Captain's Blog

Microsoft Recommends Shavlik

Its pretty well known that we have been working on patch management for a long time, creating MBSA and now providing Shavlik NetChk Limted, which is directly recommended by Microsoft.  We are focused helping assure our customer's and the industry in general are getting strong security support. Our on going relationship with Microsoft is key to this.

Here are some related links:

Microsoft

Legacy Product Support: For customers using legacy products not supported by MBSA 2.0.1, Microsoft Update, and WSUS, Shavlik Technologies provides a free MBSA 2.0.1 companion tool called Shavlik NetChk Limited.

Users who have the following products in their environment can use Shavlik NetChk Limited to augment MBSA 2.0.1 results for comprehensive security update detection.

•	Office 2000
•	ISA Server 2000
•	FrontPage Server Extensions 2000/2002
•	Visual Studio .Net 2002/2003
•	SQL Server 7.0/2000
•	Other products not included in Microsoft Update's supported product list

WindowsITPro

"Shavlik Technologies was an easy choice for Microsoft to go to for providing continuity in supporting [complete security scanning] for customers who are using some of the older products," said Stephen Toulouse, Group Program Manager at Microsoft. "Shavlik has an intimate knowledge of security detection requirements since they helped develop the first version of MBSA for Microsoft."

Redmond Mag

ENT

Shavlik's NetChk Protect Limited searches for critical  security patches and spyware. However, the free version does not install patches  or remove spyware, according to the product's Quick Start Guide posted on  Shavlik's Web site. 

Get this free product, without any registration or timeous here.

Windows Server 2003 SP2

Shavlik Technologies has released updated patch XML files for Shavlik HFNetChkPro and Shavlik NetChk Protect.

XML data version = 1.1.3.3402  Last modified on 3/13/2007

This update includes the following changes:

- Added Windows Server 2003 SP2
   Before installing SP2, Microsoft recommends removing IE7 (if installed)
   This service pack is currently available for English and German systems only.

- Updated the malicious software removal tool

- The Shavlik XML Team

Apple QuickTime 7.1.5

Shavlik Technologies has released updated patch and spyware XML files for Shavlik HFNetChkPro and Shavlik NetChk Protect.

XML data version = 1.1.3.3374  Last modified on 3/6/2007

This update includes the following changes:

- Added AQ07-001 (QAQ7150) Apple QuickTime 7.1.5 update (available as a patch and as a software distribution item)
- Added x64 patches for Internet Explorer for MS05-052 and MS05-054.

- The Shavlik XML Team

New Spyware sigs from Shavlik data team

Shavlik Technologies released new data files for the NetChk Spyware and NetChk Protect application this evening.  Details are below:

- Jason

*****************************************************

 

Version 5.6

XML Date: 01/04/2007

XML Version: 1.0.2.1452

XML Object Count: 101,449

 

Version 5.5

XML Date: 01/04/2007

XML Version: 1.0.2.1454

XML Object Count: 101,092

 

 

Added Video ActiveX Object

-Category: Nonbizware

-Details: Video ActiveX Object claims to be a video codec. Certain websites require this codec to be installed to play a video. This program has the potential to install unwanted software. From the EULA: …"SOFTWARE INSTALLATION: Components bundled with our software may report to Licensor and/or its affiliates the installation status of certain marketing offers, such as toolbars, and also generalized installation information, such as language preference and operating system version, to assist Licensor in its product development. No personal information will be communicated to Licensor or its affiliates during this process. Licensor may offer additional components through our version checking/update system. These components include: (a) "Internet Explorer Security Plugin 2006": Internet Explorer toolbar that protects your computer while you browse by setting high level of security for suspicious hosts. (b) "Public Messenger ver 2.03": Popup advertising module that opens Internet Explorer ad windows when you are connected to internet. (c) "Internet Security Add-On": your Internet Explorer homepage will be changed. (d) Security software: antivirus/antispyware application."

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Low

 

Added Virus Rescue

-Category: Nonbizware

-Details: Virus Rescue claims to be an Antivirus application.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Moderate

 

Added Video Access

-Category: Nonbizware

-Details: Video Access claims to be a video codec. Certain websites require this codec to be installed to play a video. This program has the potential to install unwanted software. In testing, versions of this program installed a rootkit version of the Zlob virus.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Critical

 

Added Ad-Protect

-Category: Nonbizware

-Details: Ad-Protect claims to be an anti-spyware program. After scanning a system, the program will prompt users for registration (purchase). This program is a variant of the Spy-Shield and Virus Blast program family.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Moderate

 

Added new version of PestTrap

-Category: NonBizWare

-Details: PestTrap claims to be an anti-spyware application. It appears to be a rebranded version of SpyNO/SpySheriff. During operation, it displays pop up warnings instructing a user to purchase a full copy of the program.

-Comments: New version of PestTrap added to the database.

-Risk/Severity: Low

 

Updated Spy-Shield

-Details: Updated signature to remove false positive detection with the Virus Blast and Ad-Protect signatures.

 

Updated VirusBlast

-Details: Updated signature to remove false positive detection with Spy-Shield and Ad-Protect signatures.

 

Updated Spy-No

-Details: Updated signature to remove false positive detection with the PestTrap signature.

 

Updated PestTrap

-Details: Updated signature to more accurately detect file versions with this signature.

 

FF06-010 Firefox 1.5.0.9 (QFF1509 and QFF1519)

Shavlik Technologies has released updated patch XML files for Shavlik HFNetChkPro and Shavlik NetChk Protect.

XML data version = 1.1.3.3129 Last modified on 12/20/2006

This update includes the following changes:

Added FF06-010 Firefox 1.5.0.9 (QFF1509 and QFF1519) as a security patch and a software distribution item Added FF06-011 Firefox 2.0.0.1 (QFF2010 and QFF2011) as a security patch and a software distribution item

December Patch Day

**Update** Shavlik Technologies has been receiving some questions this week around two Microsoft patches that were released this past Patch Tuesday: MS06-073: Vulnerability in Visual Studio 2005 Could Allow Remote Code Execution (925674) Visual Studio 2005 and MS06-077: Vulnerability in Remote Installation Service Could Allow Remote Code Execution (926121) Remote Installation Services (RIS). We have communicated to our customers that these two patches are not currently supported by Shavlik products and cannot be scanned for or deployed using Shavlik products, and customers are asking why not. We want our customers to know that the security of their networks is the number one concern of Shavlik Technologies. We have been watching the market very closely over the last year and see the factual evidence of an increased need for patches for the Microsoft Operating System, Microsoft Applications, and non-Microsoft Applications. The number of patches released each month is on the rise for each of these scenarios. In order for Shavlik to continue to be the most responsible vulnerability management vendor in the market, we are responding to this increasingly complex threat environment with a new, breakthrough patch engine technology that we internally refer to as “Dynamic Product Detection” (DPD). The final name for this new capability when released has not yet been decided upon. Our new DPD technology will enable us to not only continue to patch the Microsoft Operating System and applications but this will also allow us to quickly release patches for non-Microsoft applications which have been exploited in the last few months. DPD will make our detection capability significantly more comprehensive, allowing customers to respond to multi vendor application threats to their servers and desktops. DPD will be released in early Q1, 2007.

Shavlik Technologies has released updated patch XML files for Shavlik HFNetChkPro and Shavlik NetChk Protect.

XML data version = 1.1.3.3117 Last modified on 12/12/2006

**Please read NOTE below about two patches that are NOT supported by Shavlik.**

This update includes the following new patches:

MS06-072: Cumulative Security Update for Internet Explorer (925454)

MS06-074: Vulnerability in SNMP Could Allow Remote Code Execution (926247)

MS06-075: Vulnerability in Windows Could Allow Elevation of Privilege (926255)

MS06-076: Cumulative Security Update for Outlook Express (923694)

MS06-078: Vulnerability in Windows Media Format Could Allow Remote Code Execution (923689)

This update includes the following changes:

MSRT-001: Malicious Software Removal Tool - December Update

MS06-059: Patch for Excel 2002 has been updated. Detection logic has not changed.

If you previously installed this patch, there is no need to re-install this patch.

MSWU-093: Australian Daylight Savings Time download URL has been updated.

**PLEASE NOTE**

MS06-073: Vulnerability in Visual Studio 2005 Could Allow Remote Code Execution (925674) Visual Studio 2005 is NOT supported by Shavlik products and cannot be scanned for or deployed using Shavlik products.

MS06-077: Vulnerability in Remote Installation Service Could Allow Remote Code Execution (926121) Remote Installation Services (RIS) is NOT supported by Shavlik products and cannot be scanned for or deployed using Shavlik products.

- The Shavlik XML Team

APSB-0620. Patch for Adobe Reader and Adobe Acrobat

Shavlik Technologies has released updated patch XML files for Shavlik HFNetChkPro and Shavlik NetChk Protect.

XML data version = 1.1.3.3096  Last modified on 12/8/2006

This update includes the following changes:

- Added APSB-0620.  Patch for Adobe Reader and Adobe Acrobat version 7.x Additional Info here: http://www.adobe.com/support/security/bulletins/apsb06-20.html

This patch will require a reboot if the affected Adobe file is in use when the patch is installed.

- The Shavlik XML Team

new patches

Shavlik Technologies has released updated patch XML files for Shavlik HFNetChkPro and Shavlik NetChk Protect.

XML data version = 1.1.3.3057  Last modified on 11/14/2006

This update includes the following changes:

Microsoft Security Bulletin MS06-066
Vulnerabilities in Client Service for NetWare Could Allow Remote Code Execution (923980)
Severity: Important http://www.microsoft.com/technet/security/Bulletin/MS06-066.mspx

Microsoft Security Bulletin MS06-067
Cumulative Security Update for Internet Explorer (922760)
Severity: Critical http://www.microsoft.com/technet/security/Bulletin/MS06-067.mspx

Microsoft Security Bulletin MS06-068
Vulnerability in Microsoft Agent Could Allow Remote Code Execution (920213)
Severity: Critical http://www.microsoft.com/technet/security/Bulletin/MS06-068.mspx

Microsoft Security Bulletin MS06-069
Vulnerabilities in Macromedia Flash Player from Adobe Could Allow Remote Code Execution (923789)
Severity: Critical http://www.microsoft.com/technet/security/Bulletin/MS06-069.mspx

Microsoft Security Bulletin MS06-070
Vulnerability in Workstation Service Could Allow Remote Code Execution (924270)
Severity: Critical http://www.microsoft.com/technet/security/Bulletin/MS06-070.mspx

Microsoft Security Bulletin MS06-071
Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (928088)
Severity: Critical http://www.microsoft.com/technet/security/Bulletin/MS06-071.mspx

Malicious Software Removal Tool (updated)

- The Shavlik XML Team

patch updates from the data team

Shavlik Technologies has released updated patch XML files for Shavlik HFNetChkPro and Shavlik NetChk Protect.

XML data version = 1.1.3.3033  Last modified on 10/25/2006

This update includes the following changes:

Microsoft has 're-released' the patch for Project 2002 for MS06-062.  The patch itself hasn't changed - if you previously deployed this patch, there is no need to re-deploy the patch. 

Microsoft originally named the Project patch the same name as the Office 2002
patch - thus creating confusion for customers.  This re-release is to address
the renamed patch and updated download URLs.  Although the underlying patch
contents has not changed, the file size and date\time of the patch has changed,
therefore the Shavlik product will redownload this patch.

Shavlik has also modified the QNumbers of the recent Firefox patches - specific to the software distribution entries for these patches.  Scan templates using patch groups for software distribution patches may need to be reviewed to ensure that the appropriate qnumber is still selected.

- The Shavlik XML Team

Install Mozilla Firefox 2.0 w/o agents

(From the Shavlik Data Team)

Shavlik Technologies has released updated patch XML files for Shavlik HFNetChkPro and Shavlik NetChk Protect.

XML data version = 1.1.3.3031 Last modified on 10/24/2006

This update includes the following changes:

Added FF06-008 (QFF2000) Mozilla Firefox 2.0.

A security patch scan will identify systems running earlier versions of Firefox and will prompt to update them to version 2.0. A software distribution scan will enable you to deploy Firefox 2.0 to systems where Firefox has not been previously installed.

NOTE: When deploying Firefox 2.0 to systems where Firefox has been previously installed, the deployment will pause and will display a message to the screen if it determines that a version of Firefox is currently in use on that system.

The deployment process will not continue until a user clicks 'OK' to close Firefox.

- The Shavlik XML Team