Accelerated Adobe Reader/Acrobat Security Update

Adobe released an out-of-cycle security update to address the critical security issues in Adobe Reader and Adobe Acrobat.  In addition to addressing CVE-2010-3654 noted in Security Advisory APSA10-05 and CVE-2010-4091 referenced in the Adobe PSIRT blog ("Potential issue in Adobe Reader"), these updates also incorporate the Adobe Flash Player update as noted in Security Bulletin APSB10-26.

Release date: November 16, 2010
Vulnerability identifier: APSB10-28
CVE numbers: CVE-2010-3654, CVE-2010-4091
Platform: All Platforms

Edit Note:  I have been advised by my friend Randy that the Adobe Reader update re-introduces "Reader_SL.exe".  It is located in \%Program Files%\Adobe\Reader\ and is not required.  See the SystemLookUp description.


Acrobat and Reader users can update to the latest version, v. 9.4.1 using the built-in updater, by clicking “Help” and then “Check for Updates.” The Adobe Reader update for Windows is available from here. As usual, the caution to UNCHECK the box shown below. Neither the scan nor any offered toolbar are needed for the update! 

Free McAfee® Security Scan Plus (optional)

Free Google Toolbar (optional)

Search Google from any web page, block pop-ups
Learn more | Privacy policy | License

Free McAfee® Security Scan Plus (optional)

The next quarterly security update for Adobe Reader and Acrobat is scheduled for February 8, 2011.


References:

• Adobe Product Security Incident Response Team (PSIRT) Blog: Security updates released for Adobe Reader and Acrobat (APSB10-28)
• Security Bulletin (APSB10-28)

Clubhouse Tags: Clubhouse, Windows, Security, Updates, Vulnerabilities, Information,

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Flash Player Critical Security Update

An Adobe Security Bulletin has been posted to address a critical security issue in Adobe Flash Player.  As described in the Adobe PSIRT Blog: Security update available for Adobe Flash Player:

"Today, a Security Bulletin has been posted to address a critical security issue (CVE-2010-2884) in Adobe Flash Player. This Security Bulletin affects Adobe Flash Player 10.1.82.76 and earlier versions for Windows, Macintosh, Linux, and Solaris, and Adobe Flash Player 10.1.92.10 for Android.  Adobe recommends users apply the update for their product installation. This addresses the issue first mentioned in Security Advisory APSA10-03. "

Although Adobe suggests downloading the upate from the Adobe Flash Player Download Center or by using the auto-update mechanism within the product when prompted, if you prefer, the direct download links are as follows:

• IE: http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player_ax.exe
• Non-IE (Opera, Firefox etc) http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player.exe

If you use the Adobe Flash Player Download Center, be careful to UNCHECK the box shown below. It is not needed for the Flash Player update!

1 MB

Free McAfee® Security Scan Plus (optional)

Free Google Toolbar (optional)

Search Google from any web page, block pop-ups
Learn more | Privacy policy | License

Free McAfee® Security Scan Plus (optional)

Verify Installation:
To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu.

Do this for each browser installed on your computer.

Verify the version of Adobe AIR installed on your system in the Adobe AIR TechNote.

Details from Security Bulletin APSB10-03:

Release date: September 13, 2010
Last updated: September 20, 2010
Vulnerability identifier: APSA10-03
CVE number: CVE-2010-2884
Platform: All

Clubhouse Tags: Clubhouse, Microsoft, Windows, Security, Updates, Vulnerabilities, Information,

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft: Fix it For Me Now!

It does not matter how something on a person's computer broke. It could be the result of a malware infection, a conflict with a third-party application, or self-help that backfired. Regardless of the source of the problem, we all want Microsoft to Fix it and to Fix it Now.

Although Microsoft has long provided Knowledge Base articles with detailed instructions for repairing problems such as those mentioned above, the instructions generally involve registry edits -- which is understandably something the average home user generally will shy away from doing.

Along comes Microsoft Fix it, a tool to automate those fixes that you want now, relieving you from worrying about messing up a registry edit that could result in your computer in worse condition than before you attempted the fix.

The Fix it Team has created a wide range of fixes covering problems in Windows, Internet Explorer, Microsoft Office programs such as Excel and Word, Outlook, Windows Media Player, Zune and a whole lot more. Many of those fixes are a result of Windows Error Reporting (WER) where people like you and I allow the submission of crash reports to Microsoft. By submitting those reports, Microsoft Product Support Reports (MPSReports) is able to analyze the results and fixes for repeated problems are added.

To check that Windows Error Reporting (WER) is enabled, do the following:

Windows Vista:

Click Control Panel > System and Maintenance > Problem Reports and Solutions > Change settings > Advanced settings > Select "Automatically check for solutions".

Windows XP:

Click Start > Right-click My Computer > Properties > Advanced Tab > Error Reporting.

If you are not sure where to start, you can try Microsoft Automated Troubleshooting Services (Microsoft ATS) to detect problems on your machine and automatically fix any common problems.

The Fix it Team has provided multiple resources to assist you in locating a Fix it solution:

1. Fix it for me blog
2. Fix it Gadget (Download link)
3. Fix it Solutions Page
4. Microsoft Fix it Solutions Center

Listed below are a few of my favorite fixes for problems I frequently see in the support forums.


Windows Fixes

Enable Windows Firewall

Error message when you use the Windows Update or Microsoft Update Web site to install updates: "0x8007000B"

How do I enable User Account Control in Windows Vista

How do I reset the Windows Update settings?

How to reset Internet Protocol (TCP/IP)

Internet Explorer

Ask Toolbar that causes a crash in Windows Internet Explorer 6 and 7

How do I move the Standard toolbar to a location that is above the Address bar in Internet Explorer 7 or Internet Explorer 8?

Reset Internet Explorer settings

Re-Register the Internet Explorer .dll file

Uninstall or remove Internet Explorer 8 - restores your previous version.

Other Examples

Default line spacing and default paragraph spacing in Word 2007 differ from the default spacing in earlier versions of Word

How to move the Windows Taskbar from its default position or reset it to its default position

Reset Windows Media Player Associations

The next time you need a solution for a problem, let Microsoft Fix it for you.



Related Posts: Microsoft FixIt Label


Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft Listens! Windows 7 UAC Changes

Within hours of Jon DeVaan's posting the Update on UAC in the Engineering Windows 7 blog, a joint posting by Jon and Steven Sinofsky was published announcing two changes to the RC (Release Candidate) of Windows 7:

1. The UAC Control Panel will run in a high integrity process, which requires elevation.
2. Changing the UAC setting (adjusting the slider) will prompt for confirmation.

As described in UAC Feedback and Follow-Up:

"The first change was a bug fix and we actually have a couple of others similar to that—this is a beta still, even if many of us are running it full time. The second change is due directly to the feedback we’re seeing. This “inconsistency” in the model is exactly the path we’re taking. The way we‘re going to think about this that the UAC setting is something like a password, and to change your password you need to enter your old password."

I was not concerned about the second fix to Windows 7 because "Scotty is on Patrol" and would have advised me if something attempted to change the UAC setting on my computer. However, not all Windows users have WinPatrol watching over them (Hmmm, why not?) so I am glad that Microsoft listens.

Thank you, Windows 7 Team.


Engineering Windows 7 UAC Posts:

1. User Account Control
2. User Account Control (UAC) – quick update
3. Update on UAC
4. UAC Feedback and Follow-Up

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Vista UAC PM Interview

Learn how User Account Control (UAC) helps Windows Vista users work as a standard user from Austin Wilson. Vista UAC PM Interview:

Austin Wilson has been working with the product team on UAC well before it was even created in Windows Vista and gives us some insight into why it is the way it is. He clears up what UAC really is and speaks about the parental control capabilities with UAC.

The video is almost 20 minutes long but presented in an easy-to-understand, informal manner and well worth giving it a listen.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Understanding UAC in Windows Vista

There has been a lot written about UAC (User Account Control) in Windows Vista. I have read many forum posts and blog comments where users have claimed UAC as an excuse for not wanting to upgrade to Windows Vista.

What computer users need to understand is that UAC is not a detriment but rather another tool that Microsoft has provided for our use with the Windows Vista operating system. Personally, I wish to know what is going on with my computer. I want to control what is installed, where and when. That is one reason why I have WinPatrol installed on my computer. It is also the reason I advise keeping UAC activated. You can prevent installation of a drive-by install of a malicious software through the use of UAC. I would find it very reassuring to receive the following UAC prompt:

An unidentified program wants access to your computer.

Another example of an advantage to UAC is that you can create standard user accounts for your children. By providing your children with standard user accounts, you will be able to control granting permission for them to install software on the computer.

Charlene Shepard is a writer on the Windows user assistance team at Microsoft, specializing in Windows security and networking. She has prepared an excellent Windows Help article on User Account Control, Understanding User Account Control in Windows Vista.

For locating at a later date, the article has, of course, been added to Windows Vista Bookmarks. Look under Features and Tutorials.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Windows Vista Experiences

It was a couple weeks ago already that I reported The "WOW" Finally Arrived At My Door! At the time, I initially planned on installing WinPatrol and ESET NOD32 and start transferring files. After a short time thinking it over, I decided that I didn't want to stay with the OEM operating system (Windows Vista Home Premium) since OEM is all I've ever had.

I really wanted to give Windows Vista Ultimate (64 bit) a go. Unfortunately, there is very little competition in my area for broadband connections, with one DSL and one cable option. Without the competition, the service providers charge top dollar. So, at this point, I am staying with dialup. Thus the problem -- no 64 bit driver for the modem. That meant going with 32 bit.

Installation was a breeze -- easier than some software programs I've installed in the past. Microsoft has definitely perfected the process. The first thing I did after completing the install was as planned. I installed WinPatrol and ESET NOD32, then set up my dial-up connection to start downloading updates.

One of the really nice features of Windows Vista is the enhanced Security Center. I really like the interface, particularly being able to check Installed Updates (located at Control Panel\Programs\Programs and Features\Installed Updates).

Since UAC (User Account Control) is such a "hot topic" among so many people, I'll add my two cents. Personally, I like it. I have always wanted to know what is happening on my computer so for me, it is no problem taking the extra second to acknowledge the UAC prompts when I am removing a folder or copying a file to a different location.

I am still experimenting as well as discovering "must have" files from my old XP box. My first reaction, however, is that Windows Vista is much more intuitive than previous Windows operating systems. So far, I like it a lot!

Vista, Windows Calendar and UAC Tutorials

I delayed adding the three-part "Windows Calendar" tutorial preapred by Vista4Beginners because I had not decided on the bookmark category to place the links. Now that I have created the new Windows Mail page, it occurred to me that calendar would be a nice accompanyment.

As a result, the new bookmark page has been renamed "Windows Mail and Calendar" where you can find The complete guide to the Windows Calendar by Vista4Beginners bookmarked. I also added several other Vista Windows Calendar bookmarks that you may find useful.

Today, Vista4Beginners added another helpful tutorial, "Manager User Accounts". The tutorial illustrates how simple it is to create a new user account, change the account type, password, and more. This tutorial, along with several others on UAC and other security features of Windows Vista, can be found bookmarked at Vista Security Features.

VistaRewired Bookmarked

Edit Note: When I originally drafted this post, I debated whether I wanted to include a link with instructions on how to disable Vista UAC. At the time I decided to go ahead. After reading George Ou's comment today, I have to admit that I agree with him and have removed that link.

"If Vista UAC really bothers you that much, you can turn Vista UAC off and simply accept the risk of running with full administrative privileges. I’m not going to link to any tutorials on disabling UAC because anyone who can’t figure out how to turn off UAC probably shouldn’t be turning it off in the first place. I’m sorry if that sounds blunt; but I don’t want to give any advice that endangers anyone’s PC."

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

I was catching up the postings at Windows Vista Magazine which led me to a nice tutorial on how to Disable unnecessary services the quick and easy way at VistaRewired.

There is a lot more at VistaRewired, which is why the site has been bookmarked in Reviews and Collections. The individual tutorials are linked below. Perhaps when time allows (!), I will break those links down further into suitable bookmark pages. In the meantime, there is a lot of information at VistaRewired:

• Improve productivity with a 3D virtual desktop
• Ten must-read tips and tutorials for Vista
• Prepare a System Health Report
• How to log in to your PC when you have forgotten your password
• Get windows to automatically log you in each time you reboot
• Know when to defragment your drive
• Perform a Clean Install with a Vista Upgrade Disc
• Run XP in Vista and vice-versa
• Run your non-Vista software o1n Vista
• Disable unnecessary services the quick and easy way
• How to resize a partition in Windows Vista
• Disabling User Account Control

Vista and UAC (User Account Control)

Allow me to repeat Jesper Johansson's statement in Confusion about Vista Features: What UAC Really Is with regard to Vista's UAC (User Account Control):

"UAC does not, nor is it intended to, stop malware."

What UAC does do is enable running a computer with Windows Vista installed as a standard user. The result of this is important. By following the recommendation to keep UAC running, the computer is significantly less vulnerable since currently most malware requires administrator privileges.

Does running as a standard user protect against the computer operator allowing installations? Absolutely not. However, it is certainly hoped that the average computer user will recognize the difference between an unexpected request for elevated privilege and a request when intentionally installing software.

For in depth look at User Account Control for Windows Vista, tune in to the Channel 9 interview of Jon Schwartz, UAC Architect, and Chris Corio, UAC Technical Program Manager, where they tackle UAC from various angles:

1) What problems does UAC attempt to solve?
2) How does UAC actually work?
3) Why did we implement UAC UI to be so aggressive, from a user experience point of view?
4) How will UAC evolve?

UAC - What. How. Why.

Vista UAC Triggers

Ed Bott responded to a reader's question about UAC Account triggers with a quote from his recently published book, Windows Vista Inside Out. The question came from Ed's earlier post, which I had been planning on pointing out anyway. So, while you're at it, read the articles and the comments in both of Ed's articles, linked below. Great stuff, Ed!

UAC Triggers:

The types of actions that require elevation to administrator status (and therefore display a UAC elevation prompt) include those that make changes to system-wide settings or to files in %SystemRoot% or %ProgramFiles%. Among the actions that require elevation:

• Installing and uninstalling applications
• Installing device drivers
• Installing ActiveX controls
• Installing Windows Updates
• Changing settings for Windows Firewall
• Changing UAC settings
• Configuring Windows Update
• Adding or removing user accounts
• Changing a user’s account type
• Configuring Parental Controls
• Running Task Scheduler
• Restoring backed-up system files
• Viewing or changing another user’s folders and files

Within Windows Vista, you can identify in advance many actions that require elevation. A shield icon next to a button or link indicates that a UAC prompt will appear.

References:

• Why you need to be discriminating with those Vista tips

• What triggers User Account Control prompts?