Microsoft Acknowledges Anti-Virus Failed VB100 Test
16612
A Microsoft spokesperson confirmed to BetaNews this afternoon that it has learned its Windows Live OneCare anti-virus package has failed a test conducted by the respected British laboratory Virus Bulletin, disqualifying it from carrying the "VB100" logo denoting 100% detection of a selected battery of common "in the wild" viruses.
698181
(InfoWorld) - Nearly a year after Microsoft introduced Windows Live OneCare, the company's first foray into the security market is still getting low marks from analysts and users. A recent report comparing the antivirus products of various vendors ranked Microsoft's product at the bottom in terms of detecting potential security threats. At the same time, users are complaining that OneCare, which includes firewall, antivirus, backup, and antispyware software, quarantines the entire mail store of their Outlook and Outlook Express programs, making it impossible for them to retrieve e-mail. AV-Comparatives, a project in Austria overseen by security researcher Andreas Clementi, published the antivirus comparison report, which also looked at products from Symantec, McAfee, Kaspersky Lab, BitDefender, Fortinet, F-Secure, and several other antivirus products from smaller vendors. In detecting Windows viruses, worms, macros, scripts, and other OS threats, Microsoft ranked last out of the 15 vendors tested, detecting them 91 percent of the time. G Data Software AG's Anti-Virus Kit (AVK) ranked first with 99.6 percent detection, while products from three vendors -- Kaspersky Anti-Virus, MicroWorld Technologies eScan, and F-Secure Anti-Virus -- tied for second with 99 percent detection. TrustPort Antivirus Workstation from AED came in third with 98.9 percent detection. In preventing intrusion through backdoors, Trojans and in other malware detection, Windows OneCare also ranked last out of 13 vendors, with 79.6 percent detection. TrustPort came in first at 99.5 percent detection; AVK came in second with 99.4 percent detection; and AVIRA GmbH's AntiVir Personal Edition Premium came in third with 98.9 percent detection. If ranking low in its rates of malware and virus detection isn't enough to irk users, a recent update to the product has been quarantining the Outlook.PST file, which stores mail in Outlook and Outlook Express, users reported recently on a Microsoft Windows user form. "This is the most unacceptable act Microsoft has ever committed," groused one user on the forum. "I run a small business, and I am screwed. I have no way to respond to e-mails because I made the mistake of trusting Microsoft ... and all of my e-mails and contacts are gone." Microsoft confirmed the problem Friday and said it will update the Windows Live OneCare engine to fix the problem as part of its monthly patch release cycle. The company also offered the following step-by-step fix to recover lost e-mail in the meantime: *Â Close Outlook or Outlook Express *Â Click change OneCare settings in the main OneCare user interface *Â Click on the viruses and spyware tab *Â Click on the quarantine button, and then select the pst or dbx file, and then click on restore. To ensure that the problem does not continue until the next update, Microsoft said users should also do the following: *Â Click change OneCare setting in the main user interface *Â Click viruses and spyware tab *Â Click on the exclusions button *Â Click on the add folder button *Â Navigate to the specific folder that contains the .dbx or .pst file to be excluded. *Â Click OK.
402563
(InfoWorld) - Microsoft blamed human error for aÂ Windows Genuine Advantage problem that identified legitimate Windows users as piratesÂ last week. "Nothing more than human error started it all," Alex Kochis, senior product manager for Windows Genuine Advantage at Microsoft wrote on the company blog Tuesday night. New software was accidentally loaded onto the live servers running the system, he said. That ultimately caused the servers to decline activation and validation requests that were good, he wrote. While Microsoft quickly noticed the problem and rolled back the changes within a half hour, the problem continued to affect the validation service, he said. The activation process was fixed in that time frame, he said. The company is implementing some changes to make sure a similar incident doesn't happen again. It is improving monitoring in order to find out sooner if there is a problem, he said. Microsoft is also adding checkpoints that should prevent accidental changes to the servers. Kochis' explanation is fine but the incident is still troubling, said Michael Cherry, an analyst at Directions on Microsoft. "I think it's unsettling for people when it doesn't validate," he said. While it's great that Microsoft has put some new procedures in place, Cherry was surprised that it was even "feasible" for someone to accidentally load the wrong code into the live environment. "It just raises the question of what other things have they not done," he said. In his blog post, Kochis clarified that an existing policy will automatically validate all users if the WGA servers are down but that in this case, the servers weren't down, so that policy didn't kick in. With that policy in place, Cherry wonders why Microsoft didn't just take the servers down while they were diagnosing and fixing the problem so that legitimate users wouldn't continue to have issues. The problem began on Friday evening and lasted through Saturday afternoon. During that time, some users incorrectly failed the validation process, leaving them unable to use certain features including Windows Aero, Windows ReadyBoost, and some features of Windows Defender and Windows Update. Affected users also saw a message in the corner of their screen that said "This copy of Windows is not genuine." WGA has been criticized since its unveiling in 2005. The system, which works for Windows XP and Vista users, is meant to help Microsoft disable software pirates, but some users say it's cumbersome. In addition, Microsoft faces two class action suits that characterize WGA as spyware and cite concerns over how Microsoft uses data it collects about users through the program.
150857
Microsoft describes unpatched flaw that could corrupt PC memory and allow intruders.
14749
Microsoft has begun a short-term validation programme aimed at tackling software piracy. Users are invited to have their copies of Windows XP analysed, with the promise that they will be replaced free of charge if found to be counterfeit.
169476
Microsoft has fixed a critical flaw in the Windows operating system that could be used by criminals to create a self-copying computer worm attack.The software vendor released its first set of patches for 2008 on Tuesday, fixing a pair of networking flaws in the Windows kernel. Microsoft also released a second update for a less-serious&#160;Windows flaw that would allow attackers to steal passwords&#160;or run Windows software with elevated privileges.The critical bug lies in the way Windows processes networking traffic that uses IGMP (Internet Group Multicast Protocol) and MLD (Multicast Listener Discovery) protocols, which are used to send data to many systems at the same time. Microsoft says that an attacker could send specially crafted packets to a victim&#39;s machine, which could then allow the attacker to run unauthorized code on a system.Security experts say that there is no known code that exploits this flaw, but now that the patch has been posted, hackers can reverse-engineer the fix and develop their own attack code.Because IGMP is enabled in Windows XP and Vista by default, this bug could be used to create a self-copying worm attack, Microsoft said Tuesday.&quot;Theoretically this is wormable, and that&#39;s why this is rated critical,&quot; said Tim Rains, security response communications lead with Microsoft. However, Microsoft does not believe that hackers will have an easy time developing attack code that will work reliably. &quot;We&#39;ve done a thorough analysis of the vulnerability, and we&#39;ve come to the conclusion that there are several technical mitigating factors that make it unlikely to get reliable remote code execution,&quot; Rains said.Windows uses the IGMP protocol for many popular consumer applications such as streaming video, multiplayer games, and universal plug-and-play, but the protocol is usually blocked at the router. A derivative of IGMP, MLD is the multicast protocol used by IPv6 systems and is enabled on Vista by default.&quot;If it became a worm it could take over an internal network pretty quickly, or at least all the machines where multicast is enabled,&quot; said Eric Schultze, chief technology officer with Shavlik Technologies. &quot;But this one is going to be mitigated because a lot of people have blocked multicast.&quot;The critical MS08-001 update that fixes this flaw also patches a second, less-serious bug in the Windows networking stack that could be leveraged to launch a denial-of-service attack against a Windows system. This vulnerability lies in the Internet Control Message Protocol Router Discovery Protocol (ICMP RDP), which is used by Windows to find out how to communicate with the network. Because this capability is not turned on by default, Microsoft considers this to be merely an &quot;important&quot; bug.Microsoft&#39;s other Tuesday update, MS08-002, fixes an elevation of privilege flaw in the Windows Local Security Authority Subsystem Service (LSASS), used to manage account credentials in Windows.This flaw could be exploited by attackers to steal passwords or run their code with a higher level of privilege on Windows, said Schultze. &quot;The primary concern is Johnny who is a user becoming Johnny admin,&quot; he said. But if attackers were to combine an attack that exploited this flaw with another exploit that would allow them to run code on the system, then &quot;that could become a critical issue,&quot; he said.
176052
Microsoft has issued a patch to fix the security flaw, and urges its customers to use a new utility to locate the computer applications that are vulnerable.
148751
Microsoft's beta version of its Windows AntiSpyware application is available for download.
311378
MS Windows front-end to Clam Antivirus (http://www.clamav.net). Includes scheduler, virus database updates, standalone scanner, context menu integration to MS Windows Explorer and Addin to MS Outlook. Also features easy setup program.   ClamWin Free Antivirus team is pleased to announce the maintenance release which updates ClamAV engine and addresses number of issues:      * Improvements in RTF, OLE, PDF and HTML file type scanning     * Improved virus detection in certain embedded PE files     * Other bug fixes and improvements.  For a full list please refer to ClamAV changelog:  http://sourceforge.net/project/shownotes.php?group_id=86638&release_id=533658  ClamWin Team
303681
An error in the virus signature files for CA's eTrust antivirus software caused the program to mistakenly delete a crucial Windows 2003 file, which in turn caused some systems to crash and fail to reboot.
241353
The new flaw is unrelated to the help-file flaws discovered by a Chinese security company last week. Microsoft took the Chinese security group to task for disclosing the vulnerability without giving the company a chance to develop a fix.
740269
(InfoWorld) - Users are being advised to disable a certain type of file in Microsoft's Windows Media Player software following the discovery of a new security hole in the software. The flaw, which affects Windows Media Player versions 9 and 10, could allow a malicious hacker to run unauthorized software on a victim's PC or cause a denial of service attack, according to security company FrSIRT, which rated the problem critical in an advisory Thursday. The flaw is due to a buffer overflow error that can occur when Windows Media Player is used to run ".asx" media files, according to a warning from eEye Digital Security . Such files open automatically in a Web browser, meaning a hacker would need only to post an infected .asx file in a Web page and then try to lure users to visit the page, eEye Digital said. An infected file could also be sent via email, in which case users would need to be persuaded to open it. Microsoft said an initial investigation revealed that the "proof of concept" code could allow an attacker to execute code on a user's machine. It said it was unaware of any attempts to exploit the vulnerability, and it was unclear Friday morning if the proof of concept code it referred to was in the hands of hackers. Users can protect against the vulnerability in Internet Explorer by preventing it from opening .asx files automatically. Turning off Active Scripting would also greatly reduce, but not eliminate, the risk, Microsoft said. FrSIRT also recommended that users upgrade to Windows Media Player 11 , which it said is not affected. Microsoft was still determining Friday whether it needed to issue an "out of cycle" security fix for the problem or patch it with its next monthly software update. The flaw was originally reported on Nov. 22, when it was identified only as a denial-of-service issue. Some discussion boards described the problem as a "zero-day exploit," although it was unclear if that was the case. Zero-day exploits occur when exploit code is released on the same day that a flaw is uncovered, giving users no time to protect themselves. It's been another busy week for Microsoft's security teams. On TuesdayÂ the company warnedÂ of an unpatched vulnerability in Word that had been the subject of what it called "limited attacks." And on Thursday it said it was readying several patches for Visual Studio and Windows that it plans to release next week. The patches currently due for next weekÂ do not address the problemsÂ with Word and Windows Media Player.
12942
After a screenshot on MSDN appeared to show an IE8 beta passing an accepted Web standards test, some came to the only conclusion they could: that the test had to be broken.
433190
(InfoWorld) - With security vendors warning of new malware that exploits a recently patched flaw in Windows, Microsoft Corp. is saying that attacks are not on the rise. Earlier this week, two new malicious programs popped up, both of which took advantage of the MS06-040 Windows Server service vulnerability. This prompted Symantec Corp. to raise its ThreatCon rating to 2 on Thursday, an indication that users should be at a heightened level of security awareness. But on Friday Microsoft said that even with these new variants, the total number of computers being attacked was unchanged. "We're not seeing an increase in attacks, just minor variations," said Stephen Toulouse, security program manager with Microsoft's Security Response Center. Symantec's Oliver Friedrichs agreed that "the overall volume of attack attempts is fairly consistent," but he said that the fact that hackers had continued to pound away at the MS06-040 vulnerability is troubling. "The fact that we are seeing more threats exploiting these vulnerabilities, that in itself is disconcerting," said Friedrichs, a director of emerging technologies in Symantec Security Response. Symantec has counted six variants of the MS06-040 attacks to date. Symantec rates the two new programs spotted this week, W32.Dasher.G and W32.Spybot.AKNO, as low risks. AÂ security bulletin on MS06-040, which affects most versions of Windows, is available. The MS06-040 patch has to do with Windows' Server services, which are used for a variety of networking tasks, such as file sharing and printing. Because the flaw relates to widely used and network-enabled features, security experts have warned that it is a likely candidate for a widespread worm. Shortly after the patch was released, the U.S. Department of Homeland Security took the unusual step of warning users of the flaw, saying it could put the nation's infrastructure at risk. To date, however, no widespread outbreak has appeared.
201469
(InfoWorld) - Microsoft Corp. has released a test version of its new Forefront Security for SharePoint software designed to support upcoming versions of Microsoft's portal software. The beta code, released Thursday, gives administrators a way to plug as many as five antivirus scanning engines into SharePoint Server 2007 and SharePoint Services 3.0 in order to root out malicious or unwanted documents. The product is based on theÂ Antigen softwareÂ Microsoft picked up in its June 2005 acquisition of Sybari Software. Another Sybari-based product, Forefront Security for Exchange went into beta in July. This latest SharePoint release features a new Microsoft Antivirus engine, performance enhancements, and better management features. It also comes with better support for languages other than English. "Until now we've only had English versions," said Joe Licari, director of product management for Forefront. "This release will localize in 11 languages including Japanese and Chinese." Microsoft is tying the rollout of Forefront Security of SharePoint to the release of its SharePoint Server 2007 and SharePoint Services 3.0 products. The commercial version will be available for download by year's end, and then on DVD during the first quarter of 2007. The beta release can beÂ downloaded here. Â
625830
(InfoWorld) - MicrosoftÂ released its February set of security updates Tuesday, including critical fixes for bugs in Office and the scanning engine used by the company's security products. The security software flaw is of particular concern because it could, in theory, be very easily exploited by an attacker to run unauthorized software on a victim's PC. The bug has to do with the way that Microsoft's Malware Protection Engine, used by Windows Live One Care and Windows Defender, processes PDF files. Windows Defender is available for free and ships with Microsoft's Vista operating system. "An attacker could exploit the vulnerability by constructing a specially crafted PDF that could potentially allow remote code execution when the target computer system receives, and the Microsoft Malware Protection Engine scans, the PDF file," Microsoft said in its bulletin on the patch. This engine is also used by Microsoft's Antigen and Windows Forefront Security products, meaning that Exchange servers running these products could also be compromised. Although there is not yet any known attack that exploits this flaw, it could become a serious problem for Windows users running Microsoft's security products, according to Amol Sarwate, vulnerability lab manager at Qualys. "These attacks are very difficult to avoid," he said. "These products run automatically in the background." Symantec rated this scanning engine flaw the most critical of the vulnerabilities patched on Tuesday. In total, six of Microsoft's 12 updates are rated as "critical," while the other six have the less-serious rating of "important." Among the patches is a widely anticipated update for Microsoft WordÂ that fixes six bugs in Microsoft's word processing software. Hackers had been exploiting a number of these bugs in very targeted attacks over the past few months. Other critical patches fix bugs in the ActiveX HTML Help control and Microsoft Data Access Components, both used by Windows, as well as flaws in Office and Internet Explorer.
510748
A group of software engineers with ZERT has issued what it characterizes as an interim patch for the VML exploit, possibly closing the door to a new series of Trojans. In so doing, a new group resurrects some old questions about whether third parties should be trusted to patch Microsoft products.