startupware.com

Reversing the Model for Spyware Removal

Archive for January, 2006

WMF Patch Released Early

Posted: Saturday, January 7th, 2006 @ 9:48 am in Field Reports | No Comments »

On Thursday, Microsoft released the patch to remove the “SETABORTPROC” functionality from WMF image processing. The patch is on Windows update as # MS06-001, and should be installed on all systems running Windows 2000 and above. Anyone who previously installed the unofficial patch should first install the Microsoft patch, and then uninstall the unofficial patch. […]

Self-Imposed Doorstops

Posted: Friday, January 6th, 2006 @ 12:36 pm in Field Reports | Comments Off

Another day, another cleanup. This morning’s cleanup was described by a new customer like this: “It’s broken. We can’t run our customer database program. The night staff keeps surfing the internet, and loading spyware, so that’s probably it.”
What I found was a computer that, on first look, had shortcuts to software on a drive “y:\” […]

WMF Exploits

Posted: Tuesday, January 3rd, 2006 @ 11:37 am in Field Reports | No Comments »

The newest security issue for Windows is the WMF hole. First, a little history. WMF is the acronym for a Windows Meta File. That’s an old graphics format, vector style. Vector art is drawn by the computer, based on code in the file. (The other kind of graphics is a bitmap, like JPG.) Of […]