Updates 6/14/16 - "Microsoft Tuesday"

WARNING:  The link for this separate download of the MSRT is now pre-checking a box to also download "MSN default homepage & Bing default search engine".    Be sure to uncheck this, unless you really want it!

 

Malicious Software Removal Tool (MSRT, MRT) for June, version 5.37

http://www.microsoft.com/en-us/download/malicious-software-removal-tool-details.aspx 

Reminder:   Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].

This month's MSRT added detection/removal of

Win32/Ursnif - a "family of Trojans [that] can steal personal information and information about your PC and sends it to a malicious hacker.   It can also run commands from a malicious hacker."

 

from https://technet.microsoft.com/library/security/ms16-jun

The following 5 updates are rated CRITICAL:

MS16-063 Cumulative Security Update for Internet Explorer (3163649)

MS16-068 Cumulative Security Update for Microsoft Edge (3163656)

MS16-069

Cumulative Security Update for JScript and VBScript (3163640)

MS16-070 Security Update for Microsoft Office (3163610)

MS16-071 Security Update for Microsoft Windows DNS Server (3164065)

=================================

The following 11 updates are rated IMPORTANT:

MS16-072    Security Update for Group Policy (3163622)

MS16-073 Security Update for Windows Kernel-Mode Drivers (3164028)

MS16-074 Security Update for Microsoft Graphics Component (3164036)

MS16-075 Security Update for Windows SMB Server (3164038)

MS16-076 Security Update for Netlogon (3167691)

MS16-077 Security Update for WPAD (3165191)

MS16-078 Security Update for Windows Diagnostic Hub (3165479)

MS16-079 Security Update for Microsoft Exchange Server (3160339)

MS16-080 Security Update for Microsoft Windows PDF (3164302)

MS16-081 Security Update for Active Directory (3160352)

MS16-082 Security Update for Microsoft Windows Search Component (3165270) 

On this Win7x64 SP1 system, I was offered 13 updates (9 Windows 7; + 4 Office 2010) totaling 138.6 MB.

[This does NOT include the MSRT, which I downloaded and ran separately.]

A follow-up concerning Microsoft Security Bulletin MS16-077 - Security Update for WPAD (3165191):

Microsoft is today closing off a vulnerability that one Chinese researcher claims has “probably the widest impact in the history of Windows.” Every version of the Microsoft operating system going back to Windows 95 is affected, leaving anyone still running unsupported operating systems, such as XP, in danger of being surreptitiously surveilled.

http://www.forbes.com/sites/thomasbrewster/2016/06/14/microsoft-badtunnel-big-brother-windows-vulnerability/#604133dd5c64

 

EDIT:  Additional article:  https://nakedsecurity.sophos.com/2016/06/16/badtunnel-a-vulnerability-all-windows-users-need-to-patch/

On this Win7x64 SP1 system, I was offered 13 updates (9 Windows 7; + 4 Office 2010) totaling 138.6 MB.

Is this computer not listed as compatible with Windows 10?  My Windows 7x64 SP1 upgraded without any problem.

BB,

The particular Win7x64 SP1 machine on which I downloaded/tested the updates was at work.   I am therefore deferring the decision about updating that machine to my superiors, who have not (yet?) offered me any guidance.  

As for personal systems, I have two that are eligible:   a Win7x64 SP1 laptop (that you're familiar with) and a 32-bit Win8.1 tablet.   I have not updated either, and don't plan to.

They tried to sneak Win 10 on my Win 8.1 laptop yesterday along with all the other Update Tues updates.

It automatically started downloading the upgrade file when I checked for updates yesterday. It didn't warn me or show me a list of available updates. It just started to download. Fortunately, I was watching and canceled it.

And I thought I'd hidden every GWX update they tried to feed me over the past few months.

Just did the updates on my Win 7 Pro+SP1, 32-bit desktop.

Now performance is lagging. Process Explorer shows dwm.exe and one svchost process using CPU time. Although total RAM usage is constant, there are lots of RAM cycles running. I rebooted but it hasn't helped.

Scanned with Malwarebytes, MSE, and SAS. All came back clean.

Wasn't an issue before the updates, so I suspect something happened...

Anybody else running 7, 32-bit, notice a performance problem after updating?

:emotion-40:

(With acknowledgement to BB for posting...um, shall we say... "elsewhere" )

Microsoft’s update KB3159398 ( MS16-072), is causing serious problems in Windows Group Policy.
http://borncity.com/win/2016/06/16/update-kb315939​8-breaks-group-policy-in-windows/ 

Known issues  MS16-072 changes the security context with which user group policies are retrieved. This by-design behavior change protects customers’ computers from a security vulnerability. Before MS16-072 is installed, user group policies were retrieved by using the user’s security context. After MS16-072 is installed, user group policies are retrieved by using the machines security context.

Ron,

I'll freely admit being confused about the nature and extent of the Group Policy "bork" cited above.   I posted the information here as soon as I saw BB's post.   It was only hours later that I had a chance to investigate the matter.

First and foremost, I think it's unlikely that individual users have even set-up group policies on their own PCs. 

Second, on some machines were I have used the LOCAL Group Policy Editor (GPEdit.msc) , I did some quick testing, and confirmed that the policies I had set there were still functioning correctly.

Indeed, the Group Policy Management Console (GPMC.msc) that's being referenced in the article, for implementing the suggested fix, "unifies management of Group Policy across the enterprise" --- which sure sounds to me like they're talking about a linked/networked group of computers for business/institutional purposes.    And as best as I can read things, the ability to run PowerScript files is part of the GPMC download.

Hopefully, someone will be able to clarify and simply all this.  

Unless you're experiencing some of the bugs cited in the article (e.g., if your desktop icons are no longer working), I'd say you should just ignore this... unless/until we hear otherwise.

So what's the "average" user supposed to do? Run the PowerShell script offered through that site or wait until MacroStupid fixes this latest mess?

And how does one run a PowerScript .ps1 file?

Don't know if this is related, but I'm having issues logging into certain sites today, including this forum, as I described elsewhere...

1) Although the article link in ky's post suggests that Win 10 systems are affected, I find no evidence that the KB3159398 update was installed on my Win 10. And the "applies to" info at this MS page does not include Win 10:
support.microsoft.com/.../3159398

2) Once again, my policy of waiting to manually install updates for Win 7 proves its worth. After going to the Windows Update site (which, even 2 days after Patch Tuesday, took an astonishing 55 minutes to list the 15 important updates applicable - some 130 MB) I see that MS is still offering KB3159398, despite the problems with it that are now well documented at several sites. I have hidden it, and will wait a week or so before installing any of the others. 

My desktop icons seem to be working ok, but some software, eg Nitro Reader (a pdf editor), isn't working today.

It loads but becomes unresponsive, eg, won't open any files, none of its toolbars work. Have to use Task Manager to kill it...

Things were working before I installed the updates yesterday...  [:'(]