PC Tips Box » Computer

On October 13th, 2009, Microsoft started serving to Windows users patches for no less than 34 vulnerabilities, releasing the most security bulletins in the company’s history. The 13 security bulletins made available are designed to offer fixes for a range of security issues affecting Windows, Internet Explorer, Silverlight, Microsoft Office, Developer Tools, Forefront and SQL Server. Microsoft underlined that, despite the large number of patches, all security updates had been thoroughly tested, and only received the green light for broad release once they met specific quality standards.

Out of the total 13 security bulletins released, eight have received Microsoft’s maximum severity rating, namely Critical, indicating that they are designed to patch severe vulnerabilities that could allow for remote code execution in the eventuality of a successful attack. The remaining six patch packages have all been deemed Important, a less severe rating. However, customers should apply the patches offered by the Redmond company immediately. The simplest way to access the security updates is through Windows Update. Users with Automatic Updates enabled will have all patches automatically downloaded to their machines.

Microsoft revealed that no less than seven security bulletins with a maximum severity rating of Critical out of the total eight also had an exploitability index of 1. The highest possible exploitability index: 1 is indicative of the fact that Microsoft considers the possibility of exploit code becoming available in the wild for the seven flaws extremely likely, perhaps even within the first 30 days since the patches were released. This just in case you needed additional incentive to deploy the security updates.

Not even Windows 7 managed to emerge untouched from the October 2009 Microsoft patch release. Below you will be able to find a summary of the Microsoft October Security Bulletin Release, courtesy of Christopher Budd, security response communications lead, Microsoft:

MS09-050 (Maximum severity rating of Critical) This update resolves one publicly disclosed and two privately reported vulnerabilities in Server Message Block Version 2 (SMBv2). The more severe of the vulnerabilities could allow remote code execution if an attacker sent a specially crafted SMB packet to a computer running the Server service. This update received a 1 rating from Microsoft’s Exploitability Index.

MS09-051 (Maximum severity rating of Critical) This security update resolves two privately reported vulnerabilities in Windows Media Runtime. The vulnerabilities could allow remote code execution if a user opened a specially crafted media file or received specially crafted streaming content from a website or any application that delivers web content. This update received a 1 rating from Microsoft’s Exploitability Index.

MS09-052 (Maximum severity rating of Critical) This security update resolves one privately reported vulnerability in Windows Media Player. The vulnerability could allow remote code execution if a specially crafted Advanced Systems Format (ASF) file is played using Windows Media Player 6.4. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. This update received a 1 rating from Microsoft’s Exploitability Index.

MS09-053 (Maximum severity rating of Important) This security update resolves two publicly disclosed vulnerabilities in the File Transfer Protocol (FTP) Service in Microsoft Internet Information Services (IIS) 5.0, IIS 5.1, IIS 6.0, and IIS 7.0. On IIS 7.0, only FTP Service 6.0 is affected. The vulnerabilities could allow remote code execution on systems running FTP Service on IIS 5.0, or denial of service on systems running FTP Service on IIS 5.0, IIS 5.1, IIS 6.0 or IIS 7.0. This update received a 1 rating from Microsoft’s Exploitability Index.

MS09-054 (Maximum severity rating of Critical) This security update resolves three privately reported vulnerabilities and one publicly disclosed vulnerability in Internet Explorer. The vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. This update received a 1 rating from Microsoft’s Exploitability Index.

MS09-055 (Maximum severity rating of Critical) This security update addresses one privately reported vulnerability in ActiveX controls that were compiled using the vulnerable version of the Microsoft Active Template Library (ATL) and could allow remote code execution if a user views a specially crafted webpage with Internet Explorer, instantiating the ActiveX control. This update received a 3 rating from Microsoft’s Exploitability Index.

MS09-056 (Maximum severity rating of Important) This security update resolves two publicly disclosed vulnerabilities in Microsoft Windows. The vulnerabilities could allow spoofing if the attacker gains access to the certificate used by the end user for authentication. This update received a 3 rating from Microsoft’s Exploitability Index.

MS09-057 (Maximum severity rating of Important) This security update resolves one privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker set up a malicious webpage which invokes the Indexing Service through a call to its ActiveX component. This call could include a malicious URL and exploit the vulnerability, granting the attacker access to the client system under the privileges of the user browsing the webpage. This update received a 2 rating from Microsoft’s Exploitability Index.

MS09-058 (Maximum severity rating of Important) This security update resolves three privately reported vulnerabilities in the Windows kernel. The most severe of the vulnerabilities could allow elevation of privilege if an attacker logged on to the system and ran a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. This update received a 2 rating from Microsoft’s Exploitability Index.

MS09-059 (Maximum severity rating of Important) This security update resolves one privately reported vulnerability in Microsoft Windows. The vulnerability could allow denial of service if an attacker sent a maliciously crafted packet during the NTLM authentication process. This update received a 3 rating from Microsoft’s Exploitability Index.

MS09-060 (Maximum severity rating of Critical) This security update resolves three privately reported vulnerabilities in Microsoft Active Template Library (ATL) ActiveX Controls for Microsoft Office. The vulnerabilities could allow remote code execution if a user loaded a specially crafted component or control hosted on a malicious website. This update received a 3 rating from Microsoft’s Exploitability Index.

MS09-061 (Maximum severity rating of Critical) This security update resolves three privately reported vulnerabilities in Microsoft .NET Framework and Microsoft Silverlight. The vulnerabilities could allow remote code execution on a client system if a user views a specially crafted webpage using a web browser that can run XAML Browser Applications (XBAPs) or Silverlight Applications, or if an attacker succeeds in persuading a user to run a specially crafted .NET application. This update received a 1 rating from Microsoft’s Exploitability Index.

MS09-062 (Maximum severity rating of Critical) This security update resolves eight privately reported vulnerabilities in Microsoft Windows Graphics Device Interface (GDI)+. These vulnerabilities could allow remote code execution if a user viewed a specially crafted image file using affected software or browsed a website that contains specially crafted content. This update received a 1 rating from Microsoft’s Exploitability Index.

Microsoft re-released Security Bulletin MS08-069 to add detection for MSXML on Windows 7 and Windows Server 2008 R2.

Tags: ActiveX, attack, bulletin, Computer, exploit, internet explorer, Microsoft, patches, Security, security bulletins, security issue, security issues, security response, security update, Software, vulnerabilities, vulnerability, Windows, windows update, windows user

Top 10 – September 2009 Popular Tips

Jason — Thu, 01 Oct 2009 14:59:57 +0000

1. Windows 7 RTM Enterprise 90-Day Evaluation

2. Make FireFox 3 Times Fast

3. DirectX 11 Resources for Windows 7 and Vista

4. Windows 7 Upgrade Performance

5. Windows 7 Windows XP Mode RC Hotfix for Shared Folder Performance

6. Automatic Windows 7 Installs

7. Office 2010 Build 14.0.4417.1000

8. Windows 7 HomeGroup

9. DirectX with Windows 7 Support

10. Firefox 3.6 Beta 1 Up Next

and other popular tips

Tags: directx, Firefox, firefox 3, Firefox 3.6, HomeGroup, hotfix, Office, Office 2010, pctips, pctipsbox, Performance, popular, Top, Windows, Windows 7, Windows 7 RTM, Windows Vista

Six tips for greening your PC

Jason — Wed, 30 Sep 2009 08:41:01 +0000

When you consider that computers now consume about 10 percent of the electricity generated in North America and that a great many PCs still end up in landfills, leaching deadly chemicals, it makes sense to adopt more eco-friendly computing options.

John Hiddema, technical consultant for Nerds on Site, is one of the many people making a conscious effort to go green. He recycles, buys organic produce, uses cleaning products less harmful to the environment, owns energy-efficient appliances, and has configured his
PC to use less energy. He’s also going green on the job. Some of the work he does for clients’ computer systems can be done remotely from his home office, drastically reducing his need for a car.

Here are some tips for making your technology use more eco-friendly.

1. Manage power consumption

Did you know that approximately 40 percent of the energy used for home electronics is consumed while these devices are turned off or idling? Techies refer to computers and related gadgets that draw power while not in use as vampire load. Turn off and unplug everything when you’re not using it. Even simpler: shut down everything and then turn off the power bar.

“Turning off lights that aren’t in use just makes sense, right? Same thing for a computer you’re not using,” says Jeremy Kaplan, an executive editor of PC Magazine. Turn off your printer, scanner, and fax.

If you leave your computer on, set Power Options in the Control Panel to save energy. “Depending on the specific hardware, these options can reduce power usage dramatically, to the tune of 80 percent,” says Hiddema.

2. Use alternative power sources

Companies such as Solar Style and Sundance Solar offer a range of solar charger options for many battery-powered electronic gadgets, including your digital camera, MP3 player, cell phone, and laptop.

If you’re not ready to take your house off the grid, you can buy your electricity from an environmentally responsible provider. Bullfrog Power provides residents in Alberta and Ontario with renewable power from emission-free sources such as wind and low-impact water power. In the United States, Idaho Power has a Green Power Program that pools different sources of electric energy, including green sources.

3. Print smart

Using the printer-friendly option, available on many websites, can eliminate the printing of unwanted graphics or text.

Software applications, such as GreenPrint, make this process easier by automatically detecting unnecessary pages and eliminating them from your printouts. When you do print, use recycled paper and refillable ink cartridges in your printer.

4. Extend your PC’s life

If your PC is a few years old and you’re thinking of getting a new one, you may only need to upgrade some of its parts to keep it running at top capacity. You can safely upgrade many components such as the monitor, video or sound card, and hard drive, or you can add RAM to your existing PC.

Newer components are likely to be more eco-friendly. A liquid crystal display (LCD) monitor uses one-third the energy of a cathode ray tube (CRT) monitor and lasts twice as long.

You can also give an old PC new life by repurposing it.

- Install a TV tuner card and use the hard drive to record your favorite TV shows.

- Move the old PC to the cottage or let the kids use it for their homework.

- Set the machine up in the kitchen with Internet access and the old PC becomes an electronic cookbook that helps you search for and file new recipes.

5. Recycle your PC

Perhaps the greenest thing you can do is keep your computer out of the landfill. Approximately 70 percent of the heavy metals found in landfills emanate from electronics, and PCs (especially older ones) contain toxic chemicals such as lead, mercury, and polyvinyl chloride.

If your PC has reached the end of its lifecycle, a quick web search will help you find local, reputable recycling companies or charities that will take your hardware and find new uses for it. The Electronic Recycling Association, for example, collects old computers in five cities across Canada and donates them to local schools, charities, libraries, and other groups. In the United States, Recycles is a non-profit recycling exchange network that collects donations of old computers and helps distribute them to non-profit organizations within its network throughout the country.

You can also check with your PC’s manufacturer. A growing number of PC makers have recycling programs and will take back PCs at the end of their lives.

6. Buy responsibly

If you’ve decided it’s time to upgrade to a new PC, Hiddema advises reading the small print to see whether a manufacturer is following green practices in making the product or reducing its power consumption. There are various industry standards, and it can often be tricky to understand just how a particular model is more energy efficient or eco-friendly. EPEAT offers some help; it’s an independent online registry that lets you research and compare desktops and laptops of registered manufacturers based on an extensive list of environmental attributes.

Tags: Battery, Buy, Computer, computer systems, config, Desktop, desktops, gadgets, Hard drive, Hardware, homework, laptop, laptops, lifecycle, Office, old computer, power consumption, printer scanner, Recycle, scanner, Software, solar charger

Microsoft Security Essentials Final

Jason — Sun, 27 Sep 2009 21:40:03 +0000

The final version of Microsoft’s Security Essentials (codename Morro), the basic security solution the Redmond company is working on delivering for Windows, is expected to become available in a matter of weeks, at least this is what the software giant announced on Sunday in a note sent to beta testers. The MSE solution should come to the company’s client as the replacement for Windows Live OneCare, which will end its life cycle as soon as the new security software arrives.

“The final version of Microsoft Security Essentials will be released to the public in the coming weeks. If you are running the older version of the beta (1.0.1407.0), we encourage you to upgrade to a newer version of the beta (1.0.1500.0),” is what Microsoft reportedly said to the participants to its beta testing program. Microsoft Security Essentials 1.0 beta went live officially on June 23 this year, and we’ve already seen a series of updates leaked on the web and made available for download.

According to some estimations there are more than 400,000 beta testers for Morro out there, with 75,000 people downloading the Security Essentials during the first day of public availability, thus allowing Microsoft to reach its aimed number of testers in only a day. The final version of Microsoft’s new security solutions is expected to come to Windows users for free, offering them an alternative to paid antivirus software in case they are unable to purchase such a solution.

Except for the announcement regarding the upcoming availability of the final flavor of Microsoft Security Essentials, the Redmond-based company hasn’t detailed anything on the progress it is making with the beta version. Build 1.0.1500.0, which beta testers are now encouraged to download, has been wandering on various illegal download sites since about a month ago. Intended only for individual use, MSE does not come as an alternative to Microsoft’s solutions aimed at businesses.

A recent article on ZDNet is meant to show exactly this state of facts. Here is how the Redmond software company explains what MSE is aimed at: “Microsoft Security Essentials is designed for home use. It requires no registration, trials or renewals and will be available for download directly from Microsoft. Microsoft continues to offer security solutions for businesses with the Forefront line of products as part of its Business Ready Security strategy. However Microsoft Security Essentials may be a good solution for small home offices with only a few individually managed PCs.”

Tags: availability, codename Morro, estimation, Microsoft, microsoft security, Microsoft Security Essentials 1.0, Security, security software, security solutions, upgrade, Windows, Windows Live OneCare, windows user

More tricks to evade keyloggers on public PCs

Jason — Thu, 24 Sep 2009 18:28:16 +0000

The revised Vesik method involves typing nonsense characters into a password input box when using a public PC and then rearranging some of the letters to form your actual password with the mouse. If the PC contains a hardware keylogger or is infected with a software keylogger, rearranging a password in this way will usually suffice to obscure your credentials. Most hackers will concentrate on the 99% of users who type in their passwords at Internet cafés in the usual way.

One proposal sent in by many, many, many readers was a variation on a single theme. Namely, keep your sign-in information on a USB flash drive or memory stick, then copy and paste the info into the appropriate fields when you’re required to use a public PC or other unsecured computer.

Unfortunately, many keyloggers capture any information you place into the Windows Clipboard. I tested the copy-and-paste technique using the All In One Keylogger from RelyTec. (For more info, see the vendor’s site.) The program easily captured the sign-in IDs and passwords entered, whether I used the standard menu options (Edit, Copy and Edit, Paste) or the keyboard shortcuts Ctrl+C and Ctrl+V.

In my tests, the All In One Keylogger wasn’t able to capture the information when I performed a copy-paste operation using a context (right-click) menu. But that’s not much to rest one’s hopes on. Other keyloggers do succeed at capturing data copied via context-menu options.

Other strategies for blocking keyloggers

Readers suggested various ways of carrying one’s passwords on a flash drive. Jeff H. asked, for example:

* “What about surfing from suspect PCs using only Firefox Portable running off a USB drive, with all your passwords stored in the browser?”

If you store passwords in a portable version of Firefox, make sure you set a “master password” first. This encrypts your passwords so they’re not readable on the USB device for any malware to scan.

To establish a master password in Firefox, pull down the Tools menu, click Options, select the Security tab, and turn on Use a master password. After doing this, you must enter your master password once per browser session.

Another reader, Val Ingraham, proposed signing in using a tool such as the portable version of Siber Systems’ free RoboForm password manager, available on the company’s download page.

Both of these approaches were able to evade the keylogger I tested them with and would likely confound other keyloggers as well.

However, any method that permits automatic sign-in from a flash drive poses a risk of physical security. A flash drive is easy to lose. When you misplace one, you could be handing over your passwords to whoever finds the device if you don’t enable a master password.

Can freeware provide the privacy you need?

Several readers like products that are specifically designed to defeat keyloggers. Simon Bleasdale recommends Neo’s SafeKeys 2008, available for free on the Alpin Software site. The program promises the same functionality as the Windows On-Screen Keyboard (OSK) utility described in the original tip but without OSK’s security risks.

(OSK sends keystrokes in a way that keyloggers can see and record. To use OSK if you need it for entering something other than a password, open the software by clicking Start, All Programs, Accessories, Accessibility, On-Screen Keyboard.)

Neo’s SafeKeys 2008 displays a small window with a simulated keyboard on which you can type your sign-in, password, and other information just as with OSK. But unlike the Microsoft utility, Neo’s SafeKeys 2008 doesn’t transmit information in a way that can be picked up by keyloggers. Nor does the program use the Clipboard. Instead, you type your info in the SafeKeys 2008 window and then drag the data to the appropriate text box in your browser.

Neo’s SafeKeys 2008 successfully evaded the All In One Keylogger product in my tests. Other options help you foil keyloggers that regularly take screen captures to record your PC activities. According to the Alpin Software site, however, the utility’s drag-and-drop methods don’t work with all products including the Opera browser.

No product will ever be able to guarantee your safety from snoops when you use a public computer. Fortunately, the techniques and products described here and in the previous article can reduce your risk substantially.

You’re the only person, however, who can decide what constitutes an acceptable risk level for your data. That may mean never signing in to Web sites using PCs at Internet cafés or wherever you’re not sure adequate security precautions have been taken.

Tags: Computer, download, flash drive, freeware, hacker, hardware keylogger, Internet, keyboard shortcuts, Keylogger, keyloggers, keystroke, malware, password, password manager, security risk, Software, tools, usb device

Windows Optimized Desktop Toolkit

Jason — Fri, 04 Sep 2009 19:35:40 +0000

Microsoft is currently hard at work on the evolution of the resource that was formerly labeled Windows Optimized Desktop Scenarios Solution Accelerator. According to the Redmond-based company, the building phase hasn’t actually started, as the software giant still has to deal with the planning of the next iteration of the solution accelerator. In this regard, customers that are already leveraging or intend to take advantage of the Windows Optimized Desktop Toolkit can share their insights with Microsoft.

The software giant is offering all users the possibility of sending feedback on the solution accelerator, with the promise that input will be integrated into the next version of the Windows Optimized Desktop Toolkit. Customers interested in helping shape the future of the Windows Optimized Desktop Toolkit can access a survey hosted on Microsoft Connect.

“The Microsoft Solution Accelerators Team is currently planning the next release of the Windows Optimized Desktop Toolkit (previously known as Windows Optimized Desktop Scenarios Solution Accelerator). To help identify and prioritize features to include in the toolkit, we have created a survey to gather information about our customers’ desktop infrastructures,” revealed a member of the Microsoft Assessment and Planning Toolkit Team. “The survey is now available on Connect and will be open until September 22, 2009.”

At the same time, the company is also offering an alternative for customers that wish to share their feedback, but are unable to do so via the Windows Optimized Desktop Toolkit vNext survey. Personally, I tried accessing the Microsoft Connect page, ready to contribute with my input, and to snoop around trying to guess the direction Microsoft will take with the future version of the solution accelerator but I only got as far as an error page. The software giant is telling customers that the7 can contact wodtfb at Microsoft dot com in order to share their desktop infrastructure optimization needs with the company.

“To express our thanks, we will offer a free copy of OneNote software from Microsoft to 5 survey participants from a random drawing on September 22, 2009,” the Microsoft Assessment and Planning Toolkit Team representative added.

For the time being, customers can access version 1.1 of the Windows Optimized Desktop Scenarios, with updated versions of both the guide and tool, tailored to Windows 7 and Windows Server 2008 R2.

“The Windows Optimized Desktop Scenarios relate the business requirements (IT and user) for a flexible, efficient, and managed desktop environment to sets of complementary Microsoft technologies by defining and using five standard user scenarios that map business requirements to technology solutions. These core scenarios are: Office Worker, Mobile Worker, Task Worker, Contract/Offshore Worker, and workers who need to Access from Home,” Microsoft noted.

Tags: Assessment, Microsoft, optimization, optimize, Software, software giant, solution accelerator, toolkit, Windows, Windows 7, Windows Optimized Desktop Toolkit, Windows Server 2008

TOP 10 – August 2009 Popular Tips

Jason — Tue, 01 Sep 2009 06:33:25 +0000

1. Windows 7 RTM Automated Installation Kit

2. Windows 7 XP Mode RC and Virtual PC RC

3. Install Windows 7 Alongside Windows Vista for a Dual Boot System

4. How to uninstall Windows 7

5. Windows 7 RTM Code Pack

6. Vista SP2 and XP SP3 Critical Updates

7. Free Registry Back Tool For All Windows

8. Make Firefox Faster With Your Old Firefox Profile

9. Windows 7 RTM Media Center

10. Windows 7 RTM Dell Drivers

And other popular tips

Tags: Automated Installation Kit, boot, dell drivers, Drivers, dual boot, dual boot system, faster, Firefox, how to, popular, rtm, Top, updates, Virtual, Windows, Windows 7, Windows 7 RTM, windows vista

Make USB Disk Bootable

Jason — Sun, 30 Aug 2009 21:42:46 +0000

Make USB Disk Bootable is a console based free tool which lets you create a MS DOS bootable USB drive which is created by using the system files on any windows xp PC. This bootable USB Disk is actually a MS-DOS Bootable USB Drive from the users XP source files.

Tip: Install Windows 7 From Bootable USB Drive

This free tool uses HP USB Dos Format Tool to make the USB disk bootable, if you do not have HP USB Format tool installed then it will download it from the HP Website and install it on your computer.

Note: You must accept the HP End User License Agreement during setup.

Here is the step by step procedure to do the same

1. Download Make USB Bootable Tool and extract the zip package in separate directory

2. Right click mkboot.cmd file and click edit to change the attributes in the config file.

3. Change USBDRV value R: to the drive letter that is been currently used by your USB Drive when you plug it in your computer.

4. Exit and Save then double click on mkboot.cmd to run this tool.

Note: MAKE SURE THE USB DRIVE LETTER IS CORRECT WHEN YOU RUN THE TOOL

Download Make USB Disk Bootable

Tags: Bootable, bootable usb, bootable usb drive, Computer, dos bootable, download, installing windows, MS-DOS, pc, Software, usb, usb flash drive, USBDRV, Web, Windows, Windows 7, windows xp

Create an Ad Hoc Wireless Network

Jason — Tue, 25 Aug 2009 07:26:29 +0000

If you want to share information stored on your computer with other people nearby and everyone’s computer has a wireless network adapter, a simple method of sharing is to set up an ad hoc wireless network. In spite of the fact that members must be within 30 feet of each other, this type of network presents a lot of possibilities. For example, you might consider establishing an ad hoc network at a meeting of mobile computer users so that you can share information with other attendees on their own screens rather than an overhead projector. (After establishing the network, you can do this by using Windows Meeting, for instance.)

Ad hoc networks are by definition temporary; they cease to exist when members disconnect from them, or when the computer from which the network was established moves beyond the 30-foot effective range of the others. You can share an Internet connection through an ad hoc network, but keep in mind that the Internet connection is then available to anyone logging on to a computer that is connected to the network, and thus is likely not very secure.

To set up an ad hoc network:

1. On the Start menu, click Connect To.

2. In the Connect to a network window, click the Set up a connection or network task.

3. On the Choose a connection option page, click Set up a wireless ad hoc (computer-to-computer) network, and then click Next. (This option only appears on computers that have wireless adapters.)

4. Read the ad hoc network information, and then click Next.

5. Provide a network name, select whether the network is open or requires authentication, provide a security phrase if necessary, and then click Next.

After Windows Vista sets up the ad hoc network, you have the option of sharing your Internet connection.

To disconnect from an ad hoc network, display the Connect To A Network window, click the ad hoc network, and then click Disconnect.

Tags: ad hoc networks, Computer, computer network, connection, Internet, internet connection, Mobile, mobile computer users, Security, Windows, windows vista, Wireless, wireless adapters, wireless network adapter

PC Tips Box » Computer

Top10 – October 2009 Popular Tips

Related posts

Microsoft Patches 34 Security Vulnerabilities

Related posts

Top 10 – September 2009 Popular Tips

Related posts

Six tips for greening your PC

Related posts

Microsoft Security Essentials Final

Related posts

More tricks to evade keyloggers on public PCs

Related posts

Windows Optimized Desktop Toolkit

Related posts

TOP 10 – August 2009 Popular Tips

Related posts

Make USB Disk Bootable

Related posts

Create an Ad Hoc Wireless Network

Related posts