Updates - February 9, 2010

Today is "Microsoft Tuesday" --- the SECOND Tuesday of the month --- on which Microsoft is expected to release its monthly cycle of Windows critical/security updates.   Based on past history, these should be made available at 1 P.M. (Eastern Standard Time).

A plethora of updates is expected today.

Please use Windows/Automatic Updates, to determine precisely which updates are applicable to your particular system.!

Windows Malicious Software Removal Tool (MRT) for February (KB 890830) version 3.4

for 32-bit systems (Win 7 / Vista / XP / 2000 / Server 2003) http://www.microsoft.com/downloads/details.aspx?FamilyID=ad724ae0-e72d-4f54-9ab3-75b8eb148356&displayLang=en

for x64-bit systems http://www.microsoft.com/downloads/details.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

The Malicious Software Removal Tool (MRT) for February (cited above) adds detection/removal of

Win32/Pushbot  "a family of malware that spreads via MSN Messenger and AIM when commanded to by a remote attacker.  This worm contains backdoor functionality that allows unauthorized access and control of an affected machine".

The following updates are rated CRITICAL:

MS10-006 Vulnerabilities in SMB Client Could Allow Remote Code Execution (978251)

MS10-007 Vulnerability in Windows Shell Handler Could Allow Remote Code Execution (975713)

MS10-008 Cumulative Security Update of ActiveX Kill Bits (978262)

MS10-009 Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (974145)

MS10-013 Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (977935)

==================

The following updates are rated IMPORTANT:

MS10-003 Vulnerability in Microsoft Office (MSO) Could Allow Remote Code Execution (978214)

MS10-004 Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (975416)

MS10-010 Vulnerability in Windows Server 2008 Hyper-V Could Allow Denial of Service (977894)

MS10-011 Vulnerability in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege (978037)

MS10-012 Vulnerabilities in SMB Server Could Allow Remote Code Execution (971468)

MS10-014 Vulnerability in Kerberos Could Allow Denial of Service (977290)

MS10-015 Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (977165)

============

The following update is rated MODERATE:

MS10-005 Vulnerability in Microsoft Paint Could Allow Remote Code Execution (978706)

A plethora of updates i

The MVPS HOSTS file was recently updated [Feb-09-2010]
http://www.mvps.org/...p2002/hosts.htm

Download: hosts.zip (147 kb)
http://www.mvps.org/...p2002/hosts.zip

How To: Download and Extract the HOSTS file
http://www.mvps.org/...2002/hosts2.htm

HOSTS File - Frequently Asked Questions
http://www.mvps.org/...02/hostsfaq.htm

Note: the "text" version makes a great resource for determining possible unwanted connections ...
http://www.mvps.org/...p2002/hosts.txt (606 kb)

New Patches Cause BSoD for Some Windows XP Users
If you use Windows XP and haven’t yet updated your system with the applicable security updates that Microsoft issued Tuesday, you might want to hold off for a bit. Turns out, a non-trivial number of XP users are reporting that their systems suffer from the dreaded Blue Screen of Death (BSoD) and fall into an interminable reboot loop after installing the latest batch of patches from Redmond.

Complete article with fix:
http://www.krebsonsecurity.com/2010/02/new-patches-cause-bsod-for-some-windows-xp-users/

Here's some updated information on the BSoD issue:

http://blogs.zdnet.com/Bott/?p=1764&tag=col1;post-1764   asserts that the cause in many (but not necessarily all) cases was malware that was already installed on the system (often infecting the file %System32\drivers\atapi.sys )

That one seems to be an epidemic.  :emotion-2:

Thanks, ky331.

For Facebook Users, here is a good article with an explanation:

http://www.facebook.com/home.php?filter=nf#!/notes/microsoft-malware-protection-center/restart-issues-on-an-alureon-infected-machine-after-ms10-015-is-applied/313736273925