It's the second Tuesday of October and that means it's time to update Windows. There are 6 critical updates this time, along with several other ones to protect your computer. Details of what's in this month's updates can be read at the Microsoft Security Bulletin for October.
Go to Windowsupdate.com to get them and protect your computer.
Google has laid speculation to rest — it is buying YouTube for US$1.65 billion in a stock transaction. YouTube operates a wildly popular Web site showing original videos in a range from amateurish to professional. It will continue to operate independently after the Google acquisition “to preserve its successful brand and passionate community,”
From Macworld.
Svchost.exe can, and usually does, run several instances of itself at any given time, each instance running several associated services. How do you find out what these "services" are?
Posted on the Langa Blog. I've been so busy, I didn't notice Fred Langa has a blog now. Anyways, a good and brief explanation on why you see svchost.exe more than once in your process list on XP and Windows 2000.
read more | digg story
Microsoft have released an advance notification for the updates that are due to be released next Tuesday.
Don't forget to prepare for the updates as I've outlined in an earlier entry - How To Prepare for Patch Tuesday.
On 10 October 2006 Microsoft is planning to release:Microsoft Security Bulletin Advance Notification
Security Updates
Microsoft Windows Malicious Software Removal Tool
- Six Microsoft Security Bulletins affecting Microsoft Windows. The highest Maximum Severity rating for these is Critical. These updates will be detectable using the Microsoft Baseline Security Analyzer. Some of these updates will require a restart.
- Four Microsoft Security Bulletins affecting Microsoft Office. The highest Maximum Severity rating for these is Critical. These updates will be detectable using the Microsoft Baseline Security Analyzer. These updates may require a restart.
- One Microsoft Security Bulletin affecting Microsoft .NET Framework. The highest Maximum Severity rating for this is Moderate. These updates will be detectable using the Microsoft Baseline Security Analyzer and the Enterprise Scan Tool. These updates may require a restart.
Non-security High Priority updates on MU, WU, WSUS and SUS
- Microsoft will release an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services and the Download Center.
Note that this tool will NOT be distributed using Software Update Services (SUS).
- Microsoft will release No NON-SECURITY High-Priority Updates for Windows on Windows Update (WU) and Software Update Services (SUS).
- Microsoft will release two NON-SECURITY High-Priority Updates on Microsoft Update (MU) and Windows Server Update Services (WSUS).
Microsoft's MVP program supposedly rewards "outstanding members of Microsoft's peer-to-peer communities, and is based on the past year's contributions those members make in those communities online and offline." So why have they given the creator of Messenger Plus an MVP Award, when he bundles the notorious LOP Adware in with his creation?
read more | digg story
Spyware Doctor has been updated with new spyware definitions.
Latest Database Version: 3.0567 0
Intelli-Signatures: 71,240
Spyware Doctor protects your computer in 3 ways. First, it has the On guard monitor which watches places spyware will change your computer settings. By alerting you, Spyware Doctor gives you the option to not allow unwanted programs on your computer. Second, Spyware Doctor has a feature called Immunize that completely blocks known spyware from even installing. Third, spyware Doctor has a large detection database that removes spyware that has gotten onto your computer. I have used Spyware Doctor in tests against SpyAxe and SpyFalcon. It completely removed the those two. A restart of the computer and resetting my wallpaper was the hardest part.
A free scan is available from the Spyware Doctor Homepage:
http://www.pctools.com/spyware-doctor/
New Intelli-Signatures:
3.0567 0 - Backdoor.Antilam.GEN, Trojan.Clicker.Aditer, Worm.Womble
3.0566 0 - Trojan.PSW.QQDragon
3.0565 1 - Backdoor.Augodor.GEN, Drive Cleaner, Popupwithcast, Worm.Licat
Extended Intelli-Signatures:
3.0567 0 - Backdoor.Delf.EE, Backdoor.Tilebot.AF, Mirar, Regifast, SpyAxe, Trojan.Banker, Trojan.Downloader.Small.CML, Trojan.Dropper.Small.AEK, Trojan.FavAdd.AE, Trojan.Popuper, Trojan.PSW.Hangame, Trojan.PWSteal.Lineage, YourEnhancement
3.0566 0 - Advertising, Backdoor.Tilebot.AF, Block-Checker, CasinoClient, Drive Cleaner, EliteBar, Known Bad Sites, PurityScan, Trojan.Busky, Trojan.Dialer.BY, Trojan.Goldun, Trojan.Proxy.Small.BO, YourEnhancement
3.0565 1 - Backdoor.Assasin, HideWindows, Known Bad Sites, Mirar, SpyAxe, Trojan.Downloader.Agent.XQ, Trojan.Downloader.Zlob.PJ, Trojan.PSW.QQRob.U, VX2.Look2Me
Tool Update releases:
Popup Blocker 3.6.0.2083
General Information:
Updates are posted 5 times per week on average.
Updates are installed by running Spyware Doctors' Smart Update feature.
Microsoft has a patch or fix for a critical problem in the way Windows handles the so called VML Exploit. Without getting this patch, spyware, trojans, and viruses can be automatically installed on your computer from web pages and spam emails. The update is small and does not need to restart your computer to take effect. I strongly recommend everyone go to Windows Update now to get this patch. Normally, Microsoft only releases patches on the second Tuesday of the month. By releasing this fix early, this shows how serious this problem is.
The VML Exploit ( for Vector Markup Language) is described briefly in the update:Typical download size: 250 KB , less than 1 minute
A security issue has been identified in the way Vector Markup Language (VML) is handled that could allow an attacker to compromise a computer running Microsoft Windows and gain control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.
Keeping your computer up to date is important, but this update is really important. Here is a rather technical explanation of what the VML Exploit is and what it does. An example of what you might get in a spam email that uses this exploit from the Sunbelt Blog.
First of all.. what is the VML exploit?
First discovered by Sunbelt, the VML exploit allows a malicious website to install software without your knowledge or permission. The exploit uses a bug in VML in Internet Explorer to overflow a buffer and inject shellcode. Microsoft has been informed and we are hoping for a patch to be released in the October security update release.
Until then, the only way to protect your self from this exploit is to unregister the VML.dll or upgrade to IE7
Yes you did read correctly, IE7 is immune to this vulnerability. Fellow MVP, Sandi Hardmeier has written about this in her blog Spyware Sucks, not only are there some great screen shots but also links to further information.
If you are unable or unwilling to upgrade to IE7 then Bleeping Computer have recently posted an excellent tutorial on how to disable and unregister this dll.
Update:
Microsoft have released a security update today to address this issue..
Security Update for Windows XP (KB925486)
Date last published: 9/26/2006
Typical download size: 250 KB
A security issue has been identified in the way Vector Markup Language (VML) is handled that could allow an attacker to compromise a computer running Microsoft Windows and gain control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.
CounterSpy 1.5 latest update definition is 414
CounterSpy is able to catch more spyware than almost every other utility on the market because the CounterSpy threat database (with the signatures of every spyware and malware utility we can identify) is constantly updated. Our researchers constantly look for ways to improve our spyware searching database so that it catches all spyware that could potentially be on your system. Keyloggers, spyware cookies, remote access trojans (backdoors), and more are all identified.
Spyware Doctor has been updated with new spyware definitions.
Latest Database Version: 3.0565 0
Intelli-Signatures: 71,110
Spyware Doctor protects your computer in 3 ways. First, it has the On guard monitor which watches places spyware will change your computer settings. By alerting you, Spyware Doctor gives you the option to not allow unwanted programs on your computer. Second, Spyware Doctor has a feature called Immunize that completely blocks known spyware from even installing. Third, spyware Doctor has a large detection database that removes spyware that has gotten onto your computer. I have used Spyware Doctor in tests against SpyAxe and SpyFalcon. It completely removed the those two. A restart of the computer and resetting my wallpaper was the hardest part.
A free scan is available from the Spyware Doctor Homepage:
http://www.pctools.com/spyware-doctor/
New Intelli-Signatures:
3.0565 0 - Backdoor.Augodor.GEN, Drive Cleaner, Popupwithcast, Worm.Licat
3.0564 0 - Backdoor.Bancodor.GEN, Trojan.Clicker.VB.FQ
3.0563 0 - Trojan.Busky, VirusBurst
Extended Intelli-Signatures:
3.0565 0 - Backdoor.Assasin, HideWindows, Known Bad Sites, Mirar, SpyAxe, Trojan.Downloader.Agent.XQ, Trojan.Downloader.Zlob.PJ, Trojan.PSW.QQRob.U, VX2.Look2Me
3.0564 0 - Backdoor.Graybird.GEN, Backdoor.LegMir.BZ, Common Components Unrelated, I-Search Desktop Search Toolbar, Maxifiles, MediaTickets, PurityScan, Trojan.Agent.HT, Trojan.Downloader.Agent.AWM, Trojan.Downloader.Banload.M, Trojan.Downloader.Small.CYH, Trojan.Downloader.Zlob.GEN, Trojan.Dropper.MultiJoiner, Trojan.Mailbot, Trojan.Popuper, Trojan.PSW.Hangame, Worm.Spybot, Zeno Search Assistant
3.0563 0 - Backdoor.Berbew.N, Backdoor.Robobot, BookedSpace, Common Components for Trojans, Enbrowser, Maxifiles, PurityScan, TargetSavers, Trojan.Downloader.Zlob.GEN, Trojan.Popuper, Trojan.Proxy.Webber.O
Deleted Intelli-Signatures:
3.0564 0 - WhenU.Search
General Information:
Updates are posted 5 times per week on average.
Updates are installed by running Spyware Doctors' Smart Update feature.
The latest update for Ad Aware is SE1R124 19.09.2006
New Definitions:
========================
Adware.Agent +3
Adware.Baidubar +5
Adware.LetsCool +6
Adware.LoopAd
Adware.MyToolbar +4
Adware.Podcast +5
Adware.Soso +8
Adware.WeirWeb +2
Win32.Hacktool.Craagle
Win32.Trojan.IZD
Updated Definitions:
========================
Adware.180Solutions.SeekmoSearchAssistant +3
Adware.Adhelper
Adware.CasClient +9
Adware.DesktopMedia +9
Adware.MMSAssist
Adware.Sidesearch +2
Dogpile Toolbar +3
Elitum.ElitebarBHO +3
MegaSearch Toolbar
NetPal
RedSwoosh +4
SahAgent +3
Win32.Trojan.Downloader +15
Win32.Trojandownloader.Zlob +5
Win32.Trojan-PSW.Lineage
Winfixer +2
Virtumonde +9
VirusBurst +4
Zango +9
ZSearch +11
Ad Aware can be downloaded from the official Lavasoft Ad Aware page.
Spy Sweeper latest update
Program Version 5.0.7. (Build 1608)
Spyware definition: version 766
Updated September 22nd,2006
Protection against 150,734 spyware traces.
Spy Sweeper protects your computer in two ways. First, it uses what is called shields to monitor places on your computer that spyware will likely change. By alerting you, you can prevent spyware from even getting on your computer. The second way is the large threat database. With this update, there are over 140,000 known spyware threats that Spy Sweeper detects and removes, should anything undesirable get onto your computer.
Spy Sweeper available from http://www.webroot.com/consumer/products/spysweeper/
Ewido Antispyware
Note that all future updates the we give for Ewido are for the newer version, which has been renamed to Ewido Antispyware. The new version doesn't have a numer for the update. You can tell if you have the most recent update by the number of threats in the database, however.
Date of Update: September 23rd, 2006
Known threats in database: 440,074
Ewido Antimalware scans your computer to clean any spyware that may have gotten on your computer. Ewido also has active protection to prevent spyware from getting on to your computer.
•Hijackers and Spyware
-Secure surfing in the Internet without fear of annoying changes of the start page of your browser, tracking cookies and advertising bars.
•Worms
-Nobody should receive e-mails in your name with malicious files in the appendix anymore.
•Dialers
-Security against all kinds of dialers. No fear when receiving the next phone bill.
•Trojans and Keyloggers
-No chance for thieves to steal your bank data and personal sensitive information by tapped Internet connections, remote controlled webcams or secret keyboard recordings.
Product Info & Download: Ewido Anti-Spyware
