User, beware of new XP patch
301996
Microsoft has a massive patch for some of the many bugs and security holes in Windows XP. If you&#39;re using Windows XP, you might want to download the software patch and install it.
182751
Windows XP Service Pack 2 seems a smooth upgrade for most, but many are putting off installing Microsoft&#39;s big security patch anyway.
387199
Microsoft has issued a patch for a compatibility problem between the recent Windows XP Service Pack 2 and an advertising application run on many users&#39; machines.
157435
Microsoft has begun sending Windows XP Service Pack 2 to home users via of its automatic update system. Despite a few flaws that already have been found in the massive patch, the update will strengthen system security for most Windows XP ...
15812
Microsoft has quietly released an update to Windows XP to fix a potentially serious configuration problem in the firewall that ships as part of Windows XP Service Pack 2. Users who installed SP2 on their Windows
297723
Microsoft is warning Windows XP users to check for and remove any spyware that may be installed on computer systems before installing the Windows XP service pack 2 (SP2), security update.
304020
ProKras writes &quot;German magazine PC-Welt has discovered a major security flaw in Windows XP SP2 when installing over SP1. The article says that &#39;with a certain configuration, your file and printer sharing data
213499
Update to "critical" Internet Explorer patch repairs a serious security flaw introduced by the original version.
113813
thejoelpatrol writes &quot;So did Slashdotters call this one? Windows XP SP2 seems not to be so secure after all. A Register reporter goes in depth to find out just how safe a fresh install is.
408632
Microsoft denied Wednesday that its software had arbitrarily changed Windows Vista's update settings, saying that users were responsible for the modifications that generated claims of unauthorized patch installs.Reacting to reports that first surfaced last Friday, a program manager for Windows Update said today that an investigation had turned up no evidence the Oct. 9 security fixes had switched settings in Vista's AU (Automatic Updates)."From the customer logs that we received, we found that none of the updates released as part of the October security release have made any changes to users' AU settings," said Nate Clinton in a post to a company blog. "In fact, in the logs we reviewed, AU in all cases was set to 'install updates automatically' prior to the October security release."Vista allows users to turn off AU entirely, tell the operating system to check for but neither download or install any fixes, instruct the mechanism to download files but not install them; or accept all patches without any additional approval.The claims that AU settings had mysteriously reverted to the "install automatically" setting began to trickle into a message forum on the AeroXperience Web site soon after the release last Tuesday of six security updates. Several users said that AU downloaded and installed patches even though they had specifically instructed Vista not to do so.But unlike last month, when a Windows newsletter revealed that Microsoft had updated users' PCs contrary to their instructions, the newest charges were limited to AeroXperience members. No similar reports, for example, were posted to the Windows Update support newsgroup hosted by Microsoft. During September's brouhaha, that newsgroup was thick with messages about the stealth updating.Certain that AU had not run amok and changed its own settings, Clinton fingered users for the altered state of AU. "I want to stress that the Windows Update client does not change AU settings without users' consent. However, AU settings can be set or changed in the following scenarios," he said, and then listed five; all require the user to take action or accept one option from several offered."During the installation of Windows Vista, the user chooses one of the first two recommended options in the 'Out of Box Experience' and elects to get updates automatically from Windows," Clinton said was one possibility. Another: "The user chooses to opt in to Microsoft Update during the installation or the first run experience of another Microsoft application such as Office 2007."Earlier, a Microsoft spokeswoman had been more blunt. "It may be more a case of someone clicking to change their AU settings but not realizing /remembering doing so," she said Tuesday.Users on AeroXperience writing to the forum after Microsoft wrapped up its investigation accepted Clinton's explanation. "The disparity between the Windows Update control panel applet and the OOBE (Out of Box Experience) update settings page (when first running Windows Vista) seems to be what's causing the confusion," said a member identified as Bryant.Computerworld is an InfoWorld affiliate
97795
Blog: Patch Tuesday will affect both Windows XP and Vista as well as Excel and Publisher.
86222
In brief Exploit circulating for unpatched vuln
646179
Wondering if you should install Microsoft&#39;s Windows XP patch now? Worried about what might go wrong? We have answers to these questions and others, written from information supplied by Microsoft and other sources.
412397
If you have spyware installed on your computer system and you update your operating system with the latest Windows XP Service pack 2 (SP2) update, your computer could possibly freeze.
209227
Security researchers are warning of another pair of vulnerabilities in Microsoft Corp.&#39;s Internet Explorer browser affecting users on fully patched Windows XP Service Pack 2 systems.
411156
Microsoft's consumer security software changes the AU (Automatic Updates) settings in Windows XP and Vista without telling users or getting their approval, a researcher said Thursday -- behavior that may explain recent reports of patches being installed and systems rebooting without permission.When Microsoft responded to new charges of silent changes last week, however, it denied that AU settings were ever altered without user approval, and it didn't mention OneCare as a possible culprit.Scott Dunn, an editor at the "Windows Secrets" newsletter, reported Thursday morning that OneCare silently changes AU settings as it installs. No matter what AU setting the user selected previously, OneCare's installer quietly changes it to the fully automatic option."Some security products have turned on AU in the past," said Dunn, who also tested several other current consumer suites, including Symantec's Norton 360 and Norton Internet Security, McAfee's Internet Security Suite, and Check Point Software's ZoneAlarm Internet Security Suite. "But OneCare was the only guilty party."OneCare's willful way with AU may be an explanation for the reports two weeks ago of machines downloading and installing the Oct. 9 set of security fixes even though their owners had explicitly instructed Windows to ignore all downloads or notify them before they were installed.Several days later, after it wrapped up an investigation, Microsoft said AU settings were never changed without user consent, and it blamed absent-minded users for making modifications and then forgetting that they had."I find this surprising and very disturbing," said Dunn. "If they're going to change [AU] settings, they should let you know."Four options, down to one In both Windows XP and Vista, users can select from four options in AU: Download and install all updates automatically; download files but do not install them without user consent; check for but neither download nor install without permission; and disable Automatic Updates entirely.OneCare, sold for $49.95 and offered as a free 90-day trial, sets AU to the first, and all-automatic, setting, said Dunn, on both operating systems. "It does that even if Automatic Updates is completely disabled," he added. If users later uninstall OneCare -- for instance, after a trial has expired -- the software does not return the machine to the earlier settings; they must be reset by the user."Worse, OneCare silently turns on [Windows] services that have been disabled by the user," Dunn said, referring to the two services that some users, frustrated at earlier incidents in which Windows retrieved and installed patches without permission, have manually turned off: Automatic Updates and Background Intelligent Transfer Service. The services can be switched off manually using the Windows services.msc utility. Normally, once disabled, they remain that way until the user manually turns them back on.ComputerWorld confirmed Dunn's account of OneCare's AU changes by installing the security suite on both Windows XP and Windows Vista.At no time during installation, said Dunn, does OneCare tell the user that the software will modify Windows' settings or provide an opt-in dialog. Nor do the various online documents -- including Microsoft's privacy statement and an addendum for OneCare -- that are offered up early during the process contain any information about the changes. "It turns out there's a brief mention of it buried deep in one of the OneCare help files," said Dunn. "But that's not the same as telling users upfront."The help file (select "What does Windows Live Update do to help manage and maintain my computer's software updates?" to view the pertinent section) acknowledges that OneCare makes changes without bothering to ask. "When you first install Windows Live OneCare, setup automatically enlists your computer in Microsoft Update and changes your computer's settings to download and install updates automatically using Automatic Updates," it reads.Who's 'forgetful' now? Although Microsoft was not immediately available for comment this morning, it made it clear last week that reports of unauthorized updates, and even PC reboots, could not be blamed on its software."I want to stress that the Windows Update client does not change AU settings without users' consent," said Nate Clinton, a program manager with the Microsoft Update team in a company blog entry a week ago. He went on to list five possible explanations; all require the user to take action or accept one option from several offered.Earlier, a Microsoft spokeswoman had been more blunt. "It may be more a case of someone clicking to change their AU settings but not realizing/remembering doing so," she said last Tuesday. She also called out OneCare's installation as one such possible moment and claimed that the security suite offered users the option of changing AU settings. It does not."This is just one more example of Microsoft having the attitude that we know better than you do, that you should just stop asking questions and let us do what we want," said Dunn.Computerworld is an InfoWorld affiliate
425600
December's Patch Tuesday finds Vista in bad guys' sights. Plus: Get Office 2007 SP1, get your fix for Flash, and avoid an HP laptop disaster.