"Computer Security Day is an annual event that is observed worldwide. It was started in 1988 to help raise awareness of computer related security issues. The goal of Computer Security Day is to remind people to protect their computers and information. Officially, Computer Security Day is November 30th. However, some some organizations choose to have functions on the next business day or week if CSD falls on a weekend."
The theme for Computer Security Day is "A Good Defense". Be a responsible and safe web surfer by ensuring that your defenses are up -- as indicated in the Security Garden header,
"The best way to protect your garden is to fence it in. The same applies to your computer."
The tips provided during October (linked above) provide ways you can be proactive in protecting your information. Particularly with so many people doing online shopping, see SafeShopping.org.
With all the craziness at the malls on Black Friday, I am glad that I stuck with my normal routine. If you were out, I hope you made some good buys.
The next big event is Cyber Monday -- the Monday after Thanksgiving when most Americans return to work after the long Thanksgiving Holiday weekend. Before broadband connections were widespread, people were taking advantage of the high-speed connection at the office that they did not have at home.
The CyberMonday website has a collection of holiday deals from more than 500 merchants. All of Shop.org's proceeds from CyberMonday.com support the Ray Greenly Scholarship Fund.
If you're among the fifty lucky winners of the HP Magic Giveaway, your Holiday shopping will certainly be simplified. I know there would be several excited members of my family. Several of the blogs published their rules today, including GearLive.
The origin of Thanksgiving most likely stems from the harvest festivals that are traditional in many areas of the world. In the United States, it is probably the one holiday that brings more families together than any other and has been celebrated since colonial days.
Whether you are alone or with friends and family this Thanksgiving Day, I send wishes to all Security Garden readers for a very Happy Thanksgiving.
Norman Rockwell painting, "Freedom From Want" Dated 3/6/1943 From Curtis Publishing
Remember - "A day without laughter is a day wasted." May the wind sing to you and the sun rise in your heart...
The day after Thanksgiving, referred to as Black Friday, traditionally kicks off the Holiday shopping season in the United States. Stores compete with one another, providing limited-time specials of popular items.
With the economy in a precarious state, many people are forecasting lean Holiday shopping this year. However, I suspect that the Black Friday specials will coax many shoppers either into the stores or to make online purchases.
If you are doing your shopping online, whether it be for Black Friday or Cyber Monday specials, please use common sense and shop online safely. Whether you are a new or long-time reader of Security Garden, don't be a victim. Stick to the sites you know to be safe for online shopping trips and check out the tips in the references below.
Beta release: 0.4.154.25 includes feature and bug fixes as well as the following Security Update:
"Security Issues
This release fixes an issue with downloaded HTML files being able to read other files on your computer and send them to sites on the Internet. We now prevent local files from connecting to the network with XMLHttpRequest() and also prompt you to confirm a download if it is an HTML file.
Severity: Moderate. If a user could be enticed to open a downloaded HTML file, this flaw could be exploited to send arbitrary files to an attacker. [Originally fixed in 154.18]"
Reminder: It is not advisable to use Beta software on production systems.
Remember - "A day without laughter is a day wasted." May the wind sing to you and the sun rise in your heart...
I do not frequently write about hardware. However, I really am enjoying my Zune 8. With each change Microsoft has made to the Zune since the original release, it just keeps getting better. A Zune would certainly make a nice Holiday gift, whether for yourself, a family member or that special someone.
Zune 3.1 Update
The 3.1 update includes additional games, a change to Zune Social and what is described as "improvements to the software"-- i.e., improved play count reporting and content synchronization between the Zune software and the Zune device
The new games are Checkers, the ever popular Sudoku and Space Battle. In addition, Texas Hold'em was updated with a new multiplayer mode and single player difficulty levels.
To get the new update, launch the Zune software on your computer and click settings > check for updates.
Zune Pass Changes
In a major change to Zune Pass, subscribers can keep 10 tracks from Zune Marketplace each month. Not only can you keep the 10 tracks (even if you do not renew your Zune Pass) but you can also back them up to DVD/CD.
Of note, approximately ninety percent (90%) of the 4+ million tracks in Zune Marketplace are available as DRM-free MP3s. Zune Marketplace includes MP3s from Sony BMG, Universal Music Group, and Warner Music Group, as well as indie distributors IODA and The Orchard.
Linked below is a helpful FAQ on the new Zune Pass "keep it forever" model, published by Microsoft MVP Harvey Chute.
Price Drop
Zune Insider “officially” announced lower prices for U.S. and Canadian markets at Zune Originals and all major retail partners. See Price Moves for Zune 3.0 for information.
Attention Canadians:
One last point for my Canadian neighbors is that BestBuy in Canada is offering an online promotion if you purchase a Zune 16 online, you receive a Zune 4 for free. See From BestBuy.ca: if you buy a Zune 16, you get a Zune 4 (for free!)
Julie Amero's nightmare is finally over. As reported by Rick Green:
The unbelievable story of Julie Amero concluded quietly Friday afternoon at Superior Court in Norwich, with the state of Connecticut dropping four felony pornography charges.
Julie pleaded guilty to a misdemeanor, received a $100 charge and the revocation of her Connecticut teaching credentials.
Alex Eckelberry -- the White Knight who played an integral role in not only bringing Julie's situation to the attention of the public but also in leading the group who volunteered to assist Julie -- said that Julie had no plans on ever teaching in Connecticut again anyway. Who can blame her after being misaligned, mistreated and, in my opinion, not only falsely accused, but also wrongfully and shamefully persecuted for something she was not responsible for causing.
Finally, Julie and her family will have something to be thankful for on Thanksgiving Day.
I am sure a lot of people who decided to hold off on the upgrade from Windows XP to Windows Vista were now looking to waiting until 2009 when Windows 7 is RTM. As Ed Bott clearly explains in No upgrades from XP to Windows 7?
"If that’s your strategy, you probably need to be aware that, at least in the current not-a-beta release, upgrades from XP to Win7 are blocked. (I don’t know whether this restriction will be in the final edition as well, but I bet it is.) You can do a clean install only, with all your old Windows files going to a Windows.old directory and none of your files and settings transferred (you can, however, use Windows Easy Transfer to save settings first and restore them later).
So the compatibility issues you’re ignoring right now aren’t going to go away. If you have apps or hardware drivers that only work on XP and aren’t compatible with Vista, you’re going to have those same issues with Windows 7, which isn’t going to magically fix anything."
Remember - "A day without laughter is a day wasted." May the wind sing to you and the sun rise in your heart...
Microsoft announced today that the company is discontinuing Windows Live OneCare (WLOC), although support will continue for current WLOC subscribers until the subscriptions expire. WLOC is an all-in-one suite that includes a number of non-security features that most subscribers ignored (i.e., printer sharing and automated PC tune-up).
I am wondering if the indication in the PressPass announcement that "Morro" will be a stand-alone download providing malware protection for the Windows XP, Windows Vista and Windows 7 operating systems implies that Morro will supplement or replace Windows Defender. Since Morro won't be available until the second half of 2009 (perhaps introduced with Windows 7?)
Code-named “Morro,” this streamlined solution will be available in the second half of 2009 and will provide comprehensive protection from malware including viruses, spyware, rootkits and trojans. This new solution, to be offered at no charge to consumers, will be architected for a smaller footprint that will use fewer computing resources, making it ideal for low-bandwidth scenarios or less powerful PCs. . . .
“Because uptake of standard anti-malware is low around the world, particularly in developing nations, the availability of basic protection for anyone who wants it is all the more important,” said Roger Kay, founder and president of Endpoint Technologies Associates. “By offering such basic protection at no charge to the consumer, Microsoft is promoting a safer environment for PCs, service providers and e-commerce itself, since it is through unprotected PCs that the worst threats are introduced to the system as a whole.”
“Morro” will be available as a stand-alone download and offer malware protection for the Windows XP, Windows Vista and Windows 7 operating systems. When used in conjunction with the ongoing security and privacy enhancements of Windows and Internet Explorer, this new solution will offer consumers a robust, no-cost security solution to help protect against the majority of online threats.
I have not been a fan of the ZoneAlarm firewall by Check Point Software since the Ask Toolbar was included as a pre-checked optionand disguised as ZoneAlarm Spy Blocker.That aside, I have been unpleasantly surprised lately seeing a large number of computers without a software firewall. Without a doubt, the computers have all been heavily infected.
Perhaps those folks -- and yourself as well if you need a software firewall -- will take advantage of this one-day offer for a free one year subscription for Zone Alarm Pro.
"On Tuesday, Nov. 18, Check Point Software will offer the ZoneAlarm Pro software package for free for 24 hours, in celebration of Check Point's 15th anniversary, a company spokeswoman said Friday.
ZoneAlarm Pro, which contains a firewall, antispyware, and ID protection service (including credit monitoring) normally costs $39.95. The download location for the free ZoneAlarm Pro package will go live at 6 AM PDT on Tuesday morning."
The download URL is expected to go live at 6 AM PDT.
Remember - "A day without laughter is a day wasted." May the wind sing to you and the sun rise in your heart...
On Saturday I reported the additional problems AVG was having with their updated definitions (See AVG Causes More Problems.)
Following AVG's incorrect detection of a core Windows component (user32.dll) as a trojan, apparently AVG is making an attempt to make amends to affected AVG customers (both those who use the free version as well as paid subscribers). According to PCMag and The Inquirer, AVG will be providing a free year of service to affected users.
(Hat Tip: Cel) From PCMag:
"Essentially, the offer covers a free year of AVG 8.0 service, or a free upgrade for AVG 7.5 users. The upgrade also includes users of the free AVG antivirus service. Not all customers will receive the license, just "affected users," AVG said. The company said it will contact affected customers beginning Nov. 24, and advise them of how to obtain the free year of service."
No software is perfect and certainly cannot protect the computer from infections caused by the person behind the keyboard. However, considering the flood of logs by AVG users that I have been dealing with the past two weeks of computers infected with "Trojan Horse Agent 4.E" and the recent problems AVG users have faced, I shall stick with other vendors.
I stopped including AVG when listing "free for personal use antivirus software" in March when Grisoft added the "Security Toolbar". The list is growing on why I continue to leave AVG off the list:
Granted, false/positives occur but after the crippling false detection of user32.dll I would have expected closer scrutiny. It certainly makes it appear that Grisoft doesn't test their updates on even a basic setup.
For the F/P of user32.dll, see the following entries on the AVG FAQ page:
In case you are not able to run your Windows XP operating system after AVG 8.0 virus definition update, it may be caused by a false positive on a specific "user32.dll" system file. The file was moved to the AVG Virus Vault and deleted. Therefore it is not possible to start Windows. Please follow the steps below to rectify this situation: In case you do not have Windows XP installation CD with the latest updates, we strongly recommend you to use our fix tool instead. The mentioned fix tool can be found in FAQ 1575. WARNING! There is a high probability of incompatibility with other system files (for example with winsrv.dll) if the latest installation CD is not used. This can also cause inabitity to start operating system. 1. Please insert the Windows XP installation CD and boot computer from this CD (if you do not have the installation CD please follow steps mentioned in our FAQ 1575). 2. Choose and run Recovery Console. 3. Choose Windows operating system you want to repair. 4. Disable AVG Resident Shield from loading. You can disable loading services/drivers with "disable" command, i.e. you have to type the following commands (some of them might not be present in all AVG editions): disable avgMfx86 disable avgMfa86 disable avgldx86 disable avglda86 5. Restore the User32.dll file from the Windows XP installation CD (instead "D:" use letter of your CD-ROM drive): expand D:\i386\user32.dl_ c:\windows\system32\ In case the command fails, please use the following command to rename original user32.dll and repeat the command above. ren user32.dll user32.bak 6. Restart computer and boot Windows normally. 7. In order to re-enable the AVG Resident Shield services we recommend that you perform the AVG repair installation as follows: - Download the latest AVG installation package from the following webpage and save it on your hard disk: http://www.avg.com/download?prd=aav (AVG Anti-Virus 8.0) http://www.avg.com/download?prd=ais (AVG Internet Security 8.0) http://www.avg.com/download?prd=avf (AVG Anti-Virus plus Firewall 8.0) - When you are prompted, please do not open this file directly from the internet, but click the Save button and choose a location, where the installation file should be stored. We recommend saving the file to the Desktop. - Restart your computer. - Locate the downloaded AVG installation file (it has a four color square icon and its name starts with AVG_...) and launch the installation by double-clicking on it. - Follow the installation wizard. - When prompted, please select the Repair installation option. - Enter your license number when you are asked (we recommend that you use the copy&paste* method to enter this license number into the installation form). - Restart your computer and update AVG.
Whether you call it Veteran's Day, Armistice Day or Remembrance Day, November 11th is a time to put aside politics and pay tribute to all who died for their country. As I did last year, I am republishing Canuk's last tribute. The comment he posted provides one example of why he was a special person:
"I too "will remember your friends who never had a full life", while thanking you and your comrades who have served with pride, honesty and honour.
Despite anyone's thoughts of the current conflict in Iraq - opposition or agreement, we must always remember that these brave young men and women are fighting for a cause they also may or may not agree with. The huge difference between them and us is that they are putting their lives on the line 24/7 while we sit in our homes in comfort, using the freedom of speech previous warriors won for us, and for that they deserve our love, respect, and support."
Another special person, Bill Pytlovany, is honoring Veterans by providing a special discount on WinPatrol this week. See Veteran's Day is Special All Week Long.
LEST WE FORGET
We Shall Keep the Faithby Moira Michael, November 1918
Oh! you who sleep in Flanders Fields, Sleep sweet - to rise anew! We caught the torch you threw And holding high, we keep the Faith With All who died. We cherish, too, the poppy red That grows on fields where valor led; It seems to signal to the skies That blood of heroes never dies, But lends a lustre to the red Of the flower that blooms above the dead In Flanders Fields. And now the Torch and Poppy Red We wear in honor of our dead. Fear not that ye have died for naught; We'll teach the lesson that ye wrought In Flanders Fields. Flags courtesy of3DFlags.com
If you are like me and adamantly dislike toolbars, be watchful of the pre-checked option for the MSN Toolbar the next time you update Sun Microsystems Java™ Runtime Environment (JRE).
Personally, I have not installed Java on my home computer and have done just fine without it.
Microsoft Corp. today announced a search distribution deal with Sun Microsystems Inc. to offer the MSN Toolbar, powered by Microsoft Live Search, to U.S.-based Internet Explorer users when they download the Java™ Runtime Environment (JRE™), effective as of today.
Through this agreement, Internet Explorer users downloading Sun’s JRE will have the option to download the MSN Toolbar and have one-click access to Live Search features, as well as news, entertainment, sports and more from the MSN network and direct access to Windows Live Hotmail and Windows Live Messenger.
“This agreement with Sun Microsystems is another important milestone in our strategy to secure broad-scale distribution for our search offering, enabling millions more people to experience the benefits of Live Search,” said Yusuf Mehdi, senior vice president of the Online Audience Business at Microsoft. “With the vast array of Java software-based Web applications that are downloaded every month, this deal will expose Live Search to millions more Internet users and drive increased volume for our search advertisers.”
With more than 6.5 million Java software developers around the globe, Java is one of the most widely available and popular software platforms. It is already present on 91 percent of Internet-connected PCs worldwide. The Java Runtime Environment is one of the highest-volume consumer downloads on the Web, with tens of millions of downloads each month from http://java.com.
“With over 800 million Java desktop users around the world, our goal is to provide Java users with compelling and immersive business and consumer solutions powered by Java technology and value-added solutions from world-class software partners,” said Rich Green, executive vice president of Software at Sun Microsystems. “Our customers expect top-quality products when they choose to download technology from Sun, and we are confident that they will find great value in both Microsoft’s MSN toolbar and Live Search.”
Volume 5 of the Microsoft Security Intelligence Report (SIR), covering January through June, 2008, has been published. The SIR report trends in software vulnerability disclosures, trends in the malicious and potentially unwanted software landscape, and provides an update on trends in software vulnerability exploits.
The report is summarized at the Malware Protection Center and the Executive Summary or full version of the SIR are available at the following Microsoft Download pages:
"Microsoft vulnerabilities accounted for 42% of the total vulnerabilities on Windows XP for browser based attacks; however, on Windows Vista-based machines the proportion of vulnerabilities attacked in Microsoft software dropped to just 6% of the total. This highlights our not only our continued security investments in the browser but also that attackers are focusing more and more on the applications that run in the browser.
The infection rate for Windows Vista is significantly lower than Windows XP, regardless of service pack levels. In addition, 64-bit versions of XP and Vista have lower infection rates than their 32-bit counterparts.
The higher the level of service pack a machine runs, the lower the rate of infection. This is consistent across client and server platforms, across all versions. Clearly, keeping up to date with the latest service pack levels and security patches is beneficial from a security perspective. While we have always thought this to be true, having a data point to prove it is great."
If the complete SIR is more detail than you are ready to digest, I think you will enjoy The Bret and Vinny Show - SIR Volume 5 . The dialog between Bret Arsenault (GM US National Security Team) and Vinny Gullotto (GM Microsoft Malware Protection Center) is "easy listening" and presents a nice discussion of the trends and findings in the latest SIR. I highly recommend it. In fact, why not tune in now?
If you need to upgrade your word processing program, Microsoft is still offering the Ultimate Steal. Microsoft Office Ultimate is only $59.95 to eligible students.
To be elibible:
You must have a valid e-mail address at an educational institution ending with the domain suffix .EDU (ie, leina@contoso.edu) OR have a valid email address at one of the educational institutions listed here.
AND
You must be a student at a U.S. educational institution and must be actively enrolled in at least 0.5 course credit and be able to provide proof of enrollment upon request.
These additional products are also available to eligible students:
Office Visio Professional 2007 $55.95
Office Languages Packs 2007 $9.95
Windows Vista Ultimate Upgrade w/SP1 $64.95
Remember - "A day without laughter is a day wasted." May the wind sing to you and the sun rise in your heart...
Christopher Budd provided an update at the MSRC Blog on MS08-067 and Security Advisory 958963 yesterday. Microsoft has not seen significant changes since issuing the Security Advisory. Importantly, they are continuing to see "strong, rapid and wide deployments of the security update worldwide."
Bill Pytlovany is back from PDC2008 and has a pre-Beta version of Windows 7 installed on his test machine. Based on his post, I could not help but get the impression that he is a bit surprised that WinPatrol works without any problems on the latest Microsoft operating system.
Just like a "Timex keeps on ticking", Scotty the Windows Watchdog keeps on protecting from Windows 95 through and including Windows 7!
