Support for Windows XP SP2 Ending in July

Posted: 14 May 2010 04:47 AM PDT

Microsoft announced this week that they will stop supporting Windows XP service pack 2 and Windows 2000 on July 13 as reported by USAToday. Microsoft usually offers 5 years of support for an operating system and 5 years of extended support so the time has wound down for XP SP2 and 2000.

This announcement could be a pain for many people because it is estimated that 50% of Windows XP machines in use by businesses are running service pack 2. While the task of updating tons of SP2 machines may be daunting, it is better than leaving them be. They become sitting ducks for hackers and malware as reported: Infected PCs in corporate settings are in high demand by cyber gangs who place them in networks, or botnets, of thousands of other infected PCs used to spread spam, steal data, hijack online bank accounts and shut down websites for extortion or political reasons.

It is estimated that home users are generally better about having machines with service pack 3 because they often have auto updates enabled. However, I have seen plenty of home computers come on the bench with only SP2 at my job at Call That Girl so there will still be lots of SP2 computers coming into repair shops that cater to home users. The official Microsoft recommendation is to upgrade to Windows 7 but the other option is of course using Windows Update to get XP SP3 or just downloading it from Microsoft. Windows 2000 isn’t so lucky, it looks like its time is up for good.

“Sexiest Video Ever” Malware on Facebook

Posted: 19 May 2010 10:13 AM PDT

A new malware attack has been circulating Facebook lately which puts a link on the user’s newsfeed claiming to be the “sexiest video ever”. When clicked the program tries to access the user’s info and if they allow that it will prompt them to install a new version of a FLV video player and starts downloading an .exe.

The file it actually downloads is Hotbar Adware which puts a toolbar in the browser and displays ads based on browsing habits. The Facebook application will also post messages on friend’s walls with the same video link and “sexiest video ever” message.

If the user doesn’t allow the application to access their info they are safe. If a user has gotten the malware the Daily Mail reports that Graham Cluely from security software developer Sophos said: “If you were one of them [that got attacked], you should scan your computer with an up-to-date anti-virus, change your passwords, review your Facebook application settings, and learn not to be so quick as to fall for a simple social engineering trick like this in future.”

Support for Windows XP SP2 Ending in July

Posted: 14 May 2010 04:47 AM PDT

Microsoft announced this week that they will stop supporting Windows XP service pack 2 and Windows 2000 on July 13 as reported by USAToday. Microsoft usually offers 5 years of support for an operating system and 5 years of extended support so the time has wound down for XP SP2 and 2000.

This announcement could be a pain for many people because it is estimated that 50% of Windows XP machines in use by businesses are running service pack 2. While the task of updating tons of SP2 machines may be daunting, it is better than leaving them be. They become sitting ducks for hackers and malware as reported: Infected PCs in corporate settings are in high demand by cyber gangs who place them in networks, or botnets, of thousands of other infected PCs used to spread spam, steal data, hijack online bank accounts and shut down websites for extortion or political reasons.

It is estimated that home users are generally better about having machines with service pack 3 because they often have auto updates enabled. However, I have seen plenty of home computers come on the bench with only SP2 at my job at Call That Girl so there will still be lots of SP2 computers coming into repair shops that cater to home users. The official Microsoft recommendation is to upgrade to Windows 7 but the other option is of course using Windows Update to get XP SP3 or just downloading it from Microsoft. Windows 2000 isn’t so lucky, it looks like its time is up for good.

Targus Recalls Half a Million Laptop Power Adapters due to Burn Hazard

Posted: 07 May 2010 08:20 PM PDT

Beware, Targus just recalled half a million laptop power adapters as reported by Engadget. The adapters are actually made by Comarco and the reason for the recall is that faulty wiring could cause the connector tips to heat and melt their plastic casing, posing a burn hazard to hapless users that try to unplug it. 518 incidents of the tips heating have been reported to Comarco with 53 of the incidents resulting in the plastic casing melting. Eight incidents of a hand or finger tip being burned have been reported.

The recall is for Targus Universal Wall Power Adapters for Laptops and the SKU numbers of the models affected are:
APA23US-02
APA23US-03
APA23US-04
APA63US-03
APA63US-04
APM62US-03
APM62US-04
The SKU number can be found on the bottom of the adapter.

This info site from the US Consumer Product Safety Commission recommends that anyone that has one of these adapters should stop using it immediately and contact Comarco. Contact info for Comarco is posted on that website.

Everything – Fast, Intelligent Search

Posted: 30 Apr 2010 11:34 AM PDT

Everything is small, free and portable application designed to search through a system at crazy fast speeds. It achieves these fast searching speeds by only the searching file names, rather than the contents of the file.

Where this really tears away from the built in Windows search (other than its incredibly fast searching) is that it supports boolean and regex operators. For example, if you want to search for ABC but want it to exclude any file with 123 in its name, you would do: abc !123

Or perhaps you want to search for a file that is named “grey”, but you also might have saved it as “gray”. You could search for both with: gr(a|e)y

It takes a few seconds to archive your files when it is first run (about 15 seconds for the 3TB in this system) but once it has done that, all future search results will appear almost instantly.

Be sure to read Everything’s FAQ to see its full capabilties and the boolean/regex commands it supports.

Downloads:
Download from Official Site – 272kb

April 2010 Stability and Reliability Update for Windows 7 and Windows Server 2008 R2 is Available

Posted: 04 May 2010 06:37 PM PDT

A new update for Windows 7 and Server 2008 R2 is currently available for download. It will fix a number of stability and reliability issues. According to the Microsoft release it will fix these specific issues:

– Windows Explorer crashes and then restarts when you access a third-party Control Panel item.
– You cannot connect to an instance of SQL Server Analysis Services from an application in Windows 7 or in Windows Server 2008
R2 after you install Office Live Add-in 1.4 or Windows Live ID Sign-in Assistant 6.5.
– Windows Explorer may stop responding for 30 seconds when a file or a directory is created or renamed after certain applications
are installed.
– The Welcome screen may be displayed for 30 seconds when you try to log on to a computer if you set the desktop background to
a solid color.
– You are not warned when you delete more than 1000 files at the same time. Then, the files are deleted permanently and are not
moved to the Recycle Bin.

The update can be downloaded in Windows Update or manually from the Microsoft site linked above. If you choose the manual download route it requires you to know whether you are running the 32-bit or 64-bit version of Windows. Happy updating!

Foxit Reader Update Blocks New PDF Attack Tactic

Posted: 05 May 2010 11:12 PM PDT

In April a new attack emerged that hid malware in a PDF and used a design flaw in the PDF format to infect computers along with social engineering tactics to get users to open the bad PDF. It exploited the /Launch feature of PDFs to run malware embedded in the PDF and in addition it was reported that methods were found to change the warning text in the reader to trick users into allowing it to run. Users of Adobe Reader, Foxit, and other readers were vulnerable to the attack.

Computer World now announces that Foxit Software has released an update to version 3.3 of their Foxit Reader on May 4 that helps block the PDF exploits. Foxit Reader is a free PDF reader that competes with Adobe Reader. The update adds a safe mode, called the Trust Manager, that is enabled by default. The Trust Manager blocks external commands that may be embedded in a PDF. In the Foxit 3.3 release announcement it says,

This is a follow-up security improvement to the Foxit Reader release on April 2nd, 2010. Earlier this month, Foxit Reader adopted a warning message before running any executable command embedded in a PDF document. Version 3.3 adds a second level of security by giving the user an option for disabling all external commands. The new Trust Manager allows users to select a safe mode operation, once selected; no external commands will be executed by the Foxit Reader.

The Trust Manager does not disable all JavaScript which is frequently used to exploit vulnerabilities but it is partially disabled. Specifically one of the JavaScript functions disabled is the ability of PDF files to execute non-PDF files. It is possible for the user to easily disable/enable Trust Manager.

Adobe so far hasn’t said that they will put out an update to Adobe Reader to counter this exploit, Foxit Reader is the only one to take action against this problem so far. Adobe does say that one solution that users can take is to disable the /Launch feature in Adobe Reader which is turned on by default.

McAfee to Pick Up Repair Bills for Nuked XP SP3 Systems After Bad Update

Posted: 26 Apr 2010 10:18 PM PDT

Last week we posted about a buggy update that McAfee released that deleted a critical system file which caused computers to shut down.

McAfee recently sent out a press release saying that they will pick up the repair bill for the machines effected:

For impacted home or home office customers who have incurred costs to repair PCs as a result of the security update issue, McAfee will reimburse reasonable expenses, such as a visit to a local tech support specialist. Details of this program, including steps to submit a reimbursement request, will be posted on the McAfee Web site within a few days, so please check back.

Additionally, because we value our loyal customers, home or home office users whose PCs were rendered inoperable or severely impaired as a result of the security update will receive a free two-year extension of their current McAfee subscription product at no charge.

If you or your clients were effected by this, here are the steps you can take to get the machine back up and running:

Step 1 – Locate a local toll free support number for your country. A qualified technician is standing by to diagnose your computer’s current status and determine the fastest way to get you up and running again.

Step 2 – If the technician can’t get your system up and running over the phone, we’ll get you the software to get your system up and running again. We can get you the software in one of two methods. You can either download the software fix from a working PC, or we will express deliver a CD to you.

Microsoft Leaves Systems Vulnerable To Prevent BSOD Repeat

Posted: 16 Apr 2010 11:16 PM PDT

Two months ago Microsoft released a security update designed to fix two flaws in the Windows kernel. Unfortunately, this update would cause a Blue Screen of Death on many users computers. After some research, it was discovered that a rootkit was the cause of the crashes and Microsoft stopped automatically serving this update.

Microsoft has since restarted distribution of this update only after it had found out a way to block the rootkit-infected computers from receiving the patches.
Jerry Bryant who is a general manager with the Microsoft Security Response Team said the following:

“If detection logic included in Automatic Update discovers abnormal conditions in certain operating system file configurations, the update will fail and customers will be presented with an error message that offers alternative support options,”

While this will prevent the Blue Screen of Death appearing, it will leave users vulnerable to the exploit the update was originally designed to patch. No exploits of this flaw appear to exist in the wild just yet, but Microsoft warns that exploit code is likely to be developed.

Sun Releases Out-Of-Cycle Java Patch To Prevent Drive-By, In-The-Wild Attacks

Posted: 18 Apr 2010 01:50 AM PDT

A week ago Sun (the makers of the Java platform) told a Google researcher (Tavis Ormandy) that it did not consider a known exploit to be serious enough to patch.

Ormandy said:
Sun has been informed about this vulnerability, however, they informed me they do not consider this vulnerability to be of high enough priority to break their quarterly patch cycle.

For various reasons, I explained that I did did not agree, and intended to publish advice to temporarily disable the affected control until a solution is available.

However, in an unexpected turn about, Sun released a patch for this exploit once reports started coming in that users were being infected by drive-by, in-the-wild Java attacks.
The flaw which was discovered independently, occurs because the Java-Plugin Browser is running “javaws.exe” without validating command-line parameters. To protect yourself and your clients from it, update to the most recent version of Java here.

11 Security Bulletins for April’s Microsoft Patch Tuesday

Posted: 08 Apr 2010 11:22 PM PDT

This Tuesday, Microsoft will be releasing 11 security bulletins addressing 25 vulnerabilities. Some of the main vulnerabilities that are going to be patched are:

• The VBScript Internet Explorer Help File vulnerability
• The SMB flaw that can crash Windows 7 / Server 2008 R2 remotely (Disclosed way back in November 2009)

Along with these security patches, there will also be a few non-security patches marked as high-priority that affect Microsoft Update. An updated version of the Microsoft Windows Malicious Software Removal Tool will also be released.

The exact breakdown of the bulletins is as follows:

• Bulletin 1: Critical (Remote Code Execution) – Affects Windows
• Bulletin 2: Critical (Remote Code Execution) – Affects Windows
• Bulletin 3: Critical (Remote Code Execution) – Affects Windows
• Bulletin 4: Critical (Remote Code Execution) – Affects Windows
• Bulletin 5: Critical (Remote Code Execution) – Affects Windows
• Bulletin 6: Important (Elevation of Privilege) – Affects Windows
• Bulletin 7: Important (Remote Code Execution) – Affects Windows
• Bulletin 8: Important (Remote Code Execution) – Affects Office
• Bulletin 9: Important (Denial of Service) – Affects Windows & Exchange
• Bulletin 10: Important (Remote Code Execution) – Affects Office
• Bulletin 11: Moderate (Spoofing) – Affects Windows

Facebook Password Reset Malware

Posted: 19 Mar 2010 04:41 AM PDT

A fake Facebook password reset email seems to be doing the rounds in the last few days. I The Facebook password reset email says the following:

Subject: Facebook Password Reset Confirmation! Customer Support

Dear user of Facebook,

Because of the measures taken to provide safety to our clients, your password has been changed. You can find your new password in attached document.

Thanks,
Your Facebook.

Instead of having a fake Facebook page to collect the victims passwords (phishing), the email is sent with a malware attachment. The malware is known as “Bredolab” which is a Trojan downloader. In the two computers I repaired today, Bredolab downloaded some rogue antivirus products. However, some sites are saying that it also downloads a password stealing trojan.

change your passwords after the infection has been removed as well.

“Dancing with the Stars Lineup 2010″ Malware

Posted: 16 Mar 2010 11:16 PM PDT

When you visit it, you’ll see your typical “You have 100 viruses” scareware.

Once installed, the malware product appears to be the rogue antivirus “CleanUp Antivirus”.

As Patrick said “I’ll bet its making them a fortune”. Such an innocent query with a malicious site as the top result. If you ever do encounter this infection, BleepingComputer.com have removal instructions for Cleanup Antivirus.

Microsoft Fixes Eight Bugs, Warns Of IE Zero-Day

That's a welcome relief after last month's set of 13 bulletins addressing 26 vulnerabilities.

On the other hand, Microsoft is also warning about a new zero-day vulnerability affecting Internet Explorer 6 and 7, but not Internet Explorer 8.

Microsoft attributes the problem to an an invalid pointer reference within Internet Explorer that can, under certain conditions, be accessed after an object is deleted. An attacker can potentially exploit this vulnerability for remote code execution.

"At this time, we are aware of targeted attacks attempting to use this vulnerability," Microsoft states in its advisory. "We will continue to monitor the threat environment and update this advisory if this situation changes."

The last zero-day vulnerability in Internet Explorer was identified in January following Google's disclosure of the "Operation Aurora" cyber attack from China.

"It's a vote of confidence for IE 8 and a reminder that IE 6 is at the end of its life and should be," said Andrew Storms, director of security operations at nCircle Network Security, in phone interview.

With regard to the advisories, Storms says that the "important" severity rating reflects the need for user interaction to exploit these vulnerabilities.

Wolfgang Kandek, CTO of Qualys explains in a blog post that an attacker needs to trick the target into opening a malicious Excel document to execute the attack. "Exploitability is high for the majority of vulnerabilities listed, so we suggest to put this patch on a fast installation schedule," he says.

The situation is similar with Windows Movie Maker, according to Kandek: The user has to open a malicious file to launch an attack. He notes that Windows XP and Vista ship with vulnerable versions of the movie making software, and that while Windows 7 does not, a user could download and install version 2.6, which is affected. "The bulletin does not provide a patch for the also affected Windows Producer, a little used multimedia add-on to PowerPoint," he says.

Storms says that the Excel bulletin is interesting because it's the first bug addressed in Microsoft's recent Excel 2007 file format. Older Microsoft Office file formats, he says, are easier to attack.

F1 Virus Alert

http://www.snopes.com/computer/virus/F1key.asp

March Patch Tuesday

Posted: 04 Mar 2010 10:09 PM PST

Microsoft will release two security updates on Tuesday. The small number of updates is a downturn that was not unexpected.

“This is indicative of the on and off cycle that Microsoft uses. Last month was more OS related, this month they’re patching some applications,” said Andrew Storms of nCircle Network Security.

The two updates are rated as “important”. The vulnerabilities that these two patches fix include a way for attackers to insert malicious code in machines.

Source: COMPUTERWORLD

Antivirus Spam

Posted: 26 Feb 2010 08:58 PM PST