Captain's Blog

Shavlik Cash For Clunkers

Douglas thanks for the nice note about our $4500 rebate program which we called Shavlik Cash For Clunkers for obvious reasons and it was too much fun to resist the name.  But the rebate is real, up to $4500 back until Sept 15th or the $1M we set aside in rebates is gone, so for smaller customers the product is in effect free if you turn in your clunker for destruction.  Given the value of this deal we will need to make sure its a trade-in, just like the Fed Gov is doing.

We do ask people pay for the maintenance as it covers our very frequent updates to our anti-virus, spyware and patch data as well as phone support.  And thanks to Sunbelt software for working with us to make this happen.  Since we license our software in a perpetual model the maintenance pricing is not full subscription pricing, make this a true high value deal.  Click here for details etc.

Why are we going with Sunbelt for our AV-Antispyware?

I went to lunch today with one of our top resellers and he asked me, "I like what you are doing in the AV space but why did you selected Sunbelt?" and I thought it would be a good idea to widely share my answer.

To start, we made our partnering decision over two years ago and we are happy with the results.

I have known the leadership at Sunbelt Software for many years and they are trustworthy and great people to work with, that was very important to me because like any relationship all parties need to work together well through thick and thin and over time.  (I also know the leadership at a number of other AV related companies and they are good, trustworthy people who make great products also so this was not the only reason to work with SB, but it was a required first step).

The next step was for us to find who had a great spyware engines as many modern attacks act like spyware even though they are often considered to be viruses and Sunbelt was at the top of the list from their work with Giant which was sold to Microsoft a few years ago.  My security team felt SB had great dedication to the industry and working with them was a no-brainer.  Then SB added their Viper AV engine and he picture was completed.  They have certifications from well known labs are more are on the way which is good, but their technology is new.  But not that new, it has been around for a while now and with the new-ness comes new ways of doing things, light, fast etc. as it does not need to carry the code that solves old problems.  These new ways create a great product.

The vendor we selected also needed to have a great SDK since we are doing a complete integration. So I had my engienering team visit with SB and review their engineering process along with their SDK and I got the thumbs up, so add another big green check box because of the integration fails we all fail.

We also needed to develop a business partnership in which we could add strong AV in to our existing products without a financal large impact to our end-users on pricing and SB was very creative in helping us create a win-win-win between our customers, SB and us.  Great news. 

I also wanted to create something new, not just a bolt on but a new way of managing computers for patch management and AV-Spyware. I wanted a new company to work with so we could work together more from the ground up which we have done, our UI and their AV and Spyware tools and data to create a new work and with 7.0 we have hit that goal as our upcoming release will show -- I hope everyone gives it a try and when your current AV subscription comes up you can just remove it from you budget as you will already have a new solution in place from us.

Microsoft Recommends Shavlik

Its pretty well known that we have been working on patch management for a long time, creating MBSA and now providing Shavlik NetChk Limted, which is directly recommended by Microsoft.  We are focused helping assure our customer's and the industry in general are getting strong security support. Our on going relationship with Microsoft is key to this.

Here are some related links:

Microsoft

Legacy Product Support: For customers using legacy products not supported by MBSA 2.0.1, Microsoft Update, and WSUS, Shavlik Technologies provides a free MBSA 2.0.1 companion tool called Shavlik NetChk Limited.

Users who have the following products in their environment can use Shavlik NetChk Limited to augment MBSA 2.0.1 results for comprehensive security update detection.

•	Office 2000
•	ISA Server 2000
•	FrontPage Server Extensions 2000/2002
•	Visual Studio .Net 2002/2003
•	SQL Server 7.0/2000
•	Other products not included in Microsoft Update's supported product list

WindowsITPro

"Shavlik Technologies was an easy choice for Microsoft to go to for providing continuity in supporting [complete security scanning] for customers who are using some of the older products," said Stephen Toulouse, Group Program Manager at Microsoft. "Shavlik has an intimate knowledge of security detection requirements since they helped develop the first version of MBSA for Microsoft."

Redmond Mag

ENT

Shavlik's NetChk Protect Limited searches for critical  security patches and spyware. However, the free version does not install patches  or remove spyware, according to the product's Quick Start Guide posted on  Shavlik's Web site. 

Get this free product, without any registration or timeous here.

Article from Michael Vizard at Ziff Davis

Michael's blog

While security vendors are quick to play the fear card when it comes to trying to get you to buy their products, one of the issues that terrifies security vendors most is the high cost of security. Instead, vendors like to bandy about terms like "unified threat management," which is basically their way of saying you should dump all your existing security products in favor of their products regardless of the fact that this generally means paying for the same products over again.

In fact, the only two vendors that seem to be trying to create a dialogue about the cost of security are Shavlik and Altiris. For those of you familiar with neither company, Shavlik focuses exclusively on security management software that not only promises to make it easy to manage what you have, but is also easy to install. They accomplish this by pulling data from each client that is then passed back to a centralized database. On top of that database Shavlik runs a policy server that provides a central point of control. On top of that Shavlik also offers tools that eliminate unauthorized applications from any client on the network and another tool that helps companies determine whether they are in compliance with any specific set of regulations.

Shavlik NetChk Pro Plus 5.8 is released

Shavlik NetChkPro Plus 5.8 is released!  Its not yet publicly announced, that will be coming soon.  Its new items are integrated agents with the agent-less, remote consoles and multiple-site database roll up for reporting.  Also included are delegation and patch policy based management and a number of other features based on extensive customer feedback.

We will be releasing the Protect (patch and spyware version) of this product shortly after the Patch only version.

This release is designed to meet the needs of over 6,000 customers, more than double of the next Pure Play Patch ISV - all of us at Shavlik Technologies thank you for your input and support for making us the market leader.

ARMing the Enterprise with Active Vulnerability Management™ Solutions

Thanks to Ken Camp for the next comments on our paper

Most of the online white paper libraries are filled with papers written by vendors. It’s important when using these resources that we not fall prety to any single vendor’s viewpoint. That said, these papers also provide a tremendous set of resources. Here’s a worthwhile paper I found today that’s very recent.

Here is the paper he is referring to, ARMing the Enterprise with Active Vulnerability Management™ Solutions

Patch Tuesday

Microsoft has released 10 new security bulletins today. Shavlik is currently testing these patches and will release updated XML files shortly.

Microsoft Security Bulletin MS06-056

Vulnerability in ASP.NET 2.0 Could Allow Information Disclosure (922770)

http://www.microsoft.com/technet/security/bulletin/ms06-056.mspx

Severity: Moderate

Microsoft Security Bulletin MS06-057

Vulnerability in Windows Explorer Could Allow Remote Execution (923191)

http://www.microsoft.com/technet/security/bulletin/ms06-057.mspx

Severity: Critical

Microsoft Security Bulletin MS06-058

Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (924163)

http://www.microsoft.com/technet/security/bulletin/ms06-058.mspx

Severity: Critical

Microsoft Security Bulletin MS06-059

Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (924164)

http://www.microsoft.com/technet/security/bulletin/ms06-059.mspx

Severity: Critical

Microsoft Security Bulletin MS06-060

Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (924554)

http://www.microsoft.com/technet/security/bulletin/ms06-060.mspx

Severity: Critical

Microsoft Security Bulletin MS06-061

Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution (924191)

http://www.microsoft.com/technet/security/bulletin/ms06-061.mspx

Severity: Critical

Microsoft Security Bulletin MS06-062

Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (922581)

http://www.microsoft.com/technet/security/bulletin/ms06-062.mspx

Severity: Critical

Microsoft Security Bulletin MS06-063

Vulnerability in Server Service Could Allow Denial of Service (923414)

http://www.microsoft.com/technet/security/bulletin/ms06-063.mspx

Severity: Important

Microsoft Security Bulletin MS06-064

Vulnerabilities in TCP/IP IPv6 Could Allow Denial of Service (922819)

http://www.microsoft.com/technet/security/bulletin/ms06-064.mspx

Severity: Low

Microsoft Security Bulletin MS06-065

Vulnerability in Windows Object Packager Could Allow Remote Execution (924496)

http://www.microsoft.com/technet/security/bulletin/ms06-065.mspx

Severity: Moderate

- The Shavlik XML Team

MBSA 1.2.1 and MS06-055

Below is a nice detailed note from Doug Neal of partner Microsoft (we created mssecure.xml with them and MBSA 1.2.1 for them) as he posted on patchmanagement.org .  I wanted to also note that our latest MBSA compatable tool does provide one solution for all Microsoft patches - and there is a fully free scanner version along with other free versions of our software as I posted a note a while ago on.

(thanks to Doug)

You may want to read the MSRC bulletin for MS06-055 (http://www.microsoft.com/technet/security/Bulletin/MS06-055.mspx).  Although the MBSA team always provides a public announcement on the Microsoft.public.security.baseline_analyzer newsgroup, the MSRC bulletin will always be the authoritative source for all issues regarding a security update.

There is table within every MSRC security bulletin that identify the level of MBSA 1.2.1 and MBSA 2.0 support.  From the table, you can see that MS06-055 is not supported by MBSA 1.2.1 (which is based on the MSSecure.XML file).  MS06-055 is fully supported by MBSA 2.0 (which uses Microsoft Update and the WSUSSCAN.CAB file).

Any month MBSA 1.2.1 cannot provide support (usually due to technical limitations in the dated scan engine used by MBSA 1.2.1), Microsoft will provide a monthly edition of the standalone Enterprise Scan Tool (EST).  All of the links describing MBSA 1.2.1 support and the EST tool (when needed) can be found in the security bulletin.

Customers who are using the MSSecure.XML file outside of the three Microsoft-supported products (SMS 2.0 SUIT, MOM and MBSA 1.2.1) are not only using the catalog file in an unsupported manner, but are potentially at risk since the MSSecure.XML file will never contain data for bulletins it cannot support (see KB 306460 and KB 895660) which makes it less than authoritative for patch detection outside of the supported Microsoft tools.

The MSSecure.XML file will not include Office products (since an integrated version of the ODT tool is used instead).  MSSecure.XML will also not include bulletins that do not have MBSA 1.2.1 support (like Outlook Express, Windows Media Player 10/11, Internet Explorer 7.0, .Net Framework 1.0/1.1/2.0, Jscript, Microsoft's addition of Adobe Macromedia Flash in Windows, FrontPage Server Extensions, MDAC and a number of other components).  MSSecure.XML will also not include detection and support for 64-bit platforms or Vista.

Additionally, the standalone MBSA 1.2.1 tool will be decommissioned in the coming months in favor of MBSA 2.0 (already released) and an additional tool (yet to be named) that will remove the need for MBSA 1.2.1 detection by filling in the 'gap' of detection for products that are not supported in MBSA 2.0 (which is based on Microsoft Update and WSUS technologies).  See the MBSA home page at www.microsoft.com/mbsa for details as they become available.

Please feel free to post to the MBSA newsgroup (Microsoft.public.security.baseline_analyzer) if you have any questions regarding MBSA that Microsoft can answer since we may not always see them on this mailing list.

doug neal
Microsoft Baseline Security Analyzer (MBSA)
MBSA 1.2, 2.0, EST, CSA and MSSECURE.XML scan tools

Vote for us in SC Mag!

From Jill on our marketing team:

Hi all,

 We are officially in the running for the SC Magazine’s 2007 Global Awards / Reader Trust Category for the following:

1. Shavlik NetChk Protect for  Best Anti-Malware Solution (includes anti-spyware, virus, spam and patch management products)
2. Shavlik NetChk Compliance for Best Policy Management Solution

 

Voting is open to the public until October 13.  If you know anybody who is familiar with Shavlik NetChk Protect and Shavlik NetChk Compliance and would be willing to vote for our product, please pass along the following web address:

http://scmagazine.com/us/awards/categories/readerstrust

 

Once you click on the above link, click on the category of Best Anti-Malware, and vote.  Then go back to the original link and click on Best Policy Management and vote.

Sept Patch Day

From the Patch Team: (Mark: we are testing these patches on over 300 configurations via our automated system - this takes a bit of time, measured in hours - and when its done we will  update our servers with new XML that enables the management these patches.  We test for 26 languages also - all today - so everyone gets access as fast as possible)

Microsoft has released three new security bulletins and has re-released patches associated with two prior security bulletins

MS06-052

Vulnerability in Pragmatic General Multicast (PGM) Could Allow Remote Code Execution (919007)

Severity: Important

http://www.microsoft.com/technet/security/Bulletin/MS06-052.mspx

MS06-053

Vulnerability in Indexing Service Could Allow Cross-Site Scripting

(920685)

Severity: Moderate

http://www.microsoft.com/technet/security/Bulletin/MS06-053.mspx

MS06-054

Vulnerability in Microsoft Publisher Could Allow Remote Code Execution

(910729)

Severity: Critical

http://www.microsoft.com/technet/security/Bulletin/MS06-054.mspx

Re-releases:

MS06-040 has been re-released for Windows 2003 SP1

http://www.microsoft.com/technet/security/Bulletin/MS06-040.mspx

MS06-042 has been re-released for IE 5.01 SP4, IE6 SP1 on Win2K and XP, and IE 6 on Windows Server 2003

http://www.microsoft.com/technet/security/Bulletin/MS06-042.mspx