think you can tell if you have a virus without av? think you’re smart enough to avoid viruses? you might need to think again

read more | digg story

Posted today by Chris Keroack [MSFT] at 21 Apr 2008 5:04 PM UTC on TechNet Forums

Today we are happy to announce that Windows XP Service Pack 3 (SP3) has released to manufacturing (RTM). Windows XP SP3 bits are now working their way through our manufacturing channels to be available to OEM and Enterprise customers.

We are also in the final stages of preparing for release to the web (i.e. you!) on April 29th, via Windows Update and the Microsoft Download Center. Online documentation for Windows XP SP3, such as Microsoft Knowledge Base articles and the Microsoft TechNet Windows XP TechCenter, will be updated then. For customers who use Windows XP at home, Windows XP SP3 Automatic Update distribution for users at home will begin in early summer.

Thanks to everyone here who installed the public betas – you not only gave us detailed feedback but also helped each other out with timely troubleshooting. Through the beta program we found several important issues and were able to confirm some essential fixes. We couldn’t have done this without you.

We will still be monitoring this forum during the next few weeks in case you have more feedback about the release of Windows XP SP3.

On behalf of myself, Shashank Bansal and Windows Serviceability, many thanks.

Chris Keroack
Release Manager, Windows XP Service Pack 3
Windows Serviceability

Microsoft Security Advisory (951306)

Vulnerability in Windows Could Allow Elevation of Privilege

Microsoft is investigating new public reports of a vulnerability which could allow elevation of privilege from authenticated user to LocalSystem, affecting Windows XP Professional Service Pack 2 and all supported versions and editions of Windows Server 2003, Windows Vista, and Windows Server 2008. Customers who allow user-provided code to run in an authenticated context, such as within Internet Information Services (IIS) and SQL Server, should review this advisory. Hosting providers may be at increased risk from this elevation of privilege vulnerability.

Currently, Microsoft is not aware of any attacks attempting to exploit the potential vulnerability. Upon completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through a service pack, our monthly security update release process, or an out-of-cycle security update, depending on customer needs.

General Information

Purpose of Advisory: To provide customers with the initial notification and provide additional information regarding the impact to Windows service accounts. For more information, see the Workarounds and Suggested Actions sections of the security advisory.

Advisory Status: Advisory published.

Recommendation: Review the suggested actions and configure as appropriate.

This advisory discusses the following software.

Frequently Asked Questions

Originally posted at Photo Matt

Since people are asking, this so-called alert on Security Focus appears to be completely false and has no information that an attacker or the WordPress developers could use. It is completely content-free, except for making claims that every version of WP since 2.0 is vulnerable.

Online, apparently, it’s fine for someone to run into a crowded theatre and yell “fire” and the less basis there is in fact the more people link to them. It’s not uncommon to see crying-wolf reports like the above several times in a week, and a big part of what the WP security team is sifting through things to see what’s valid or not.  [More ...]

by Wendy Davis, Tuesday, Apr 1, 2008 8:00 AM ET

ADWARE PURVEYOR ZANGO IS PRESSING forward with its case that spyware removal vendor Kaspersky Lab wrongly interfered with Zango’s relationships with Web users.

In papers filed with a federal appeals court, Bellevue, Wash.-based Zango argued that Kaspersky, which removes software that serves pop-up ads, should itself be considered “badware.” “Kaspersky disabled Zango without the customer’s consent and without the customer’s ability to override Kaspersky’s invasive actions,” Zango argued to the Ninth Circuit in a brief filed late last week. “Kaspersky inflicted this interference by behaving like the very ‘badware’ from which it purported to protect consumers.”

[Full Story]

Thanks to Suzi at Spyware Warrior.