Chinese AV "Patches" Windows XP

As all of you know, Windows XP is dead.
Or it is? As far as the Chinese community is concerned, there is still hope.

Several AV companies had pushed for a special product where we do not see anywhere else in other markets known as "XP Protection". Basically, the AV Product claim to be able to protect even the unpatched XP against these new vulnerabilities and attacks.

Don't take my word for it. Recently, at "The EXP Challenger Contest". a total of 179 hackers and security experts coming from all over the world have tried to compromise Windows XP computers running：

• 奇虎 360 XP盾甲 
• 腾讯电脑管家（XP专属版本）
• 金山毒霸 XP防护盾

In the 13 hours event, only 腾讯 was broken in 57 seconds by "shaheshang", followed by 金山 later. Qihoo managed to withstand all the attacks.

So, what does this mean? Maybe for those Chinese who are not going to upgrade to new Windows for whatever reasons, they could use these products to actually provide them protection and continue to use Windows XP?

But there is a epilogue to the story. At the end of the event, a hacker "小小小乖兔" managed to break through 奇虎 as well. So, it does means that, maybe hard, but there is a way. Nothing is invulnerable.

So, I guess at least with such products around, it is safe to assume if the clients in Chinese are still using Windows XP, they will be deploying at least one of these products.

And lastly, all the listed products had been updated and are FREE.

Microsoft Re-Patch Tues Aug 2014

It seems that due to the BSOD patches being retracted few weeks back, Microsoft had been working hard to restore the status of these vulnerabilities, especially when some of them are critical. Sure enough, we see a new patch that is suppose to replace the previous patch and I think for those who had not uninstalled the patches according to my post here:

http://blog.winston-avalon.com/2014/08/microsoft-aug-patch-tue-could-cause-bsod.html

You should apply this whether or not you had it uninstalled since this is quite critical in my opinion.

Just use your Windows Update and you should see this patch available now!

Microsoft Aug Patch Tue Could Cause BSOD

Yes, no joke~! 4 of the suspected Patch Tue updates for Aug 2014 were suspected to cause some users to crash or BSOD. Judging from the descriptions, it will only be a matter of time when the criteria are met. In fact, it is Microsoft who advise users to UNINSTALL these patches ASAP!

http://support.microsoft.com/kb/2982791

Don't worry,  let me walk you through this. Hopefully when you are now reading this, your PC has not crashed yet. Then the steps are simpler (I did not say it is simple, just not as complicated).

If your Windows is still alive... Time to uninstall those patches. According to Microsoft:

Open the Programs and Features item in Control Panel, and then click View installed updates. Find and then uninstall any of the following update that are currently installed:

• KB2982791
• KB2970228
• KB2975719
• KB2975331

Well, firstly, not very helpful. The patches are not arranged by KB numbers and the search somehow do not deal with these numbers either.

But luckily, you can still sort them by name and you should be looking for these two:

Security Update for Microsoft Windows (KB2982791)

Update for Microsoft Windows (KB2975719)

Based on the descriptions, it is very likely you will only have one of these:

2975719 August 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 
2975331 August 2014 update rollup for Windows RT, Windows 8, and Windows Server 2012

So you might want to look for the other one instead if you are still on Windows 8.0

So, I guess its perfectly normal to have just one of them. As for the other missing one:

2970228 Update to support the new currency symbol for the Russian ruble in Windows

It sound like I may not have it because I do not have the Russian language installed? Likely.

Well if you are a bit out of luck and had the BSOD, you will have to go into safe mode to save that. The details are on their page at:

http://support.microsoft.com/kb/2982791

I strongly suggest you print that out on a working computer. Or be lazy and just system restore back to the previous month... That will probably work.

Adobe Flash Player 13 Full Offline Installer - Fixing the stopped at 7% Error

The latest Flash Player 13 may had stopped downloading for some at 7% and giving a message:
"Lost connection. Trying to reconnect..."
And actually it does nothing of that sort...

The Flash installer had been one of the worse nightmare ever. For a start, its a EXE executable, but because of whatever reason, something its saved as a ZIP and you can imagine the mess of confusion it is to average user.

Then the download is horrible and I get 10% success rates only in some places.

To top that up, the installer is ALWAYS deleted once it is ran and no matter if it is successful or not! Obviously a waste of bandwidth.

I had talked about it again and again in the past:
http://blog.winston-avalon.com/2011/11/flash-player-11-download-fail-at-12.html

My advise is DON'T use Flash. Really. Given the track record, its probably one of the easiest door to open on your PC if not the MOST. And most of the bigger players had long given up on Flash, like Apple (not surprising) and finally Google in Android 4.4.

But if you really have no choice, need to run it in a VM etc, there is still the option to download it.
Just go to :
http://www.adobe.com/products/flashplayer/distribution3.html

And I really want to stop hot-linking the direct EXE file now since Flash is updated ever so often and that last thing I need is to misdirect someone into downloading a old version.

But hopefully, I will not need to post this for Flash 14 (if it will ever exist...)

Patch Tuesday July 2013

Usually I do not talk much about Patch Tuesday from Microsoft, but this time round, it totals to about 30 or so updates on most system with Windows and Office. I think that is would the mention. Not only that, there are 6 rated CRITICAL and many which does not have full details on what and how it is exploited as Microsoft got the vulnerability in private. Doesn't that worry you? It should. For all you know some of these vulnerabilities had already been used in the wild, so I suggest you roll in these patches as soon as possible. (How about NOW??)

So, what are fixed in this round? Here is a summary of it:

• Kernel driver bug due to TTF (yes, I know your WTF look, why would a TTF font be injected into kernel...?) This allow escalation and there is full source code available.
• Several .Net Framework and Silver patches 
• Vulnerability in GDI+. Seriously, I think they will never get this fix since it comes back every time.
• IE. For once, IE 10 is badly hit. Usually most vulnerability would not affect IE 10 (on Win8 especially). Well, this is really the patch you need to install ASAP since IE will be your first point of contact.
• Directshow with GIF files. Makes you think how a simple file format thing like PDF, PNG (oh yes, last month we just had one), DOCX or sort. It does seems to have a trend of attacking file formats nowadays.
• Windows Media Format. WMF. There we have it, just to prove my previous point.
• Windows Defender. It's a path transversal. Well, even the big giants has faults sometimes. But the scary part is Microsoft does patch it... Do you see other AV vendors patching their main program much (I know you get updates, but those are AV signatures, they are different things)?

And other patches involving SD card removal, new camera models, language pack and fonts. 

So, you can see its going to be a busy busy week. And whoever is using those exploits will probably be sweating or trying their last strike to make good use of it before you patch your computer. 

MKV plays with sound, but without video on media players

Have this problem, and yet its not all MKV behind as such? If so, you are in luck, because I have the solution for you here.

First, lets explain whats the problem. In order to save header space (who is not much point consider the MKV is like 8GB and you save 1MB on header...), MKV had implemented a new header compression function for the audio tracks which is default in some version of MKVmerge v4.1.0 (that's another good reason to hate Apple users). Because of this new implemented feature, it is practically forced down, without working out with the manufacturers of the media players.

More info:
http://www.matroska.org/news/compressed-headers.html

As such, we need a tool to undo this, or simply give up and play with PC. The original MKVtoolnix will work (it even has windows version):
http://www.bunkus.org/videotools/mkvtoolnix/downloads.html

There is a batch file created to help make this simple with mkvtoolnix as well, which I had uploaded here:
http://www.fileserve.com/file/uUNGEY6
Just download it and put into same directory of mkv and run it.

But, I prefer to keep it simple and not install or configure too much to fix this. There is a specific tool for cleaning up the mess so that the file can be played by the media players.
http://www.matroska.org/downloads/mkclean.html

Hope this help you. If so, do leave me a comment so that I know it actually works for you guys!