Kaspersky false alarm quarantines Windows Explorer
127140
Accidents will happen A faulty signature update from Kaspersky Lab on Wednesday flagged up Windows Explorer (explorer.exe) as infected with a low-risk virus, Huhk-C. As a result the core Windows component was quarantined or worse.â¦
411156
Microsoft's consumer security software changes the AU (Automatic Updates) settings in Windows XP and Vista without telling users or getting their approval, a researcher said Thursday -- behavior that may explain recent reports of patches being installed and systems rebooting without permission.When Microsoft responded to new charges of silent changes last week, however, it denied that AU settings were ever altered without user approval, and it didn't mention OneCare as a possible culprit.Scott Dunn, an editor at the "Windows Secrets" newsletter, reported Thursday morning that OneCare silently changes AU settings as it installs. No matter what AU setting the user selected previously, OneCare's installer quietly changes it to the fully automatic option."Some security products have turned on AU in the past," said Dunn, who also tested several other current consumer suites, including Symantec's Norton 360 and Norton Internet Security, McAfee's Internet Security Suite, and Check Point Software's ZoneAlarm Internet Security Suite. "But OneCare was the only guilty party."OneCare's willful way with AU may be an explanation for the reports two weeks ago of machines downloading and installing the Oct. 9 set of security fixes even though their owners had explicitly instructed Windows to ignore all downloads or notify them before they were installed.Several days later, after it wrapped up an investigation, Microsoft said AU settings were never changed without user consent, and it blamed absent-minded users for making modifications and then forgetting that they had."I find this surprising and very disturbing," said Dunn. "If they're going to change [AU] settings, they should let you know."Four options, down to one In both Windows XP and Vista, users can select from four options in AU: Download and install all updates automatically; download files but do not install them without user consent; check for but neither download nor install without permission; and disable Automatic Updates entirely.OneCare, sold for $49.95 and offered as a free 90-day trial, sets AU to the first, and all-automatic, setting, said Dunn, on both operating systems. "It does that even if Automatic Updates is completely disabled," he added. If users later uninstall OneCare -- for instance, after a trial has expired -- the software does not return the machine to the earlier settings; they must be reset by the user."Worse, OneCare silently turns on [Windows] services that have been disabled by the user," Dunn said, referring to the two services that some users, frustrated at earlier incidents in which Windows retrieved and installed patches without permission, have manually turned off: Automatic Updates and Background Intelligent Transfer Service. The services can be switched off manually using the Windows services.msc utility. Normally, once disabled, they remain that way until the user manually turns them back on.ComputerWorld confirmed Dunn's account of OneCare's AU changes by installing the security suite on both Windows XP and Windows Vista.At no time during installation, said Dunn, does OneCare tell the user that the software will modify Windows' settings or provide an opt-in dialog. Nor do the various online documents -- including Microsoft's privacy statement and an addendum for OneCare -- that are offered up early during the process contain any information about the changes. "It turns out there's a brief mention of it buried deep in one of the OneCare help files," said Dunn. "But that's not the same as telling users upfront."The help file (select "What does Windows Live Update do to help manage and maintain my computer's software updates?" to view the pertinent section) acknowledges that OneCare makes changes without bothering to ask. "When you first install Windows Live OneCare, setup automatically enlists your computer in Microsoft Update and changes your computer's settings to download and install updates automatically using Automatic Updates," it reads.Who's 'forgetful' now? Although Microsoft was not immediately available for comment this morning, it made it clear last week that reports of unauthorized updates, and even PC reboots, could not be blamed on its software."I want to stress that the Windows Update client does not change AU settings without users' consent," said Nate Clinton, a program manager with the Microsoft Update team in a company blog entry a week ago. He went on to list five possible explanations; all require the user to take action or accept one option from several offered.Earlier, a Microsoft spokeswoman had been more blunt. "It may be more a case of someone clicking to change their AU settings but not realizing/remembering doing so," she said last Tuesday. She also called out OneCare's installation as one such possible moment and claimed that the security suite offered users the option of changing AU settings. It does not."This is just one more example of Microsoft having the attitude that we know better than you do, that you should just stop asking questions and let us do what we want," said Dunn.Computerworld is an InfoWorld affiliate
635209
(InfoWorld) - Microsoft plans to roll out a new version of its antipiracy Windows Genuine Advantage (WGA) Notifications tool for Windows XP over the coming weeks and months, following aÂ barrage of criticismÂ from users. The software giant has incorporated user feedback into the new version to make installation of the tool and validation of the operating system less opaque, according to a Microsoft statement issued Tuesday. The upcoming release of WGA Notifications features a new installation wizard and will display validation results as soon as the tool has been installed. The software doesn't need to be rebooted after its installation, Microsoft said. Instead of the tool simply flagging a copy of the OS as genuine or not, Microsoft has added an additional "indeterminate" result category and access to resources to troubleshoot issues if users are unable to validate their operating systems. Microsoft plans to update the tool every 90 to 120 days, as a way to react to re-evaluation of the software and any changes in software piracy. Microsoft began piloting an initial version of WGA Notifications in April to ascertain whether users' copies of Windows XP were genuine, as part of the vendor's Genuine Software Initiative to crack down on pirated and counterfeit versions of Windows. Users who can't validate their copy of Windows as genuine forfeit the right to install many of the updates Microsoft provides for Windows and add-on software. So far, WGA Notifications has provedÂ highly unpopular with users, with criticism reaching a crescendo in June. First, the tool came under attack forÂ exhibiting spyware-like behaviorÂ since WGA Notifications was checking in with Microsoft's servers each time users rebooted their PCs even though the software had already certified the copy of Windows XP as genuine. Microsoft disputed the spyware allegation, saying that although the tool regularly called home, it wasn't providing any information to Microsoft, just checking to see if it should run. Later that same month, users complained that Microsoft was delivering WGA Notifications as a high priority automatic update for Windows XP despite the tool still being in a test version. The software vendor has typically provided test versions of its software separately from updates. Microsoft said the tool's license explained the software was a pre-release version, but customers countered that fact wasn't made sufficiently obvious. Microsoft finally responded byÂ issuing a second version of WGA NotificationsÂ in late June that only periodically checked if the copy of Windows was genuine every time users logged on to the system. At the same time, the software vendor moved the tool out of the testing stage. Microsoft remains committed to having WGA Notifications fully deployed worldwide by year-end. Â
94834
When your antivirus, spyware stopper, or firewall keeps you from getting your work done, find an alternative.
681694
Windows XP Service Pack 2 gets a 'hotfix' for VPNs, part of the \
738746
SSL-Explorer is the world's first open-source, browser based SSL VPN solution. This unique remote access security solution provides users and businesses alike with a means of securely accessing network resources from outside the network perimeter using only a standard web browser.     The main addition to this 0.2.7 release of SSL-Explorer is a major alteration to the authentication flow which has been changed to a multi-stage login process.  The system now has the ability to alter the selectable authentication schemes for a particular user depending on those granted to them via their policies. Additionally, an RSS based context sensitive help system has now been introduced into this release. Also included in the release are various bugfixes for proxy support.   SSL-Explorer product page:   http://www.sshtools.com/showSslExplorerCommunity.do    SSL-Explorer SourceForge.net project page:   http://sourceforge.net/projects/sslexplorer/
507312
Trojan.Mebroot malware is read at startup, then changes the Windows kernel to avoid detection.
86025
An Internet Explorer vulnerability first reported yesterday is already getting a workout. Malware utilizing the hole for installation is turning up on various Russian porn sites, with more trouble expected.
741417
Microsoft releases critical Explorer patch VNUNet.com
480779
Malware arrives in the form of a game, disables antivirus protection.
97191
A Chinese security group has released sample code to exploit two new unpatched flaws in Microsoft Windows. The advisory comes in the week before Christmas, a time when many companies and home users are least prepared to deal with the problems.
416981
To see the e-mail I get every day from readers about security issues is to develop a deep discomfort with the state of computing today. Keeping a Windows PC safe can demand a high degree of vigilance. -Rob Pegoraro
478392
(InfoWorld) - A Windows feature designed to simplify computing for disabled users could be misused in Vista, a McAfee researcher reported Monday. Attackers could use this feature, called StickyKeys, to trick a user into launching unauthorized software on the Vista machine, according to Vinoo Thomas, a McAfee researcher who blogged about the issue on Monday. StickyKeys is launched when a Windows user hits a modifier key like Shift or Alt five times. This makes the modifier key "sticky" so commands like Shift-F1 can be launched without having to hit two keys simultaneously. An attacker could replace the sethc.exe file used to launch StickyKeys with some other executable, like the Windows command utility, Thomas wrote. This backdoor vulnerability was already known to exist in Windows 2000 and Windows XP, according to Thomas. Although it is interesting that Vista is also vulnerable, it's not clear how useful the backdoor would be to an attacker because one must first gain access to the machine in order to replace the StickyKeys file. Thomas believes that it could be used by an inside attacker to bypass log-in on terminal servers and workstations. Microsoft executives were not immediately available to comment on the issue. To avoid the problem, "one can uninstall the Accessibility Tools feature, which is installed by default, to avoid this fairly simple, yet potentially serious built-in backdoor," he wrote. "And don't forget to hit the shift key five times and see what pops up on your desktop."
420901
Most users think their computer is safe from adware and spyware--but they're wrong.
479701
As other attacks surface Doubts have arisen about the effectiveness of a Windows key generator package that allegedly offered a means to circumvent Microsoft's anti-privacy protection.â¦
80549
(December 19, 2004) - Dear Nick: When we use our Windows Explorer we get a message often saying that Explorer has encountered a problem and needs to close, etc.
337058
Unpatched bugs that could allow attackers to take over Windows systems via Internet Explorer. The bugs were discovered by security company FrSIRT and reported to Adobe a week ago.