Sensationalist Press Got it WRONG! Microsoft Does Not Recommend Two Antivirus Programs!

A recent article published by PC Pro has taken wings and is being quoted in numerous stories implying that a second antivirus program is needed when using Microsoft Security Essentials.  The article states,

"Now, Microsoft has said it sees Security Essentials as merely the first layer of protection, advising customers to use additional, third-party antivirus - although the company stressed that wasn't because the product wasn't good enough to stand on its own." (bold added)

The above statement by PC Pro is an obvious misinterpretation of Holly Stewart's comment (bold added), 

"It’s not as efficient to have one kind of weapon," she said. "Like anything you must have that diversity. It’s a weakness to just have one."

Why PC Pro is Wrong

Starting with the obvious, Microsoft Security Essentials on Windows 7, or earlier and Windows Defender on Windows 8 are disabled when a third-party antivirus software is installed.  Thus, an active second antivirus program cannot be run along side Microsoft Security Essentials or Windows Defender.

As clearly stated in this Microsoft Malware Protection Center help topic,

"It’s not a good idea to run other antivirus or antispyware products at the same time as Microsoft Security Essentials or Windows Defender.

Using more than one real-time security product can affect your PC performance. You might also get an error code when you try to update or install, such as 0x80070643."

The use of the word "weapon" by Holly Stewart in the above quote does not mean a second antivirus software, rather, as has long been recommended by the security community, a layered approach of another weapon is needed.

In addition to one up-to-date antivirus software, it is also critical to maintain updated third-party applications such as Adobe products and Oracle Java and install Microsoft security updates.

Along with "safe surfing", having one or two secondary security applications, such as my favorite Malwarebytes Antimalware and WinPatrol to supplement the work of your antivirus software program is generally recommended.

Microsoft Strategy Works!  

As illustrated in the Microsoft Malware Protection Center report, Evaluating our protection performance and capabilities, 99.9% of computers using Microsoft real-time protection reported no infections on the average day of August, 2013.  With results like that, it is clear that the change in focus by Microsoft to prevalent threats is obviously working.

Thus, PC Pro, Microsoft Security Essentials is not designed to be at the bottom of the antivirus rankings.  It is designed to target prevalent threats to consumer's computers, as illustrated in the change log for 1.159.819.0, released today.

Update:  Microsoft published a response to the "misinterpretation" by PC Pro and the other authors who added to it.  The Microsoft article is referenced below as is an article by Leo Notenboom, who contacted Holly Stewart.  

• MMPC Blog: Our commitment to Microsoft antimalware 
• Ask Leo: Do I Need to Stop Using Microsoft Security Essentials?

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Security Advisory 2887505 and Microsoft Fix it

Microsoft released Security Advisory 2887505 which relates to an issue with Internet Explorer.

It is important to note that there are a limited number of targeted attacks which are specifically directed at Internet Explorer 8 and 9. The issue, however, could potentially affect all supported versions of IE.

As described by Dustin Childs in the below-referenced MSRC Blog post,

"This issue could allow remote code execution if an affected system browses to a website containing malicious content directed towards the specific browser type. This would typically occur when an attacker compromises the security of trusted websites regularly frequented, or convinces someone to click on a link in an email or instant message."

Mitigations

Microsoft has made available a Fix it solution for users of Internet Explorer.  Additional mitigations include the following advice, also from the MSRC Blog post:

• Set Internet and local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
  This will help prevent exploitation but may affect usability; therefore, trusted sites should be added to the Internet Explorer Trusted Sites zone to minimize disruption.
• Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and local intranet security zones
  This will help prevent exploitation but can affect usability, so trusted sites should be added to the Internet Explorer Trusted Sites zone to minimize disruption.

Below are the links to both apply and uninstall the Fix it solution.  Note:  The Fix it solution applies only 32-bit versions of Internet Explorer.
 

Apply Fix it	Uninstall Fix it
Microsoft Fix it 51001	Microsoft Fix it 51002

Another option is to install the Enhanced Mitigation Experience Toolkit (EMET), described in the "workarounds" section of the Tech Net Advisory.

If you have Windows Vista or Windows 7 installed, you should have updated to IE9 or IE10.  In the event you haven't, it is strongly advised that you update!

References:

• Microsoft KB Article 2887505: Microsoft Security Advisory: Vulnerability in Internet Explorer could allow remote code execution
• MSRC: Microsoft Releases Security Advisory 2887505
• Security Research & Defense: CVE-2013-3893: Fix it workaround available
• Tech Net Advisory: Microsoft Security Advisory (2887505): Vulnerability in Internet Explorer Could Allow Remote Code Execution

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Firefox 24.0 Released With Critical Security Updates

Mozilla sent Firefox Version 24.0 to the release channel.  At the the time of this posting, there is no indication of security fixes included.  An update will be made if or when that information has been provided.

Update:  The security fixes included in version 24.0 have finally been posted.  It is advised that this update be installed ASAP.

Version 24.0 includes seventeen security updates of which seven are critical, four high, and six moderate.
 

Fixed in Firefox 24

MFSA 2013-92 GC hazard with default compartments and frame chain restoration
MFSA 2013-91 User-defined properties on DOM proxies get the wrong "this" object
MFSA 2013-90 Memory corruption involving scrolling
MFSA 2013-89 Buffer overflow with multi-column, lists, and floats
MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes
MFSA 2013-87 Shared object library loading from writable location
MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers
MFSA 2013-85 Uninitialized data in IonMonkey
MFSA 2013-84 Same-origin bypass through symbolic links
MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification
MFSA 2013-82 Calling scope for new Javascript objects can lead to memory corruption
MFSA 2013-81 Use-after-free with select element
MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed
MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning
MFSA 2013-78 Integer overflow in ANGLE library
MFSA 2013-77 Improper state in HTML5 Tree Builder with templates
MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9)

What’s New

• NEW -- Support for new scrollbar style in Mac OS X 10.7 and newer
• NEW -- Implemented Close tabs to the right
• NEW -- Social: Ability to tear-off chat windows to view separately by simply dragging them out
• CHANGED -- Accessibility related improvements on using pinned tabs (see 577727)
• CHANGED -- Removed support for Revocation Lists feature (see 867465)
• CHANGED -- Performance improvements on New Tab Page loads (see 791670)
• FIXED -- Replace fixed-ratio audio resampler in webrtc.org capture code with Speex resampler and eliminate pseudo-44000Hz rate ( see 886886)
• FIXED -- 24.0: Security fixes can be found here

Update

To get the update now, select "Help" from the Firefox menu at the upper left of the browser window, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu.

If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Mozilla Firefox Release Notes
• Bug Fixes 

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...