Furth and Fortune blog by Will Murray

I wrote a new post on Allogro titled “Vista Quick Launch icon locations change after restart“. It explains how to fix a problem where the icons in my Quick Launch toolbar in Windows Vista were rearranged into alphabetical order after every restart and the toolbar was resized, taking up most of the Taskbar. This fixes a similar problem in Windows XP, too.

Tags: Windows, Windows Vista, Windows XP

Summary

Threat Level: Critical Zero-Day Vulnerability
This threat is currently active and spreading in the wild. Most Windows-based computers, even if fully up-to-date with all the official Microsoft patches, are vulnerable right now unless certain actions are taken to protect yourself (see below).

What it does: Various websites, including advertising sites that generate advertisements appearing on trusted websites, become infected. These sites use a specific type of attack to slip through your computer’s security, leaving a big hole for your computer to be further attacked. Since some versions of Outlook and Outlook Express use Internet Explorer to display some types of e-mail, you can become infected just by displaying infected e-mails you receive.

What stops it: You can configure certain settings on your computer that will make it so the malicious software cannot run on your computer. Most of Microsoft’s workarounds may cause a few legitimate websites to incorrectly display within Internet Explorer. An unofficial workaround does not cause that problem, but it only works for people using Windows XP with Service Pack 2. An official patch is scheduled to eliminate the problem in a few weeks; an unofficial patch is available now. A good, up-to-date antivirus software package should also detect the malicious software; however, it is a good idea to check that no viruses have disabled your antivirus software before relying upon it to protect you.

Affected Software (as reported by Microsoft):

• Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1 and Service Pack 2
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
• Microsoft Windows Server 2003 with SP1 for Itanium-based Systems Edition
• Microsoft Windows Server 2003 x64 Edition

Additional affected software (as reported by Sunbelt):

• Outlook 2007 – 12.0.417.1006: Can view VML but apparently not vulnerable.
• Outlook 2003 11.8010.8036 SP2: vulnerable
• Outlook 2003 11.6568.6568 SP2: unknown (not tested)
• Outlook 2003 11.5608.5606: not vulnerable
• Outlook 2003 11.5608.8028: not vulnerable
• Outlook 2002: not vulnerable
• Outlook 2000: not vulnerable

Official patch/security update: None at this time. According to Microsoft:

A security update to address this vulnerability is now being finalized through testing to ensure quality and application compatibility Microsoft’s goal is to release the update on Tuesday, October 10, 2006, or sooner depending on customer needs.

How to Protect Yourself

Until Microsoft releases an official patch (scheduled for Tuesday, October 10, 2006), you really can’t “fix” this flaw in your computer. You can apply an unofficial patch (which should work until Microsoft releases theirs, but Microsoft won’t help you if the patch messes up your system), you can enact some workarounds that stop the problem before it can harm your system, or perhaps do both.

Unofficial Workaround

In addition to the workarounds from Microsoft mentioned below, SecuriTeam has discovered that Windows XP users with Service Pack 2 installed have another option (and it’s good for blocking many other types of attacks, so it seems like a good idea!). Simply enable system-wide enforcement of software-enforced Data Execution Prevention (DEP) and make sure Internet Explorer is not exempted. It’s easier to do than to pronounce.

Difficulty: Not Very Difficult
Impact: Microsoft does not list any adverse problems with enabling this feature. In fact, they state “Software-enforced DEP can help prevent malicious code from taking advantage of exception-handling mechanisms in Windows.”

The following instructions are based on one of several different ways Microsoft allows you to configure DEP. You must be logged on as an administrator to manually configure DEP on the computer. A restart is required after completing these steps.

1. Click Start, click Run, type sysdm.cpl, and then click OK.
2. On the Advanced tab, under Performance, click Settings.
3. On the Data Execution Prevention tab, click Turn on DEP for all programs and services except those I select
4. If Internet Explorer, Outlook Express, or Outlook are listed in the box below that option, you should either remove the program(s) from the list (select the program and click the Remove button) or at least make sure the checkbox in front of each program is unchecked.
5. Click OK two times.
6. Restart your computer for the changes to take effect.

Once you have protected your system, visit ZERT’s vulnerability test page. NOTE: If your system is vulnerable, your browser will crash. If your browser crashes after following these instructions, carefully re-read the instructions and try again or try a different patch or workaround.

Unofficial Patches

Until Microsoft releases an official patch, an unofficial patch that is not supported by Microsoft is available from the Zeroday Emergency Response Team (“ZERT”). ZERT is a group of highly skilled software and hardware engineers with industry liasons who develop emergency patches for vulnerable systems. They release patches only when they feel the risk of waiting for the vendor (in this case Microsoft) to release an “official” patch is greater than the risk of releasing a patch that may not be quite as polished and fully tested, but blocks the problem. Additionally, there are several links to additional good information about the threat. ZERT’s site is located at: http://isotf.org/zert/

Download the ZERT patch and view the instructions.

Once you have protected your system, visit ZERT’s vulnerability test page. NOTE: If your system is vulnerable, your browser will crash. If your browser crashes after following these instructions, carefully re-read the instructions and try again or try a different patch or workaround.

Official Microsoft Workarounds

See Microsoft’s page under the Suggested Actions headings for updates to the following information.

Un-register Vgx.dll

Difficulty: Not Very Difficult
Impact: Applications that render VML will no longer do so once Vgx.dll has been unregistered. Generally, that should not impact your day-to-day web browsing very much unless a particular favorite site of yours uses VML; most sites do not use it… [Continue reading]

20 (Mostly) Funny Videos By or About Microsoft

I should point out that I am not a Microsoft employee, but I work for a Microsoft partner. That means that I work for a company that sells and supports Microsoft products. My opinions, and the opinions of the videos displayed and/or linked to from this blog do not necessarily (and in most cases almost certainly don’t) represents Microsoft’s official views, or even my own (except what I wrote in the comments). Some of these videos are legitimate Microsoft ads, some are spoofs, some are ads or jokes that I have no idea how they got approved by the corporate bureaucracy ("It’s better to beg for forgiveness than to ask for permission" mentality?), and some are jokes and parodies that others have made. I hope you enjoy some or all of these. Please post comments about what you like. Just don’t turn this into a religious discussion about how evil or wonderful Microsoft and Bill Gates are, how much better or worse Mac or Linux are (or OS/2 or any other system), etc. As I tell my clients, "I have no religious convictions when it comes to computers. I just recommend that you use whatever works the best for your particular needs given your particular budget." Now, enjoy the lighter side of Microsoft.

Punish Your Microsoft Developer

About 6 months ago, I saw the following video at a Microsoft partner event. I’m still waiting for the WSYP to be offered to the partners. Gotta love it!

Tags: advertisements, humor, marketing, Microsoft, videos, Windows, Xbox, YouTube

Most people want to keep their computers running problem-free, but many do not know how to do so. I thought it might be handy to create this Top 10 list to help you out a bit. This isn’t a complete list, but if you follow these 10 pieces of advice, you will be a lot better off than most people. For more detailed information and a handy checklist for keeping your computer in top-notch condition, download the free Maintenance Schedule from http://www.acanth.com/tools

Only about half of the list is actually stuff you need to do to the computer. The other half is a combination of attitudes and practices you should adopt to keep your computer and your personal information personal.

1. Visit http://update.microsoft.com/ monthly, especially around the 2nd Wednesday
2. Make sure your anti-virus and anti-spyware are installed, updated, and working
3. Backup everything you can’t replace or that would cost too much to replace
4. Do not let kids surf without at least casual supervision; filtering tools help but are not perfect
5. Phishing attacks (pretending to be someone you trust to get info) have spread to the telephone
6. Never give out personal information unless you initiate the process
7. Good passwords mix upper and lower case letters with numbers and even punctuation
8. Use AT LEAST two different passwords: one for private sites (like banks) and another for elsewhere
9. Scan hard disks for errors and defragment them regularly (every 3-6 months or so)
10. Keep the computer clean and cool, wash your hands, and don’t eat at the computer

Expanding on four key points:
#1 – The 2nd Tuesday of each month is “Patch Tuesday” at Microsoft. The majority of security updates are released on that day.
#2 – Most anti-virus software and some anti-spyware programs offer subscriptions to keep the programs up-to-date. If your subscription lapsed, you could be vulnerable. Some viruses are able to disable the anti-virus software, so remember to check occasionally that it is still running.
#4 – Filtering software for kids helps, but sooner or later inappropriate things will slip through. It’s best if a parent is around to discuss with the child what he or she saw, and help them to come to an understanding about such things.
#5 – Phishing attacks have moved to the telephone using VOIP telephony. This allows phishers in one country to appear to be local to you and even have caller ID report information that appears legitimate. E-mail has been prone to phishing attacks for some time. More targeted “spear phishing” attacks focus on specific, related targets. The best advice is never to trust or give personal information to anyone that contacts you, even if it appears to be someone you know. Always initiate the contact (call your bank or co-worker) and confirm that they need the information. Do not call phone numbers from e-mails or given to you by callers; it could be one of their cohorts pretending to be your bank or whatever.

Tags: backup, best practices, content filtering, passwords, patches, phishing, privacy, spyware, tips, VOIP, Windows

I spent a long time looking for information on joining a domain with Windows XP MCE recently. I personally cannot/will not guarantee it will work—it could even kill your Media Center Edition installation. And there might even be other, easier ways to do this. But I’m going to post this here and eventually try it for the fun of it in a lab environment. I certainly wouldn’t recommend trying it in a productions environment without lots of testing.

Tags: how-to, installation, tips, Windows