CA antivirus mistakenly flags Windows component
472946
An overnight update to CA's eTrust Antivirus signatures caused some mayhem for users when the software flagged a security-related process in Windows as malicious.
298609
One in five applications installed on Windows PCs are missing security patches, a Copenhagen-based vulnerability tracker has reported.According to Secunia APS, more than 20 percent of the applications scanned by its Personal Software Inspector (PSI) utility were open to attack because available fixes for security flaws had not been applied.&quot;More than 20 percent of all applications installed on users&#39; PCs have known security flaws, but the users have yet to install the patch provided by the vendor of [the] product,&quot; said Jakob Balle, Secunia&#39;s development manager, in a post to the company&#39;s blog last week.The 20 percent figure was based on scans of more than 14.5 million applications installed on the Windows PCs operated by users who downloaded and installed Secunia&#39;s PSI. The utility scans for some 4,200 different applications and reports on their patch status.The 1-in-5 ratio, however, is an improvement over earlier PSI scans. Last May, Secunia said that 28 percent of the&#160;applications PSI scanned were missing available security updates.Secunia released the free patch-detection utility a year ago but shifted it to Release Candidate 1 (RC1) stage earlier this month. The company claimed that nearly 191,000 users have downloaded and run the program.PSI, which runs on Windows 2000, XP, Vista and Server 2003, can be downloaded from Secunia&#39;s Web site.Computerworld is an InfoWorld affiliate.
295855
Antivirus firm warns of 10 holes in Windows XP SP2. Solution: Buy the company's products.
40836
Microsoft has tweaked its antipiracy software to show when it can't quite decide whether the operating system is authorized or not.
62609
With viruses, worms, spyware, spam and phishing, running a computer this year -- especially one with Windows -- has often been a colossal headache. -Rob Pegoraro
587157
Root of recent Windows Updates woes? Microsoft's OneCare security tool changes Automatic Update settings as it installs.
411156
Microsoft's consumer security software changes the AU (Automatic Updates) settings in Windows XP and Vista without telling users or getting their approval, a researcher said Thursday -- behavior that may explain recent reports of patches being installed and systems rebooting without permission.When Microsoft responded to new charges of silent changes last week, however, it denied that AU settings were ever altered without user approval, and it didn't mention OneCare as a possible culprit.Scott Dunn, an editor at the "Windows Secrets" newsletter, reported Thursday morning that OneCare silently changes AU settings as it installs. No matter what AU setting the user selected previously, OneCare's installer quietly changes it to the fully automatic option."Some security products have turned on AU in the past," said Dunn, who also tested several other current consumer suites, including Symantec's Norton 360 and Norton Internet Security, McAfee's Internet Security Suite, and Check Point Software's ZoneAlarm Internet Security Suite. "But OneCare was the only guilty party."OneCare's willful way with AU may be an explanation for the reports two weeks ago of machines downloading and installing the Oct. 9 set of security fixes even though their owners had explicitly instructed Windows to ignore all downloads or notify them before they were installed.Several days later, after it wrapped up an investigation, Microsoft said AU settings were never changed without user consent, and it blamed absent-minded users for making modifications and then forgetting that they had."I find this surprising and very disturbing," said Dunn. "If they're going to change [AU] settings, they should let you know."Four options, down to one In both Windows XP and Vista, users can select from four options in AU: Download and install all updates automatically; download files but do not install them without user consent; check for but neither download nor install without permission; and disable Automatic Updates entirely.OneCare, sold for $49.95 and offered as a free 90-day trial, sets AU to the first, and all-automatic, setting, said Dunn, on both operating systems. "It does that even if Automatic Updates is completely disabled," he added. If users later uninstall OneCare -- for instance, after a trial has expired -- the software does not return the machine to the earlier settings; they must be reset by the user."Worse, OneCare silently turns on [Windows] services that have been disabled by the user," Dunn said, referring to the two services that some users, frustrated at earlier incidents in which Windows retrieved and installed patches without permission, have manually turned off: Automatic Updates and Background Intelligent Transfer Service. The services can be switched off manually using the Windows services.msc utility. Normally, once disabled, they remain that way until the user manually turns them back on.ComputerWorld confirmed Dunn's account of OneCare's AU changes by installing the security suite on both Windows XP and Windows Vista.At no time during installation, said Dunn, does OneCare tell the user that the software will modify Windows' settings or provide an opt-in dialog. Nor do the various online documents -- including Microsoft's privacy statement and an addendum for OneCare -- that are offered up early during the process contain any information about the changes. "It turns out there's a brief mention of it buried deep in one of the OneCare help files," said Dunn. "But that's not the same as telling users upfront."The help file (select "What does Windows Live Update do to help manage and maintain my computer's software updates?" to view the pertinent section) acknowledges that OneCare makes changes without bothering to ask. "When you first install Windows Live OneCare, setup automatically enlists your computer in Microsoft Update and changes your computer's settings to download and install updates automatically using Automatic Updates," it reads.Who's 'forgetful' now? Although Microsoft was not immediately available for comment this morning, it made it clear last week that reports of unauthorized updates, and even PC reboots, could not be blamed on its software."I want to stress that the Windows Update client does not change AU settings without users' consent," said Nate Clinton, a program manager with the Microsoft Update team in a company blog entry a week ago. He went on to list five possible explanations; all require the user to take action or accept one option from several offered.Earlier, a Microsoft spokeswoman had been more blunt. "It may be more a case of someone clicking to change their AU settings but not realizing/remembering doing so," she said last Tuesday. She also called out OneCare's installation as one such possible moment and claimed that the security suite offered users the option of changing AU settings. It does not."This is just one more example of Microsoft having the attitude that we know better than you do, that you should just stop asking questions and let us do what we want," said Dunn.Computerworld is an InfoWorld affiliate
480779
Malware arrives in the form of a game, disables antivirus protection.
116589
Some say Win XP SP2 enhancements cause conflicts, don't protect as claimed.
64290
Security firms are warning about a Windows virus disguising itself as an electronic Christmas card. The Zafi.D virus translates the Christmas greeting on its subject line into the language of the person receiving infected e-mail.
271561
Antivirus company Symantec is warning its customers about a number of critical holes in Microsoft&#39;s Windows operating system. The holes, which surfaced late last week, could make Windows systems vulnerable to compromise by remote attackers.
507746
Cupertino, we have a problem Symantec has updated its anti-virus definition files after a duff update falsely identified two open source packages as adware.â¦
402563
(InfoWorld) - Microsoft blamed human error for aÂ Windows Genuine Advantage problem that identified legitimate Windows users as piratesÂ last week. "Nothing more than human error started it all," Alex Kochis, senior product manager for Windows Genuine Advantage at Microsoft wrote on the company blog Tuesday night. New software was accidentally loaded onto the live servers running the system, he said. That ultimately caused the servers to decline activation and validation requests that were good, he wrote. While Microsoft quickly noticed the problem and rolled back the changes within a half hour, the problem continued to affect the validation service, he said. The activation process was fixed in that time frame, he said. The company is implementing some changes to make sure a similar incident doesn't happen again. It is improving monitoring in order to find out sooner if there is a problem, he said. Microsoft is also adding checkpoints that should prevent accidental changes to the servers. Kochis' explanation is fine but the incident is still troubling, said Michael Cherry, an analyst at Directions on Microsoft. "I think it's unsettling for people when it doesn't validate," he said. While it's great that Microsoft has put some new procedures in place, Cherry was surprised that it was even "feasible" for someone to accidentally load the wrong code into the live environment. "It just raises the question of what other things have they not done," he said. In his blog post, Kochis clarified that an existing policy will automatically validate all users if the WGA servers are down but that in this case, the servers weren't down, so that policy didn't kick in. With that policy in place, Cherry wonders why Microsoft didn't just take the servers down while they were diagnosing and fixing the problem so that legitimate users wouldn't continue to have issues. The problem began on Friday evening and lasted through Saturday afternoon. During that time, some users incorrectly failed the validation process, leaving them unable to use certain features including Windows Aero, Windows ReadyBoost, and some features of Windows Defender and Windows Update. Affected users also saw a message in the corner of their screen that said "This copy of Windows is not genuine." WGA has been criticized since its unveiling in 2005. The system, which works for Windows XP and Vista users, is meant to help Microsoft disable software pirates, but some users say it's cumbersome. In addition, Microsoft faces two class action suits that characterize WGA as spyware and cite concerns over how Microsoft uses data it collects about users through the program.
469846
An exploit for PHP's COM objects on the 5.x series has been reported by shinnai - an issue that allows for a bypass of safe_mode and disable_function settings.   The exploit has been published as a PHP file for easy testing on your Windows/PHP installation (it was tested on WinXP Pro SP2 on both the CLI and Apache). No additional modules are needed for this exploit - only the COM functions and a Windows system.   The issue comes from an overflow in the str_repeat function allowing for the execution of whatever applications the developer wants on the remote Windows machine (including the ability to create and remove files and directories). There is no path for this issue currently (should be corrected in the next minor PHP release).
651348
Want to hack Windows? Better get familiar with the Registry first. Here's what you need to know.
657568
On the heels of Microsoft's announcement that it will disable anti-spyware protections on copies of Vista it claims to be counterfeit, the company is under fire for naming the developer of a program that can install adware on user's PCs as one of its Most Valued Professionals.
97191
A Chinese security group has released sample code to exploit two new unpatched flaws in Microsoft Windows. The advisory comes in the week before Christmas, a time when many companies and home users are least prepared to deal with the problems.