Microsoft Malware Protection Engine Vulnerability

The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software. There has been found a vulnerability in it. The vulnerability (CVE-2018-0986) may allow an attacker to execute arbitrary code in the security context of the LocalSystem account and take control of the system.

Affected are versions earlier than 1.1.14700.5.

In default settings Malware Protection Engine should update itself automatically. Instructions for checking currently used version can be read here under "Verification of the update installation" section of the correspondent product in use.

More information can be read from the related advisory.

F-Secure Rescue CD 3.00 Released

F-Secure released over a week ago Rescue CD version 3.00 that can be used to scan the system for malware. Program renames all files containing malware to .virus file extension. Following list is quoted from Release Notes of Rescue CD:

Rescue CD will by default scan:
* all hard drives in the computer
* all USB drives attached to the computer
* Windows FAT and NTFS filesystems
* Virus definition databases are updated automatically if the computer has
an internet connection
* Virus definition databases can be updated manually by using a USB drive
* The Rescue CD Guide (pdf) has step by step instructions how use the CD

To use F-Secure Rescue CD on a computer the computer must:

* Be x86 compatible
* Have at least 256MB of RAM
* Be able to boot from a CD
* Be able to connect to the Internet or be able to use a USB drive

According to F-Secure the big changes compared to 2.00 include a proper manual for the product, ability to update databases manually with a USB stick, better hardware support (Knoppix version 5.3.1), upgraded NTFS driver (NTFS-3G 1.2506) and the ability to detect MBR viruses.

Rescue CD can't be used to scan encrypted files or folders.

Antivirus Is 'Completely Wasted Money' Says Chief Security Officer of Cisco

Cisco's chief security officer John Stewart thinks that current antivirus protection doesn't work and that's why it's complete waste of money. Stewart shared his thoughts at Auscert 2008 security conference. According to him companies have so many virus infections that they've got used to them. Infections exist even if antivirus protection software is installed. Data criminals create new malware so quickly that antivirus protection can't match its speed.

"If patching and antivirus is where I spend my money, and I'm still getting infected and I still have to clean up computers and I still need to reload them and still have to recover the user's data and I still have to reinstall it, the entire cost equation of that is a waste.", says Stewart according to Zdnet Australia.

Stewart sees using of whitelists as a better solution. This would mean that only authorized and approved software would have permission to execute. That way malware couldn't access the system even if other protection fell down.

Nowadays antivirus protection companies have made their product packages include also pre-defensive protection fixing weak points of traditional antivirus protection.