Fix for Adobe Flash Player Rendering Issues with IE9

Adobe has released Flash Player 10.3.181.16 for Internet Explorer only.  The update for Internet Explorer addresses an issue where Flash animations were displaying in the left-hand corner of the screen for users of Internet Explorer 9.

The version for other browsers remains at 10.3.181.14.

Note: If you disabled hardware acceleration in Internet Explorer 9 using the instructions on this page, you should re-enable hardware acceleration.

In the event you reverted to a previous version of Flash Player, it is strongly advised that this update be applied as soon as possible as the updated version included critical security updates.

Download

Direct Download for IE users: http://fpdownload.macromedia.com/get/flashplayer/current/install_flash_player_ax.exe

Verify Installation

To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Remembering Those Who Served, Memorial Day 2011

Vietnam Memorial Wall
April 30, 2005
Photograph by Luigi Masu

Memorial Day is a day set aside to remember those who have died in the service of their country.  It is also a time when I remember a very special Canadian who likely knew more about U.S. politics and history than most U.S. citizens. Memorial Day 2007 was his last blog post, reading in part:

"Memorial Day was officially proclaimed on 5 May 1868 by General John Logan, national commander of the Grand Army of the Republic, in his General Order No. 11, and was first observed on 30 May 1868, when flowers were placed on the graves of Union and Confederate soldiers at Arlington National Cemetery. The first state to officially recognize the holiday was New York in 1873. By 1890 it was recognized by all of the northern states. The South refused to acknowledge the day, honoring their dead on separate days until after World War I (when the holiday changed from honoring just those who died fighting in the Civil War to honoring Americans who died fighting in any war). For more history of Memorial Day visit Memorial Day History."

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mac Rogue Remover Tool

The creators of rogue (fake) antivirus programs that have been plaguing Windows users for many years have now migrated to the Mac platform. 

Although Apple is planning a Mac OS X software update that is expected to automatically find and remove Mac Defender malware and its known variants, affected Mac users do not need to wait for the update.  In the meantime, Mac users are advised to consider the following:

1. For Safari users, uncheck the default setting "Open safe files after downloading" on your Mac.
2. In the event you fell for the scam and purchased the fake program, contact your credit card company.
3. Watch for the promised update to be issued by Apple.
4. Install an antivirus software.  (Sophos offers a free antivirus software for Mac home users.)

In the unfortunate event your computer has been infected with one of the rogues, Bleeping Computer to the rescue!  Site owner, Microsoft MVP Lawrence Abrams, has created a tool and removal guides to assist in the removal of many of the known variants of the recently released rogues.  As other variants become available, expect that additional removal guides will be made available. 

• Mac Security:  Mac Security Removal Guide
• Mac Defender:  Mac Defender Removal Guide
• Mac Protector:  Mac Protector Removal Guide
• Mac Guard:  Mac Guard Removal Guide

For background information on the Mac Removal Tool, see Introducing the BleepingComputer Mac Rogue Remover Tool.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Flash Player 10.3 and IE 9 Issues

The critical security update to Adobe Flash Player 10.3 has resulted in SWF content being displayed in the upper left corner of the screen in some cases. 

The issues appear to be limited to Adobe Flash Player 10.3 and Internet Explorer 9.  As a result, Adobe has temporarily disabled the automatic update notification for Flash Player 10.3 and Internet Explorer. 

A hotfix is in the works and a new version is expected to be available next week.  In the meantime, Adobe has provided the following workarounds:

"1. On some systems, you might be able to resolve this issue by updating the Intel HD Graphics drivers.  It has been reported that version 8.15.10.2361 and above do not display this bug.  Unfortunately, some systems might require updates directly from your system manufacturer.  We're working with system manufacturers to make sure they include the latest drivers in future releases.

2. You can disable hardware acceleration in Internet Explorer 9 using the instructions on this page.  Please note that you should re-enable hardware acceleration once this problem has been resolved to enjoy the full benefits of hardware acceleration.

3. Use an alternate browser. All reports indicate that this issue is specific to Internet Explorer 9.  You can use Firefox, Chrome, Safari, Opera, etc. with content designed for Flash Player while this issue is being resolved.

4. You can manually uninstall Flash Player 10.3 and revert back to Flash Player 10.2.  While we always recommend you use the latest Flash Player for security and stability, this will get you back to your previous version."

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Coming Soon: Office 2010 and Sharepoint 2010 SP1

Service Pack 1 for Microsoft Office 2010 and Sharepoint 2010 was announced at TechNet Atlanta.

As of this timing, the service pack is scheduled to be released the end of June.  It will initially be available from both the Download Center and Microsoft Update and will include all language versions.  The service pack will not be included as an Automatic Update until at least 90 days after the initial release.

In addition to including public and cumulative updates, below is a sampling from the Microsoft Office Blog of highlighted changes to be included in SP1. 

• Outlook fixes an issue where “Snooze Time” would not reset between appointments.
• The default behavior for PowerPoint "Use Presenter View" option changed to display the slide show on the secondary monitor.
• Integrated community content in the Access Application Part Gallery.
• Better alignment between Project Server and SharePoint Server browser support.
• Improved backup / restore functionality for SharePoint Server
• The Word Web Application extends printing support to “Edit Mode.”
• Project Professional now synchronizes scheduled tasks with SharePoint task lists.
• Internet Explorer 9 “Native” support for Office Web Applications and SharePoint
• Office Web Applications Support for Chrome
• Inserting Charts into Excel Workbooks using Excel Web Application
• Support for searching PPSX files in Search Server
• Visio Fixes scaling issues and arrowhead rendering errors with SVG export
• Proofing Tools improve spelling suggestions in Canadian English, French, Swedish and European Portuguese.
• Outlook Web Application Attachment Preview (with Exchange Online only)
• Office client suites using “Add Remove Programs” Control Panel, building on our work from Office 2007 SP2

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Ribbon Search Commands for Microsoft Office 2010 and 2007

Microsoft Office has so many formatting and editing features, it is difficult to remember where everything is located.  In addition, many long-time users of Microsoft Office have found the Ribbon confusing.

The Microsoft Office Labs has a solution in the form of a simple add-in called Search Commands.  Search Commands has been available for a while now, but it seems to be a little-known add-in.  Search Commands will help you quickly find the commands you need in Microsoft Office 2007 and 2010 Word, Excel and PowerPoint.


To launch Search Commands, click on the Search Commands tab in Word, Excel and PowerPoint. If you prefer keyboard shortcuts, click the Windows Key + Y combination.

As illustrated in the images below from Office 2010 and Office 2007, the search mechanism is very intuitive.  Merely typing "insert" in the search box yielded the most commonly searched information:

Try it.  You'll like it. 

If you are new to the Ribbon, you may also find the information at Office.com helpful: Office Ribbon Find Commands.

Requirements and Download Information

• Requirements: Windows XP or later. Office 2007 or Office 2010 32- or 64-bit.
• Limitations: English only. Works with Word, Excel and PowerPoint only. 
• Additional Information: Microsoft Office Labs
• Download Link: Download Search Commands

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

WinPatrol 20.5 Update

WinPatrol 2011 has been upgraded to version 20.5.  The upgraded version addresses both a number of long-time requests and also resolves many issues related to 64-bit Windows operating systems.

The updated features and resolved issues at WinPatrol 2011.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Flash and other Products Critical Severity Updates

Adobe released Critical Severity updates to three products and one Important Severity update to another. If you use RoboHelp, Audition or Flash Media Server (FMS), it is strongly recommended that you apply the updates as soon as possible.

Adobe Security Bulletins

• APSB11-09 – Security update available for RoboHelp (Important Severity)
• APSB11-10 – Security update available for Audition (Critical Severity)
• APSB11-11 – Security update available for Flash Media Sever (FMS) (Critical Severity)
• APSB11-12 – Security update available for Flash Player (Critical Severity)

Adobe Flash Update Details

Although, to date, Adobe has not obtained a sample that completes an attack, the identified vulnerabilities could cause the application to crash and potentially allow an attacker to take control of the affected system.

Adobe indicated that there are reports of malware attempting to exploit the CVE-2011-0627 vulnerability in the wild.  The attack is via a Flash (.swf) file embedded in a Microsoft Word (.doc) or Microsoft Excel (.xls) file delivered as an email attachment targeting the Windows platform.

Release date: May 12, 2011
Vulnerability identifier: APSB11-12
CVE number: CVE-2011-0579, CVE-2011-0618, CVE-2011-0619, CVE-2011-0620, CVE-2011-0621, CVE-2011-0622, CVE-2011-0623, CVE-2011-0624, CVE-2011-0625, CVE-2011-0626, CVE-2011-0627
Platform: All Platforms

Standing Instructions

Although Adobe suggests downloading the update from the Adobe Flash Player Download Center or by using the auto-update mechanism within the product when prompted, if you prefer, the direct download links are as follows:

• IE: http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player_ax.exe
• Non-IE (Opera, Firefox etc) http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player.exe

If you use the Adobe Flash Player Download Center, be careful to UNCHECK the box shown below. It is not needed for the Flash Player update.  In addition, any toolbar offered with Adobe products can be unchecked if not wanted.

1 MB

Free McAfee® Security Scan Plus (optional) 

Verify Installation

To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu.

Do this for each browser installed on your computer.

References

• Adobe Security Advisory: Security Update Available for Adobe Flash Player
• Adobe PSIRT Blog: Security updates available for Flash Player, RoboHelp, Audition, and Flash Media Server

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

How to use Hotmail Aliases

Whether shopping online, joining an on-line tech forum, registering your account for on-line bill payment or some other service, a valid e-mail address is required to confirm the account.  Although you can use a plus address for easy management of your email, your primary e-mail address is easily discernible.

For situations where you do not want to use your general e-mail address, you can create an alias.  An alias is particularly useful in situations where the account being registered may result in spam.  All mail sent to alias addresses will be delivered to one Hotmail inbox.

To create an alias

1. In the left pane next to Inbox, click the Tools icon , and then click Create a Hotmail alias. You might need to sign in with your Windows Live ID.
   

   
   
   
   
2. In the dialog box, type an email address, and then click Create an alias.  Note, as in this example, you must select a unique address.
   
   

   

   
   
3. Select your inbox or a new folder for the messages sent to your alias.

To send messages from your new alias, click New to create a message.  Then just click the drop-down next to the Hotmail address to select the address you want to use.

Notes: 

• You cannot use an alias to sign in to Hotmail.  Rather, you need to use your original Hotmail email address and password, not the alias, to sign in to Hotmail.
  
• There is a limit of creating up to five e-mail aliases in your Hotmail account each year.
  
• Use the steps below to delete an alias that is no longer needed:

1. Log in to your primary Hotmail account.  
2. Click Options and select More Options.  
3. Under Managing your account, select Account details (password, aliases, time zone).  
4. Below Other Options, located at the bottom of the Account Overview page, select Your email addresses. 
5. Click Remove next to the alias you wish to delete.

Although Gmail offers the option of using plus addresses, it does not provide the capability of creating aliases.  Conversely, Yahoo! allows the creation of aliases but not plus addresses.  Hotmail provides both features, as well as the ability to manage where the mail is directed.

Additional Topics on Managing Your Hotmail

• Hotmail Security to Protect and Recover Your Account
• Hotmail Security, Common Passwords Blocked
• Hotmail Full-Session HTTPS Encryption
• Hotmail Security, How to Report a Hacked Account
• Link Windows Live IDs in Hotmail
• Use Hotmail to Manage All Your E-Mail Accounts
• Using Hotmail Plus Addresses

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Using Hotmail Plus Addresses

The improvements in Windows Live Hotmail over the years have made it my preference over Gmail and Yahoo! for managing my e-mail.  One little-known feature is the ability to create plus addresses.

Plus addresses provide a simple way to sort, delete or move e-mail messages to specific folders.  .

How to Create a Plus Address

Creating a plus address is as simple as adding a plus sign (+) then a word to your Hotmail address. To create an address specifically for those occasions you register for a newsletter, simply add +newsletter to your address.

For example, if your e-mail address is spring123@live.com, to create a newsletter plus address, you would use spring123+newsletter@live.com when registering for newsletters. 

How to use a plus address

• From your Hotmail inbox, search for email messages sent to the plus address.  From the results, you can delete or move all of the messages to a separate folder.
  

  
  Easily search for messages related to the plus address that you created.  After typing the plus address in the search box, select the option to sort by "to".
  
  
  
  
  
• The next step is to create a rule to automatically manage the newsletters.
  
  

  1. From your Hotmail inbox, click Options, and then click More options.
  2. Under Customizing Hotmail, click Rules for sorting new messages, and click New.  
  3. In this example, a rule is created so all new messages addressed to spring123+newsletter@live.com will be moved to the Newsletter folder. 
  
  

  

Although Gmail allows the use of plus addresses, it lacks the flexibility of Hotmail.  The label feature of Gmail merely provides a way of identifying similarly labeled mail, leaving your inbox cluttered.  Yahoo! does not offer plus addresses.

Additional Topics on Managing Your Hotmail

• Hotmail Security to Protect and Recover Your Account
• Hotmail Security, Common Passwords Blocked
• Hotmail Full-Session HTTPS Encryption
• Hotmail Security, How to Report a Hacked Account
• How to use Hotmail Aliases
• Link Windows Live IDs in Hotmail
• Use Hotmail to Manage All Your E-Mail Accounts

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Facebook User Credentials Exposed

Regardless of the numerous guides to Facebook members on maintaining privacy, caution is thrown to the wind when yet a new Farm-ish game, a cause to support or some other enticing Facebook application comes along.

Unfortunately, it has been discovered by Symantec that in certain cases, Facebook IFRAME applications have inadvertently leaked access tokens to third parties.  According to the analysis completed by Symantec, as of last month there were almost 100,000 applications enabling the leakage of access tokens. 

The referenced "access token" leakage means that the keys containing permissions; such as, accessing your friend's list, posting on your wall, and seeing any personal information you allowed the application have likely been provided to advertisers or analytic programs.

According to the Facebook Developer Blog, steps are being taken to transition Facebook applications from the old Facebook authentication system and HTTP to OAuth 2.0.  (OAuth 2.0 is a process of providing third-party applications limited access and HTTPS.)

Recommendations

1. Change your Facebook password since this step automatically clears all previously issued access tokens.
   
2. Turn on Security Browsing (HTTPS):

• Navigate to your Account Settings page. 
• Click the "Change" link next to Account Security
• Check the box under "Secure Browsing (https)" and then click the "Save" button.

References

• Developer Roadmap Update: Moving to OAuth 2.0 + HTTPS
• Facebook Applications Accidentally Leaking Access to Third Parties

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft May 2011 Security Bulletin Release

Microsoft released two (2) security bulletins, one (1) rated Critical and other is rated Important.  Both bulletins relate to remote code execution.

Below is the description of the bulletins, as described in the MSRC Blog:

"MS11-035 (WINS or Windows Internet Name Server): This security update resolves a privately reported vulnerability in the Windows Internet Name Service (WINS). The vulnerability could allow remote code execution if a user received specially crafted malware on an affected system running the WINS service. By default, WINS is not installed on any affected operating system. Only customers who manually install this component are affected by this issue and will be offered the update.

MS11-036 (PowerPoint): This security update resolves two privately reported vulnerabilities in Microsoft PowerPoint. The vulnerabilities could allow remote code execution if a user opens a specially crafted malicious PowerPoint file. An attacker who successfully exploited either of these vulnerabilities could gain the same user rights as a logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. "

Support

The following additional information is provided in the Security Bulletin:

• The affected software listed have been tested to determine which versions are affected. Other versions are past their support life cycle. To determine the support life cycle for your software version, visit Microsoft Support Lifecycle.
  
• Customers in the U.S. and Canada can receive technical support from Security Support or 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates. For more information about available support options, see Microsoft Help and Support.
• International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit International Help and Support.

References

• MSRC: May 2011 Security Bulletin Release
• TechNet: Microsoft Security Bulletin Summary for May 2011

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Surprisingly Little Information on Lavasoft Acquisition

It certainly appears as though the acquisition of Lavasoft AB by Lulu Software is being buried under a rug.  Although I first learned about the acquisition over a month ago, it actually occurred in January.

According to the announcement by Mannheimer Swartling, Solaria Fund acquires software business from Lavasoft:

"Solaria Fund acquires software business from Lavasoft (2011-01-18)

Solaria Fund has acquired the anti-spyware and antivirus software business from Lavasoft.

Lavasoft AB, a privately-held company headquartered in Gothenburg, Sweden, is one of the leading actors in the anti-spyware and antivirus segment.

Solaria Fund was advised by Mannheimer Swartling in the acquisition. The firm’s team was led by Johan Ljungberg, primarily assisted by Emma Olnäs Fors and Teresia Mårdh."

Adding to the confusion is the notice buried at the end of the BusinessWeek description of Lavasoft is the additional information:

"As of January 18, 2011, Lavasoft AB operates as a subsidiary of Lulu Software."

Similarly, the BusinessWeek entry for Lulu Software merely indicates "Merger/Acquisition, Lavasoft AB, January 18, 2011".

From what I can ascertain, Lulu Software and Solaria Fund are, if not one and the same, are closely held, with ties to Upclick.com.

• Eric Gareau, CEO at Lulu Software (located in Montreal, Canada)
• Michael Dadoun, Principal at Solaria Fund (located in Montreal, Canada) and Co-Founder at Upclick.com (also Montreal, Canada)
• Calin Udrea, Marketing Director at Lavasoft, formerly Director of Marketing at UpClick

What is most interesting in this change is that there has not been a Lavasoft Press Release.  In fact, it has been rather quiet in Lava-Land with only one press report to date in 2011 and only a half-dozen blog posts to date in 2011. 

Could the silence be related to the less than stellar Web of Trust ratings of Lulu Software's Fixio PC Cleaner Software?

• WOT Lulu Software Scorecard: lulusoftware.com
• WOT Fixio PC Cleaner Scorecard: fixio-pc-cleaner.en.softonic.com

Since it has been well over six years since I used Ad-Aware, perhaps others have also switched to a different anti-malware software program.  Even the Support Forum is woefully quiet, with the current online list showing 0 members logged on to the Forums. 

Baseless speculation aside, the question remains:  Why all the silence about the acquisition?

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Exploitability Index Changes and May Security Bulletin Advance Notice

A welcome change after the huge update in April, on Tuesday, May 10, Microsoft is scheduled to release two security bulletins.  The first addresses a critical vulnerability in Windows.  The second, identified as Important, addresses two vulnerabilities in Microsoft Office.  Both bulletins relate to remote code execution.

As explained in Exploitability Index Improvements Now Offer Additional Guidance:

"As of this month, we will split out the Exploitability Index into a rating for the most recent version of the software, and an aggregate rating for all older versions. In the scenario above, the rating for Windows 7 could be “2" whereas the rating for all other platforms would be "1”. This more accurately reflects risk to customers that keep their environment updated with the latest product releases."

An additional feature to the Exploitability Index will be an assessment of the Denial of Service risk.  Complete details are available in the above-referenced article.


References:

• MSRC: Exploitability Index Improvements & Advance Notification Service for May 2011 Bulletin Release
• TechNet: Microsoft Security Bulletin Advance Notification for May 2011

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...