Kaspersky false alarm quarantines Windows Explorer
127140
Accidents will happen A faulty signature update from Kaspersky Lab on Wednesday flagged up Windows Explorer (explorer.exe) as infected with a low-risk virus, Huhk-C. As a result the core Windows component was quarantined or worse.â¦
237796
(Source: Computerworld) Antivirus software alone isnt enough to prevent todays speedy, sophisticated virus attacks. Security managers should consider multitiered approaches that include behavior scanning, appliances that check e-mail for worms, and estricting user access to dangerous Web sites. Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs, to learn more.
744672
Windows security holes patched; tool to rid PCs of malicious software now available.
26007
Security firms are warning about a clever Windows virus called Bofra that has started circulating on the net.
386657
Company's eTrust software detects a Windows file as a virus and deletes it, causing some servers to crash and fail to reboot.
359809
(InfoWorld) - There was a little surprise buried inÂ Microsoft's monthly security bulletins Tuesday. It turns out that Microsoft had quietly slipped out one of the February fixes just days before its Jan. 30 Vista launch. The fix was for a bug in Microsoft's Malware Protection Engine, used by products like Windows Defender, OneCare, and Antigen to scan for malware. Microsoft had discovered that the engine could possibly be tricked into running unauthorized code if it scanned a specially crafted PDF file. Nobody has actually launched such an attack, but since these products are always automatically scanning for malware in the background, the vulnerability could have led to some pretty nasty exploits. Still, it's strange that Microsoft waited so long to notify its customers of the patch. It's rare for Microsoft to release one of these out-of-cycle updates, but since it adoptedÂ its monthly patch process back in October 2003, it generally lets people know about them as soon as they're released. Microsoft's Mark Griesi told me that the company decided to send out the malware engine fix as soon as it was ready on January 26 and that this kind of quick fix is standard practice with most security software. But he said there was no particular reason why the company decided to wait until February 13 to tell people about it. Microsoft just hasn't been in the position of having to patch its security software since rolling out the monthly patch process, he added. "It was one of those first-time situations: 'Should we say something now or should we just wait,'" he told me. "This time we decided to wait. We won't do it again." From a PR perspective, it wasn't a bad move. Microsoft has touted Defender as one of the top three Vista security features. It wouldn't have been much fun to be talking about a major security flaw in the product just days before the Vista launch, would it?
698181
(InfoWorld) - Nearly a year after Microsoft introduced Windows Live OneCare, the company's first foray into the security market is still getting low marks from analysts and users. A recent report comparing the antivirus products of various vendors ranked Microsoft's product at the bottom in terms of detecting potential security threats. At the same time, users are complaining that OneCare, which includes firewall, antivirus, backup, and antispyware software, quarantines the entire mail store of their Outlook and Outlook Express programs, making it impossible for them to retrieve e-mail. AV-Comparatives, a project in Austria overseen by security researcher Andreas Clementi, published the antivirus comparison report, which also looked at products from Symantec, McAfee, Kaspersky Lab, BitDefender, Fortinet, F-Secure, and several other antivirus products from smaller vendors. In detecting Windows viruses, worms, macros, scripts, and other OS threats, Microsoft ranked last out of the 15 vendors tested, detecting them 91 percent of the time. G Data Software AG's Anti-Virus Kit (AVK) ranked first with 99.6 percent detection, while products from three vendors -- Kaspersky Anti-Virus, MicroWorld Technologies eScan, and F-Secure Anti-Virus -- tied for second with 99 percent detection. TrustPort Antivirus Workstation from AED came in third with 98.9 percent detection. In preventing intrusion through backdoors, Trojans and in other malware detection, Windows OneCare also ranked last out of 13 vendors, with 79.6 percent detection. TrustPort came in first at 99.5 percent detection; AVK came in second with 99.4 percent detection; and AVIRA GmbH's AntiVir Personal Edition Premium came in third with 98.9 percent detection. If ranking low in its rates of malware and virus detection isn't enough to irk users, a recent update to the product has been quarantining the Outlook.PST file, which stores mail in Outlook and Outlook Express, users reported recently on a Microsoft Windows user form. "This is the most unacceptable act Microsoft has ever committed," groused one user on the forum. "I run a small business, and I am screwed. I have no way to respond to e-mails because I made the mistake of trusting Microsoft ... and all of my e-mails and contacts are gone." Microsoft confirmed the problem Friday and said it will update the Windows Live OneCare engine to fix the problem as part of its monthly patch release cycle. The company also offered the following step-by-step fix to recover lost e-mail in the meantime: *Â Close Outlook or Outlook Express *Â Click change OneCare settings in the main OneCare user interface *Â Click on the viruses and spyware tab *Â Click on the quarantine button, and then select the pst or dbx file, and then click on restore. To ensure that the problem does not continue until the next update, Microsoft said users should also do the following: *Â Click change OneCare setting in the main user interface *Â Click viruses and spyware tab *Â Click on the exclusions button *Â Click on the add folder button *Â Navigate to the specific folder that contains the .dbx or .pst file to be excluded. *Â Click OK.
741214
Workshop Windows virus cleanup primer
42644
(InfoWorld) - With Microsoft's monthly patch release expected on Tuesday, scammers are sending out fake security bulletins that attempt to install malicious software on victim's computers. The e-mail messages claim to describe a "Cumulative Security Update for Internet Explorer" that fixes a critical security flaw in the browser. It comes with a link entitled "Download this update." When users click on this link, they are taken to a server that attempts to install malicious software known as Trojan-Downloader.Win32.Agent.avk. This Trojan software then attempts to reach out to other computers on the Internet in order to install more programs on the victim's computer. The SANS Internet Storm Center received its first and only report of the scam on Thursday night, but a second sample has also been posted to the Chinese Internet Security Response Team blog. SANS volunteer Lenny Zeltser believes that the criminals behind this scam may be gearing up for more activity. The trojan looks for three different servers, and two of them have domains that haven't yet been registered. He suspects the authors of the scam may be planning to register those domains before embarking on a more widespread campaign. The two e-mail samples contained obvious errors that would be caught by technically savvy users. For example, although the patch Zeltser examined claimed to have been issued in June 2007, it was entitled MS06-4 instead of the more-plausible MS07-004. Still, these scams need to fool only a small percentage of victims in order to be successful, said Zeltser, information security practice leader at Gemini Systems in New York. "You wonder, does it really matter that there are these strange discrepancies in the way the fake security alert is written," he said. "People who would notice probably would be the kind of people who wouldn't click on the link." Another tip-off: Microsoft does send out notification e-mail when it publishes security bulletins, but the links in these alerts take users to the bulletins themselves, not to executable downloads
421637
Give your system more oomph by disabling the services that Windows activates automatically, whether or not you actually need them.
478094
Security firm Secunia has detailed a new flaw in Internet Explorer that affects users running Windows XP Service Pack 2. The vulnerability involves drag-and-drop, which can be used within a Web page to place a malicious program in the Windows startup folder.
80549
(December 19, 2004) - Dear Nick: When we use our Windows Explorer we get a message often saying that Explorer has encountered a problem and needs to close, etc.
523881
What's the best remedy for this obnoxious software installed without PC users' notice? Here are assessments of five popular anti-spyware utilities, three free and two that sell for $30.-For The Post
217347
Stop us if you've heard this before Security experts warn a new, unpatched vulnerability in Internet Explorer might be used to spread malware. A flaw in Microsoft's Direct Animation Path (daxctle.ocx) ActiveX control, rated as critical by Secunia and other security watchers, has spawned proof of concept code but has not yet become the subject of widespread, hostile attack. Memory corruption is possible even on a fully patched Windows XP system.â¦
478392
(InfoWorld) - A Windows feature designed to simplify computing for disabled users could be misused in Vista, a McAfee researcher reported Monday. Attackers could use this feature, called StickyKeys, to trick a user into launching unauthorized software on the Vista machine, according to Vinoo Thomas, a McAfee researcher who blogged about the issue on Monday. StickyKeys is launched when a Windows user hits a modifier key like Shift or Alt five times. This makes the modifier key "sticky" so commands like Shift-F1 can be launched without having to hit two keys simultaneously. An attacker could replace the sethc.exe file used to launch StickyKeys with some other executable, like the Windows command utility, Thomas wrote. This backdoor vulnerability was already known to exist in Windows 2000 and Windows XP, according to Thomas. Although it is interesting that Vista is also vulnerable, it's not clear how useful the backdoor would be to an attacker because one must first gain access to the machine in order to replace the StickyKeys file. Thomas believes that it could be used by an inside attacker to bypass log-in on terminal servers and workstations. Microsoft executives were not immediately available to comment on the issue. To avoid the problem, "one can uninstall the Accessibility Tools feature, which is installed by default, to avoid this fairly simple, yet potentially serious built-in backdoor," he wrote. "And don't forget to hit the shift key five times and see what pops up on your desktop."
104663
Worried about spyware? spam? "spim"? AOL wants to set your mind at rest. Also: Putting patches in place.
6674
Have adware and spyware commandeered your computer? An extreme solution: erasing your hard drive and starting over.