CEEK Technology AT and Mainstream Product News

Sent to you by Chris McMillan, Federal Marketing Manager via Google Reader:

Windows XP SP3 RTM Available on Windows Update, Automatic Update and Download Center

Windows XP Service Pack 3 has been released. Although the update is available on automatic updates, you can download the standard package from the following links:

• Windows XP SP3 EXE
• Windows XP SP3 ISO
• Windows XP SP3 Network Intallation Package

Windows® XP Service Pack 3 (SP3) includes all previously released updates for the operating system. This update also includes a small number of new functionalities, which do not significantly change customers’ experience with the operating system. For more information, see the whitepaper Windows XP Service Pack 3 Overview.

Things you can do from here:

• Subscribe to MSDN Blogs using Google Reader
• Get started using Google Reader to easily keep up with all your favorite sites

Sent to you by Chris McMillan, Federal Marketing Manager via Google Reader:

Jawbone 2 is here!

I blogged about it's impending arrival a while back but Aliph (the makers of the Jawbone headset) has now announced the new Jawbone headset.

Scarily it is 50% the size of the original AND it eliminates 10 times more noise!

I can't wait to get my hands on the new version then as I *LOVE* the (now) old version!

Check out my blog article where I demo'd the noise cancelling of the older version!

Things you can do from here:

• Subscribe to MSDN Blogs using Google Reader
• Get started using Google Reader to easily keep up with all your favorite sites

Sent to you by Chris McMillan, Federal Marketing Manager via Google Reader:

Keyboard Shortcuts

I use keyboard shortcuts to save time and avoid using the awkward mouse on my laptop.  Here are my favorites in Outlook 2007:

I also use custom keyboard shortcut keys to apply Color Categories to messages because my organizational system requires every message to be categorized based on the action I need to take.

I use CTRL+F12 throughout the day to archive conversations by marking them green.

Check out the lists of keyboard shortcuts on Office Online for Outlook 2003 and Outlook 2007 and find your own time-savers:

Keyboard shortcuts for Outlook 2007

Keyboard shortcuts for Outlook 2003

Ellen Adams

Program Manager

Things you can do from here:

• Subscribe to MSDN Blogs using Google Reader
• Get started using Google Reader to easily keep up with all your favorite sites

Sent to you by Chris McMillan, Federal Marketing Manager via Google Reader:

May 5 - May 11 Hot-Fix KB articles Weekly Release - Windows Client

Hi Everyone,

Last week, 11 Windows Client products related hot-fix KB articles were released, including 6 for Windows XP, 3 for Windows Vista, 2 for Internet Explorer. Below are the details:

Windows XP - 6 KB articles:

·         952079 You cannot use the Backup Utility to restore certain EFS-encrypted files on a Windows XP-based computer and data corruption occurs

·         949915 On a Windows XP-based computer, the archive attribute for a file in an offline folder is lost when the file is synchronized back to the server

·         949033 You may experience severe video degradation and a Stop error when you connect a USB Webcam to a Windows XP-based computer

·         948277 A blank desktop may appear when you log on to a Windows XP-based computer

·         945436 Error message when you try to uninstall or unload the driver for a multifunction USB device on a Windows XP-based computer: "STOP: 0x000000D1 DRIVER_IRQL_NOT_LESS_OR_EQUAL"

·         944898 Error message during synchronization of offline files on a Windows XP-based computer: "Unable to Make 'filename.ext' available offline"

Windows Vista - 3 KB articles:

·         951720 A Windows Vista-based computer may stop responding during shutdown after you install a series of hotfixes and then try to restart the computer

·         951499 When you use Windows Desktop Search (WDS) or Instant Search to perform a search on traditional Chinese characters on a Windows Vista-based computer, the search results are incorrect

·         942392 On a Windows Vista-based computer, you cannot access certain directories on a Web Distributed Authoring and Versioning (WebDAV) server

Internet Explorer - 2 KB articles:

·         951593 Error message when the Mshtml.dll component causes Internet Explorer 6 to exit unexpectedly in Windows XP SP2 or in Windows Server 2003: "Internet Explorer has encountered a problem and needs to close"

·         944410 Two or more cookie files for one Web site exist in the Temporary Internet Files folder when you use Internet Explorer to browse a cookie enabled Web site

Regards,

Content Team

Things you can do from here:

• Subscribe to TechNet Blogs using Google Reader
• Get started using Google Reader to easily keep up with all your favorite sites

Sent to you by Chris McMillan, Federal Marketing Manager via Google Reader:

May 6 - May 12 Hot-Fix KB articles Weekly Release - Windows Server

Hi Everyone,

Last week, 8 Windows Server products related hot-fix KB articles were released, including 5 for Windows Server 2003, 1 for Systems Management Server, 2 for Data Protection Manager. Below are the details:

Windows Server 2003- 5 KB articles:

·         951749 Stop error message on a terminal server that is running Windows Server 2003 SP1 or Windows Server 2003 SP2: "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"

·         951059 On a Windows Server 2003-based computer, registry-based policy settings are unexpectedly removed after a user logs on to the computer

·         950928 Error message when you restart a computer that is running Windows Server 2003 or an x64-based version of Windows XP Professional: "Stop 0xC000021A"

·         949391 When Volume Shadow Copy Service (VSS) tries to delete hardware support snapshots on a computer that is running Windows Server 2003 or an x64 version of Windows XP, the operation may fail

·         946565 On a Windows Server 2003-based computer that has the update from security bulletin MS07-062 installed, you may experience a memory leak in DNS

Systems Management Server - 1 KB articles:

·         949767 When you use PXE to run a task sequence on a System Center Configuration Manager 2007 client computer, the task sequence does not run

Data Protection Manager - 2 KB articles:

·         949783 After you use System Center Data Protection Manager 2007 to back up a SharePoint site, file recovery operations fail

·         949561 Network bandwidth usage throttling may not work in System Center Data Protection Manager 2007 if some network ports are unused

Regards,

Content Team

Things you can do from here:

• Subscribe to TechNet Blogs using Google Reader
• Get started using Google Reader to easily keep up with all your favorite sites

Sent to you by Chris McMillan, Federal Marketing Manager via Google Reader:

MS08-026: How to prevent Word from loading RTF files

This month we released an update for Microsoft Word that fixed issues relating to loading RTF files (CVE-2008-1091) and HTML files (CVE-2008-1434).  Office applications like Microsoft Word can load a large variety of different file formats, and some people may want to reduce their attack surface by disabling the formats they don’t typically use.  As of May 2007, Office 2003 and 2007 have had a feature in place called File Block which allows you to do exactly that via the registry. 

It’s important to note that the file extension doesn’t tell you what format a file is.  For example, you can rename an .RTF or .HTM file to .DOC, and Microsoft Word will load it.  File Block doesn’t key off the file extensions; these format “kill switches” are actually checked in each of the file format parsers, so the restriction can’t be bypassed by simply changing a file’s extension.  That means that simply disabling the file association between .RTF and Microsoft Word will not prevent Word from loading potentially malicious RTF files, since they can end with a .DOC extension.

Microsoft Word, Excel, and PowerPoint can each load a number of different formats which you can individually disable with File Block.  You can also specify a trusted (Office 2007) or exempt (Office 2003) folder, so that files loaded from that location are always allowed through. 

Here are some links that explain how to enable File Block and also how to configure trusted/exempt folders:

• For Microsoft Word: http://support.microsoft.com/kb/922849
• For Microsoft Excel: http://support.microsoft.com/kb/922848
• For Microsoft PowerPoint: http://support.microsoft.com/kb/922847

For general information about File Block and MOICE see this advisory: http://www.microsoft.com/technet/security/advisory/937696.mspx. 

We talk about File Block and MOICE with customers as often as we can.  Our team has presented this information at FIRST 2007, BlueHat 2007, CanSecWest 2008, and on several customer visits.  We are hoping the Black Hat selection committee will accept our talk for the 2008 Vegas conference.  Let us know (mailto: switech _at_ microsoft _dot_ com) if you have questions about File Block or MOICE, and we can either answer them or put you in touch with someone who will have the answer.

- Security Vulnerability Research & Defense Bloggers

*Postings are provided "AS IS" with no warranties, and confers no rights.*

Things you can do from here:

• Subscribe to TechNet Blogs using Google Reader
• Get started using Google Reader to easily keep up with all your favorite sites

Sent to you by Chris McMillan, Federal Marketing Manager via Google Reader:

Stop 0x8E errors after updating Symantec Antivirus 10

We are seeing cases with a Stop 0x8E errors after an update to Symantec Antivirus 10.

Prior to setting the trap frame the stack will normally look like

STACK_TEXT:

f642633c 8085b4af 0000008e c0000005 f5148223 nt!KeBugCheckEx+0x1b f6426700 808357a4 f642671c 00000000 f6426770 nt!KiDispatchException+0x3a2

f6426768 80835758 f64267e4 f5148223 badb0d00 nt!CommonDispatchException+0x4a f6426780 8089c27a 863cf008 e53e74d0 e1fa5008 nt!KiExceptionExit+0x186

f64267e4 f6e7d4ff f6eaafb8 e5330428 e2c95755 nt!ExFreePoolWithTag+0x277

WARNING: Stack unwind information not available. Following frames may be wrong.

f6426814 f6e7ddb6 f6426840 f642683c f642684c savrt+0x234ff 00000000 00000000 00000000 00000000 00000000 savrt+0x23db6

After setting the trap frame, the stack and registers will normally look like

eax=75100824 ebx=e53e74d0 ecx=f50f7400 edx=e2c95755 esi=e5330428 edi=f642683c

eip=f5148223 esp=f64267e4 ebp=f64267e4 iopl=0         nv up ei pl nz na pe nc

cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206

navex15+0x51223:

f5148223 8138dedaaeab    cmp     dword ptr [eax],0ABAEDADEh ds:0023:75100824=????????

  *** Stack trace for last set context - .thread/.cxr resets it ChildEBP RetAddr  Args to Child

WARNING: Stack unwind information not available. Following frames may be wrong.

f64267e4 f6e7d4ff f6eaafb8 e5330428 e2c95755 navex15+0x51223

f6426814 f6e7ddb6 f6426840 f642683c f642684c savrt+0x234ff 00000000 00000000 00000000 00000000 00000000 savrt+0x23db6

At this point, we believe the system is crashing due to a version mismatch between an updated version of Navex15 and older versions of Savrt and symevent.

    Image name: navex15.sys        Timestamp:        Mon Feb 11 13:41:31 2008 (47B0A4EB)

    Image name: SYMEVENT.SYS       Timestamp:        Tue Apr 18 19:16:26 2006 (4445815A)

    Image name: savrt.sys          Timestamp:        Mon Dec 19 22:24:48 2005 (43A78790)

The versions listed for Symevent and Savrt may be different than the ones listed, but so far they have all been at least a year older than Navex15.sys.

Customers should contact Symantec for support. As a workaround we can try the following

Have the customer uninstall Symantec Antivirus 10 and then reinstall the updated version.

This should hopefully put the correct version of files in place.

Things you can do from here:

• Subscribe to TechNet Blogs using Google Reader
• Get started using Google Reader to easily keep up with all your favorite sites

Sent to you by Chris McMillan, Federal Marketing Manager via Google Reader:

New Microsoft Update Catalog ROCKS!

Have you seen the new Microsoft Update Catalog? Check it out!

It gives you the ability to download as many updates as you need for various operating systems in a matter of minutes (or as fast as your download speed will allow).

http://catalog.update.microsoft.com/v7/site/home.aspx

Enter KB article number for the update into the search field and click Search.

The search results are then displayed. Click on the Add button next to the updates you wish to download.

Repeat as many times as you would like for as many different updates as you would like.

When you’re done, click on View Basket.

Remove any updates you no longer want or click Download.

Provide download location.

Receive nice pretty progress bars for each update which you can cancel at any time. 

Then you’re done:

Install to the appropriate operating system at your leisure.

Enjoy!!

Author:

Charity Shelbourne
Support Escalation Engineer
Microsoft Corporation Enterprise Support

Things you can do from here:

• Subscribe to TechNet Blogs using Google Reader
• Get started using Google Reader to easily keep up with all your favorite sites

Sent to you by Chris McMillan, Federal Marketing Manager via Google Reader:

Q1 2008 - Client OS Vulnerability Scorecard

This paper is a compilation of vulnerability data for client operating systems for the first 3 month, January through March, of 2008. Vulnerabilities and fixes for the following products are discussed:

• Microsoft Windows Vista
• Microsoft Windows XP SP2
• Red Hat Enterprise Linux Desktop (v. 5 client)
• Red Hat Enterprise Linux WS (V. 4)
• Ubuntu 6.06 LTS Desktop
• Apple Mac OS X 10.5 (Leopard)
• Apple Mac OS X 10.4 (Tiger)

For January through March of 2008, Mac OS X users experienced the highest number of vulnerabilities as well as the highest number of High severity vulnerabilities while Windows Vista users experienced the fewest and the fewest High severity vulnerabilities.

Here is the chart breaking down all of the OSes by NVD severity ratings:

Download the attached paper for full details.

Share this post :

Things you can do from here:

• Subscribe to TechNet Blogs using Google Reader
• Get started using Google Reader to easily keep up with all your favorite sites

Sent to you by Chris McMillan, Federal Marketing Manager via Google Reader:

More on Windows XP Service Pack 3...

We'd like to provide more information and address reports you may have heard about  "continuous reboot loops" occurring upon the update to Windows XP SP3. 

After investigation, we’ve determined this problem occurs on AMD-based machines with Windows XP images that were originally captured by an OEM on an Intel-based machine.   The problem is a registry value, present on images created w/ Intel processors, that causes a driver (intelppm.sys) to load at boot.  When intelppm.sys attempts to load on an AMD-based system upon the install of SP3, it causes a blue screen and the continuous reboot.  We’re planning to add a filter to prevent Windows Update from offering SP3 to affected systems and are investigating a fix. Any customers affected by this issue should contact Microsoft Customer Support Services for assistance. More information is available in KB88372 and here.

On a related note, we've heard a few questions about SP3’s distribution.  To clarify our earlier post, SP3 is currently available as a High Priority update on the Windows Update website.  This means that if you go to WU and do an express or custom install - you should see SP3 listed.  We’re pl