152
Moderator