MSRT

When you do a Microsoft Update every month (I hope you do!) then you’ll find that one of the items listed is the Malicious Software Removal Tool (MSRT for short) update. Now for months I’ve simply applied the update as a normal part of the process not even caring what it does.

So I did some research and found that Microsoft actually have a site dedicated to telling you what the MRST is all about. You’ll find it at:

http://www.microsoft.com/security/malwareremove/default.mspx

and as the site says

The Microsoft Windows Malicious Software Removal Tool checks computers running Windows Vista, Windows XP, Windows 2000, and Windows Server 2003 for infections by specific, prevalent malicious software—including Blaster, Sasser, and Mydoom—and helps remove any infection found. When the detection and removal process is complete, the tool displays a report describing the outcome, including which, if any, malicious software was detected and removed.

Now, it is updated monthly to include checking for all the newest nasties. I’m not quite sure how it exactly works but it sits in the background monitoring for rogue software. If it detects any you are informed at the next login. It is my understanding that the tool actually does a scan once a month when it is updated. More technical information on the tool can be found at:

http://support.microsoft.com/?kbid=890830

You always gotta wonder what something like this is doing sight unseen in your machine. Is it running? Is it doing anything? Well, as it turns out you can run the tool from the command line. Simply press the Start button, select the Run command from the menu and type MRT and press enter. After a few welcome screens you are able to select from a number of scan options.

Select the scan desired and press Next.

When it’s all done you should hopefully see

Now the tool doesn’t replace anti virus/anti spyware software but it is worth ensuring that you update your system every month via Microsoft Update to ensure you get this handy free utility.

Change is bad

So I’ve been looking at IE8 which comes with Windows 7. Now all this is still in beta and may be subject to change but I can’t comprehend why Microsoft has done the following.

To run Windows Update in IE7 in you went Tools | Windows update like so:

But now in IE8 Windows Update doesn’t live under the Tools menu

It live under the safety menu

I’ll tell you one thing, it is changes like these that really confuse and annoy the average user. It may make sense to the programmers in Redmond but to your average IE user it doesn’t. You would also think that to encourage people to run Windows Update you’d leave the option to do so in the same location, but no.

Sure, it may be a small thing but it makes it just that little bit harder and more frustrating for users. That is going to translate into reduced product acceptance and greater frustration, not to mention the extra support. I can just hear the support calls now – “Are you running IE8 or IE7. Ok, is Windows Update under the Tools menu? No? Oh well that means ….”

It really doesn’t make things easier in my books!

Too hard

I’ve been reading the news about the latest worm that has now infected 8.9 million machines. Now if you believe the reports:

“From an estimated 2.4 million infected machines to over 8.9 million during the last four days. That’s just amazing.” – CRN Australia

“It is the most serious large scale worm outbreak we have seen in recent years because of how widespread it is” – CNN

Now how can that be? IT companies spend so much of their time reinforcing to clients that they need to update their machines. Many have already put in place automated patching tools and still the number of infections rises faster than ever before. How can this be? The vulnerability was patched last October by Microsoft yet it goes to show how few systems out there are being patched regularly.

Many would point the finger at home users who rarely update their machines. I must say that I agree with that assessment because most of the students I ask in my IT courses never update their machines. This attitude makes us all vulnerable. Is it their fault for not patching or someone else’s for making it too hard?

Doesn’t it strike anyone else that things are not getting better they appear to be getting worse? For all the banging on IT people do about security each new worm outbreak happens faster every time. How can people have confidence in our connected world if so many machines can be compromised so quickly? Sure, maybe these report are over blown and maybe the infection does do that much ‘damage’ but don’t you get the feeling it is only a matter of time?

Clearly, keeping systems up to date is simply too hard for the vast majority of users. Clearly, the message about IT security is not getting through. Clearly, many people have no idea that their machines have been compromised. Clearly we need to do something. Clearly it seems, everything we have tried so far hasn’t worked! Any ideas?

I thought I had updated

A few days ago, like many IT people worldwide, I received a distressed call from a friend about the recent Microsoft Internet Explorer issue that they had seen all over the media. What did they need to do? I told them that they had to run a Microsoft Update from their browser. Having never done this (first bad sign) I had to given them an idea of what needed to be done. They were much calmer now knowing what make then safe. After not hearing again from them after a few day I assumed all was fine.

I was actually visiting this same friend today so I thought I’d just take a look at their system to ensure that it had been updated. I was amazed to find that the machine was not up to date at all and in fact was still vulnerable. After starting the update process I quizzed my friend as to why they hadn’t updated. Their reply was “I thought I had”.

So what happened? In theory Microsoft Update is only for Microsoft to inform the user about patches that need to be applied to the system. That is UNLESS they haven’t installed Service Pack 3 for Windows XP! If that hasn’t been installed you’ll see a screen like this:

The top option, and the one most likely to be picked by unsuspecting users like my friend, is to install Windows XP Service Pack 3 and no other updates. So what happened is my friend pushed the top button, not reading the actual instructions on the page, as non-computer people do, and merely installed Windows XP Service Pack 3 on their machine and nothing else.

Was their machine still vulnerable? Yes. Were they likely to run another update? Nope. Chalk up another win for the bad guys. This time in my books it really is an own goal on Microsoft’s part. Sure Windows XP Service Pack 3 is important but it isn’t a critical update. Being the first choice on the screen it is what most users (who aren’t computer people) are going to select in their quest to be “safe” given all the hysteria. Microsoft updates should be for critical updates only and if you are going to put a message about a Service Pack make it the second choice. Microsoft, please remember, most people have no idea about technology.

Perhaps I should have told my friend to keep running Microsoft Update until there were no more updates. Perhaps they should have read the update screen more carefully. Maybe, maybe, maybe. Yet it only takes one maybe for an attacker to compromise a system. Once they get control, your only real option is to reformat and reload, today’s malware is just too sophisticated for any cleaning tool to deal with 100% effectively. To guarantee that your system is clean after an infection the only option is a complete reload. Who wants to do that? No-one but the odds are stacked in an attackers favour. Why? You need to defend your system against EVERY threat in Windows, Office, iTunes, Acrobat and piece of software you have installed on your machine. Not just Windows, the lot. An attacker only needs to exploit ONE SUCCESSFULLY and they can have control. So who’s got the better odds? It certainly isn’t you!

It further illustrates to me the divide between those that develop IT systems and those that use them. The void between the level developers believe users are and where they actually are is immense and getting bigger everyday. Wasn’t technology supposed to get easier? The reality is that is only getting easier for attackers to compromise systems. What does that say for a system we put so much faith in these days. Our common technology is built on very shaky ground, very shaky indeed.

Is nothing safe?

Ok, if you haven’t read the news or seen the TV then you should know that you need to patch Internet Explorer urgently. In the meantime the reports indicate that you shouldn’t use Internet Explorer to browse the web.

No problems you say, I’ll use FireFox instead. Ahh, wait on there. Apparently Firefox tops the list of the 12 most vulnerable applications on Windows according to this report.

So no more web browsing until the patch gets applied. Will you are downloading the patch consider this story that a company involved with the new frontrunner’s bid for Australia’s national broadband network has links with the Chinese military.

Man. Why would anyone ever use the Internet? Problem is, they are still going to aren’t they? And many won’t be updating their systems, so it makes the Internet an even more dangerous place even if YOU do the right thing.

It’s a real double edged sword isn’t it? So, please update your systems and get others to update theirs as well because we’re all in this together.

Security videos

Have a look at these security videos from Watchguard. Down the bottom of the page you’ll also find some videos that may help ‘non-IT’ people understand some simple security principles.

The good thing is that you can download the videos and use them offline.

Here’s a pretty cool site

Just came across this really nice offering from Trend Micro. I think the site tries too hard to be all glitzy and Web 2.0 and may be a little slow at time but it is a great resource once you get it running. The entry page is:

http://itw.trendmicro.com

You’ll see that I’ve clicked on the Trend Tracker to get a load of interesting statistics.

You can navigate by clicking on the little page icons (looks a bit like the aero interface) in the top left of the window. Down the right hand side you’ll find a whole heap of handy links.

When you click on the TrendIQ section you’ll also find on the left a number of videos which aren’t too bad. They maybe something worth showing your customers to give them a better idea of the security threats faced and why Internet security is important.

I haven’t seen any advertising of this site by Trend which is strange because I think it is a great resource.