Zero Day For IE7 Being used in the wild.

It looks like IE7 patches are being used right now in the wild.  According to TrendMicro:

HTML_DLOADER.AS exploits the CVE-2009-0075 vulnerability, which is already addressed by the MS09-002 security patch released last week. On an unpatched system though, successful exploitation by HTML_DLOADER.AS downloads a backdoor detected as BKDR_AGENT.XZMS.

[Image from TrendMicro Blog]

As you can see this this can be very bad for the companies who wait a while.  Internet Explorer is still being used 1 out of 4 users and I see it it all the time on my stats.   The Good news is this isn’t as hard to get rid as the Conflicker but should be taken serious because the writers might start to want to get even more malicious and make it even harder.

This is the next step to prevent yourself from getting caught with your pants down so to speak, you need to patch all systems that have internet access.  I still like the Autopatcher because it will do the job with very little input from the user.   It also makes it easier for people to patch big systems.  You should also consider installing some Free Anti-virus software to help protect the systems you do have.

Microsoft Keynote CES 2009

Some Key topics talk about in this Keynotes are:

Windows 7 — Lighter, Faster, and Reliability. Windows 7 Should boot quicker and faster, and enables cool new interface touch.

Windows 7 — Beta will be available Worldwide on January 9, 2009 and will be available for download on MSDN and Technet.  Also it will be available at : http://www.microsoft.com/windows/windows-7 For those who want to download it from Microsoft directly.

Windows Live Essentials — Windows live Messenger, Mail, and Photo Gallery works with Windows XP, VISTA, and Windows 7. It is available for download worldwide. Dell will also be putting this on their consumer and small business computers.

Windows Mobile — 11 Different Mobile phones.

Verizon Mobile –  Windows Live Search will be available through Verizon and it’s a partnership with Microsoft.

Demo of Windows 7, Live, and Mobile:

Windows 7 will have Windows touch and be able to use net books with Windows 7.

Windows 7 has been designed with the Touch DNA in mind.

Windows Mobile demo with an Panoramic display.

Windows Live Demo –  Various things they discuss here including Photo’s and Silver light.

Windows XBOX:

Figuring out the Email-Worm Win32.Zafi.b

This is another just I just saw on the web and wanted to talk about what this little Worm does and what it’s known Aliases:

Email-Worm.Win32.Zafi.b (Kaspersky Lab) is also known as: I-Worm.Zafi.b (Kaspersky Lab), W32/Zafi.b@MM (McAfee), W32.Erkez.B@mm (Symantec), Win32.Hazafi.30720 (Doctor Web), W32/Zafi-B (Sophos), Win32/Zafi.B@mm (RAV), PE_ZAFI.B (Trend Micro), Worm/Zafi.B (H+BEDV), W32/Zafi.B@mm (FRISK), Win32:Zafi-B (ALWIL), I-Worm/Zafi.B (Grisoft), Win32.Zafi.B@mm (SOFTWIN), Worm.Zafi.B (ClamAV), W32/Zafi.B.worm (Panda), Win32/Zafi.B (Eset)

This worm spreads via the Internet as an attachment to infected messages, and also via local and file-sharing networks.
It is written in Assembler, and packed using FSG. It is 12800 bytes in packed form, and 33292 in unpacked form.

This Worm seems to be running through email and file sharing sites, One thing it tries to do is stop the process and deletes:
fvprotect.exe
winlogon.exe
jammer2nd.exe
services.exe

It attempts to detect antivirus program files on the computer and overwrite them with a copy of itself.

It also attempts to conduct DoS attacks on the following sites:

www.2f.hu
www.parlament.hu
www.virusbuster.hu
www.virushirado.hu

Fix Shutdown Problems in Vista!

In the Patch Tuesday update, Microsoft quietly released the patch to fix Windows Vista machine shut problems. This patch should of came sooner.

KB957388

Update for Windows Server 2008 and Windows Vista

Install this update to resolve a set of known application compatibility issues with Windows Server 2008. After you install this item, you may have to restart your computer.

This was not a critical update and it seems to resolve so many issues with compatibility.  One thing it seemed to fix on my system has been the shutdown time.  It is now quite fast, it would normally take me 2 to 3 mins to shutdown, now it does it in less than a Minute.   So if you’ve not installed this update please install it soon.   I would like to know if people are seeing the same thing I am.   I’ve found a great resource on fixing it if you are still having problem, it talks about how to check your system performance. Although this is been doing it lately with these programs not loaded or even running, they still seem to cause problems so now I get the feeling it has to do with legacy programs.  This should fix most of the problem with older programs.

Upcoming Patch Tuesday

I wanted to get prepared for the updates for this Tuesday and I thought I’d go through them and list what Microsoft said about each.   These are what’s been said on Technet and I am sure there will be more.   Each one of these don’t look to serious but I will post Tuesday if there is anything I’ve missed on this post.   As you might know this is not set in stone but just the direction of Microsoft for this Months Release.

KB955839

Update for Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP

Install this update to resolve an issue that is caused by revised daylight saving time laws in many countries. This update enables your computer to automatically adjust the computer clock on the correct date in 2008. After you install this item, you may have to restart your computer. This update is provided to you and licensed under the Windows Server 2008 License Terms.

KB957388

Update for Windows Server 2008 and Windows Vista

Install this update to resolve a set of known application compatibility issues with Windows Server 2008. After you install this item, you may have to restart your computer.

Is this Windows 7?

As you can see that looks to be the final release of the start screen. In the past they haven’t change the start screen, it looks to be really polished and ready for use with Windows 7. If anything, I think the boot screen will be permanent and definitely not temporary. On a Side note, I found this video as well:

macromedia.com/go/getflashplayer” flashvars=”c=v&v=60e5f8c6-09f3-4a09-bac0-355b8a7b7dcc&ifs=true&fr=shared&mkt=en-US”>oembed>Video: Windows 7 Demo 1

This video I almost suspect is the release they did at the Professional Developers Conference and is probably going to have the beta in hand. Although I could be wrong this looks to be almost like Vista? Why is Microsoft trying to make Vista turn into Windows 7, probably due to the fact that Vista had such a rotten launch they are hoping people will see Windows 7 as if Windows Vista didn’t even exist.

I also found one more little Video that looks to be promising, it’s called Windows 7 Super bar. This little Video looks convincingly like this will be kept in Windows 7 but you know how Microsoft is on beta’s. Any how, Here’s this one:

Windows 7 Super Bar from Paul Jenkins on Vimeo.

Vista To release Service Pack 2 in April 2009

Some sources are reporting that Vista SP2 will be out in April.   According to Engadget they claim TechARP is a bunch of Malaysian Kids that like to boast about how they broke the Vista SP1 and XP SP3 release schedules to the world.  They claim though that Vista Release candidate is to be out around February.Microsoft has indicated that this SP3 will include Windows Search 4, Bluetooth 2.1 wireless support, faster resume from sleep when a wireless connection has been broken and support for Blu-ray.   I personally think it will include some of Windows 7 features to better get people accustomed to Windows 7 when they come out.

Although this is speculation and no hard evidence I think it has some merit due to the fact that Microsoft has admitted in the past that Vista was a big Letdown.  I don’t think they can any more to damage than they have already done.   If anything Windows 7 will be a easy Success if they pull it off in the right way!!!  Although with WIndows 7 be leaked online there is no telling what will happen. I am sure what ever happens will be interesting to say the least!!!

Microsoft issues Vista patches out of Monthly Patch Cycle!

Microsoft issues Out of cycle patch for Vista.   These patches are as Followed:

Kb957321

An update rollup is available for the Microsoft Windows Imaging Component (WIC) in Windows Vista or in Windows Server 2008. This update rollup resolves the problems that are documented in the following articles in the Microsoft Knowledge Base:

954708 An update to add support for the serialization of complex Extensible Metadata Platform (XMP) data types in the Windows Imaging Component

945060 There may be inconsistencies in the Extensible Metadata Platform (XMP) and Exchangeable Image File (EXIF) values for an image file in Windows Vista and in Windows XP

KB959108

The Windows Portable Device (WPD) API collects and transfers Software Quality Metrics (SQM) data to Microsoft servers. The SQM data is collected only on an opt-in basis through the Microsoft Customer Experience Improvement Program. An update is available that disables the collection and transfer of SQL data to Microsoft servers.

This update affects Windows Vista-based computers, Windows Vista Service Pack 1 (SP1)-based computers, and Windows Server 2008-based computers that are in the Microsoft Windows Media Player Customer Experience Improvement Program.

Microsoft kills a fake antivirus tool from 994,061 computers!

According to Arstechnica and I’ll quote:

Win32/FakeSecSen has gone by various names, including Micro Antivirus 2009, MS Antivirus, Spyware Preventer, Vista Antivirus 2008, Advanced Antivirus, System Antivirus 2008, Ultimate Antivirus 2008, Windows Antivirus, XPert Antivirus, Power Antivirus, and Ultra Antivirus 2009. Furthermore, it is skinnable, so each of these variants has a different GUI, although the basic functionality is the same: bother users with warnings of malware until they pay up.

The Microsoft Malware Protection Center recently released some data on how the removal tool performed this month: FakeSecSen was removed from 994,061 machines. That number isn’t the highest Microsoft has recorded before, and the number of removals depends on which malware Microsoft adds each month and how widespread it is.

[via Arstechnica]

This seemed to of happened this month with the usual Windows update.  If you haven’t updated your system just yet you should.   This troublesome fake virus seems to have been killed  from several systems.  This could effectively make it harder for these guys who ever designed this program to make money.  I hope microsoft does even more virus removals in next month.  If you still want to try to get rid of these viruses don’t forget to check out my tips on Virus removal.