Welcome to the Security Garden, where everything is coming up roses.
The best way to protect your garden is to fence it in. The same applies to your computer.
Get computer security news and information, help, tips and more at the Security Garden.
Scotty, the Windows Watchdog, has changed over the years to keep up with the changes in the Windows operating systems he monitors. In addition to fixing a couple of bugs with 64-bit operating systems, with the release of WinPatrol 2011, Scotty is monitoring additional information in Active Tasks.
Whether it be a malware infection or a recently installed program that is causing problems, the additional information now available in Active Tasks and the corresponding Recent tab will be very helpful in narrowing the source of the problem.
To view the active DLL's which are connected to running Tasks, check "Show All Active Files". Click the First Detected column to sort by the date WinPatrol detected the addition of the file.
(Click image to view full size)
In the case of the .dll highlighted above, it is a legitimate file. However, in the event the file was causing problems, locate the file on the Recent tab and select Kill Task. On the other hand, if research showed that that the file was in fact malware, right-click the selected file and select "Delete on Reboot".
(Click image to view full size)
Long-time users of WinPatrol know the benefits of WinPatrol PLUS, which include the following features, not available in the free version:
Patch Tuesday was hit hard with not only Microsoft security updates but also critical updates released by Adobe for Adobe Reader/Acrobat, Adobe Flash Player and Adobe Shockwave Player. Also released were important updates for Adobe's ColdFusion product.
The updates are for all platforms and are for remote code execution and cross-site scripting (XSS). Details are in the respective security bulletins.
Security updates available for Adobe Reader and Acrobat
Critical vulnerabilities have been identified in Adobe Reader X (10.0) for Windows and Macintosh; Adobe Reader 9.4.1 and earlier versions for Windows, Macintosh and UNIX; and Adobe Acrobat X (10.0) and earlier versions for Windows and Macintosh. These vulnerabilities could cause the application to crash and potentially allow an attacker to take control of the affected system. Risk for Adobe Reader X users is significantly lower, as none of these issues bypass Protected Mode mitigations.
Acrobat and Reader users can update to the latest version using the built-in updater, by clicking “Help” and then “Check for Updates.” The Adobe Reader update for Windows is available from here.
Critical vulnerabilities have been identified in Adobe Flash Player 10.1.102.64 and earlier versions for Windows, Macintosh, Linux, and Solaris. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.
Adobe recommends users of Adobe Flash Player 10.1.102.64 and earlier versions for Windows, Macintosh, Linux, and Solaris update to Adobe Flash Player 10.2.152.26.
Although Adobe suggests downloading the update from the Adobe Flash Player Download Center or by using the auto-update mechanism within the product when prompted, if you prefer, the direct download links are as follows:
If you use the Adobe Flash Player Download Center, be careful to UNCHECK the box shown below. It is not needed for the Flash Player update.
1 MB
In addition, any toolbar offered with Adobe products can be unchecked if not wanted.
Verify Installation:
To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu.
Do this for each browser installed on your computer.
You may also want to verify the version of Adobe AIR installed on your system in the Adobe AIR TechNote.
Critical vulnerabilities have been identified in Adobe Shockwave Player 11.5.9.615 and earlier
versions on the Windows and Macintosh operating systems. These vulnerabilities could allow an
attacker, who successfully exploits these vulnerabilities, to run malicious code on the affected
system.
Download for Windows: http://www.adobe.com/shockwave/download/
Note: Please remember to uncheck any unwanted 3rd party toolbars/programs during installation. Also please do not confuse this with Adobe Flash Player which is a different program.
How to disable the auto-update setting in Shockwave: http://kb2.adobe.com/cps/166/tn_16683.html
(This must be set every time Shockwave Player is updated if you do not want auto-updating.)
Microsoft released twelve (12) security bulletins addressing 22 issues in Microsoft Windows, Internet Explorer, Office, Visual Studio, and IIS. Three bulletins are rated Critical, the remaining nine are rated Important.
The updates addressed two Security Advisories: Security Advisory 2490606 (public vulnerability affecting Windows Graphics Rendering Engine) and Security Advisory 2488013 (public vulnerability affecting Internet Explorer).
Important Note: If you installed Microsoft Fix it Solutions for two either or both of the two Security Advisories, they need to be disabled prior to installing the updates. As noted in Microsoft Fix it Available for Security Advisory 2488013, it is particularly important that the Microsoft Fix it be disabled.
Also included is an update to Security Advisory 967940, "Update for Windows Autorun,". As explained in the MSRC Blog, the purpose of the update is
"to change how earlier versions of Windows handle security when reading "non-shiny" storage media. ("Shiny" storage media would include CD-ROMs and DVDs.) Windows 7 already disables Autorun for devices such as USB thumb drives, which prevents malware lurking on such drives from loading itself onto computers without user interaction. With the change to the Advisory, earlier versions of Windows that receive their updates automatically via Windows Update "AutoUpdate" will now gain that security-conscious functionality as well. We believe this is a huge step towards combating one of the most prevalent infection vectors used by malware such as Conficker."
Microsoft also released an updated Malicious Software Removal Tool this month.
The three critical updates are described as follows:
MS11-003. This bulletin resolves three critical-level and moderate-level vulnerabilities affecting all versions of Internet Explorer. Due to existing mitigations, this bulletin is only rated at Moderate severity for all versions of Windows Server, has an Exploitability Index rating of 1, and will deprecate Security Advisory 2488013.
MS11-006. This bulletin addresses one Critical-level vulnerability affecting Windows XP, Vista, Server 2003, and Server 2008. Newer versions of our operating system are unaffected. The vulnerability involves Windows Shell Graphics and could if exploited lead to remote code execution. This has an Exploitability Index rating of 1 and will deprecate Security Advisory 2490606 which we released on January 4th. Since that time, we have not seen any attacks against this issue.
MS11-007. This bulletin addresses one privately reported vulnerability affecting all supported versions of Windows and involving the OpenType Compact Font Driver. It's rated Critical for Windows Vista, Windows 7, Server 2008 and Server 2008 R2; it's rated Important for Windows XP and Server 2003. This issue has an Exploitability Index rating of 2.
For complete details, see the references listed below.
