VIRUS ADVISORY: W32/Sober@MM!M681

What is it?
W32Sober@MM!M681 is a newly introduced medium risk virus. It's a variant of W32/Sober.gen@MM, W32/Sober@MM!M681 is another mass-mailing worm hiding inside a spam email attachment. When run, the virus displays a fake error message, infects the host computer then sends itself to stolen email addresses. Note: VirusScan users with the latest DAT file are protected from this threat.

What should I look for?
FROM: Varies
SUBJECT:
Examples: Registration Confirmation; Paris Hilton & Nicole Richie; hi, ive a new mail address BODY: Example: hey its me, my old address dont work at time. i dont know why?! in the last days ive got some mails. i' think thaz your mails but im not sure! How do I know if I've been infected?
Fake error message ("Error in packed Header") displayed. Outgoing messages as noted above. Note: Receiving an email alert stating that the virus came from your email address is not necessarily an indication you are infected. Mass-mailing viruses often forge (or "spoof") the from address.

What can I do?
Besides keeping your anti-virus protection current, fortify your PC security by installing McAfee Personal Firewall Plus — recommended against threats like W32/Sober@MM!M681 that need Internet access to spread.

How do I find out more?
Go here.

SP2 for Exchange, Office, SharePoint, and Windows

Exchange 2003 SP2
Exchange Server 2003 Service Pack 2 (SP2) enhances your messaging environment by adding improved mobile e-mail, better protection from spam, and advanced mailbox fundamentals. To download Exchange 2003 SP2, go to http://www.microsoft.com/exchange/default.mspx


Office 2003 SP2
Provides the latest updates for Office 2003 and is required to take advantage of the enhanced performance of the Offline Address Book 4.0. To download Office 2003 SP2, go to http://www.microsoft.com/downloads/details.aspx?FamilyId=57E27A97-2DB6-4654-9DB6-EC7D5B4DD867&displaylang=en


SharePoint2003 SP2
Microsoft® Office SharePoint® Portal Server 2003 Service Pack 2 (SP2) contains significant security enhancements, in addition to stability and performance improvements. Some of the fixes included with SP2 have been previously released as separate updates. This service pack combines them into one update. To download SharePoint2003 SP2, go to http://www.microsoft.com/downloads/details.aspx?FamilyId=171DC9A7-B4BA-4759-BD64-6B7D851A97EF&displaylang=en


Windows 2003 SP2
In 2006, Microsoft will ship Windows 2003 SP2 which will update both the original Windows 2003 release and Windows 2003 R2. For more info, go to http://www.windowsitpro.com/Articles/Index.cfm?ArticleID=42669&DisplayTab=Article

What is Application Verifier?

What is Application Verifier?
Application Verifier is a Visual Studio tool that exposes instrumentation already present in the Windows operating system. The instrumentation performs runtime verification of running executables in selected areas like memory allocation, critical section usage, and handle usage.

What does Application Verifier detect?
Application Verifier detects runtime problems in the area of memory allocation, detects overrun or heap-allocated blocks, reuse-after-delete, double-delete, and heap contamination. In the area of critical section usage it detects operations that may lead to deadlocks or resource leaks. In the area of handle usage, it detects attempts to reuse handles after they are no longer valid.

How does Application Verifier work?
The Application Verifier tool enables the OS instrumentation for the given executable image for the duration of a debug session. The OS changes the API layer towards the application and intercepts calls, redirecting them to a validation layer. When a violation is detected, a suitable exception is generated, and the Application Verifier tool provides relevant context for the detected violation.

A recently published KB article details a bug with Application verifier where errors in the application may not be verified. This issue may occur if the following conditions are true:

•You have installed the stand-alone version of the Application Verifier from the Microsoft Download Center.

OR

•You have enabled verifier settings using both versions of the Application Verifier for the same application.

To resolve this issue, delete the settings for the application in the stand-alone Application Verifier. To do this, follow these steps:

1.Click Start, and then click Application Verifier.
2.In the stand-alone Application Verifier, right-click the name of the application that you want to stop testing, and then click Delete Application.
3.Click Save to save your changes in the stand-alone Application Verifier.

To test the application, follow these steps:
1.In Visual Studio 2005 Team System, open the application.
2.On the Debug menu, click Start with Application Verifier.The Application Verifier now reports any errors in the application.

For more information visit http://msdn.microsoft.com/vstudio/teamsystem/support/faqs/developer_faq/ and http://www.kbalertz.com/Feedback_911142.aspx

Visual Source Safe 2005

November 7th, 2005 was the official release date for the Visual Studio 2005, SQL Server 2005, and the less talked about BizTalk. Combined within the VS suite is the latest release of source safe, Visual Source Safe 2005, used to manager source code versions. The new release of VSS has not been talked about much, not even by the MS team that developed the product. So in an effort to do the new VSS release some justice, listed below is a brief summary of the new features.

• Remote access using HTTPImproved LAN speeds, especially when used with Visual Studio
• Data storage has increased to 4GB
• View file history date/time, with respect to local time zone
• Allows third party plug-ins/editors for comparing source code and document differences.
• Managed Code Extensibility that allows better integration with Visual Studio 2005
• Unicode and XML supportProject Enhancements that allow synchronizing renamed or deleted files within VS.
  

For more information, visit the VSS home page at
http://msdn.microsoft.com/vstudio/previous/ssafe/

Recovering data from a failed hard drive

The following is not .net related, however, it's information that can come in handy to all PC users.

Q: The Hard Drive on my PC stooped working and I have no backup. What data recovery services can I use to retrieve the lost data.

A: There are several services, each with a slightly different twist, but all can help recover data from a failed drive.
http://www.ontrack.com/Homepage.aspx?id=3&pagename=Software
http://www.runtime.org
http://www.Quetek.com/

Thanks to the Berbee team for their help with this.

Tip on Error Handling

When developing class libraries, it's best to develop those routines without error handling. By doing so, any errors encountered will be sent to the calling function, where they should be handled there. By handling errors in commonly used routines, the calling routine will receive a success since the error was handled by the routine called. This could result in multiple subsequent errors and the error messages will not clearly indicate the cause of the error.

December TechNet

I want to encourage you to attend the upcoming TechNet event on December 15th. Go to www.technetevents.com for more information, and look at Brooklyn for the local event. This is the best event for SQL 2005 and Visual Studio 2005 you’re going to find in the immediate area and it’s free! Each attendee will receive:

1. Visual Studio 2005 standard
2. SQL Server 2005 standard
3. Biztalk Server 2006 Enterprise (or a download)
4. Coupon for a free certification exam.
   
   

What is WOW64?

Q: What is WOW64?

A: WOW 64, short for Windows on Windows 64-bit, enables you to run 32-bit applications on x64 Edition. It translates applications to 64-bit, provides higher performance for 32-bit applications, and features 4GB virtual memory space for each process. WOW64 launches and runs 32-bit applications seamlessly by isolating32-bit applications from 64-bit applications. This includes preventing file and registry collisions. Console, GUI, and service applications are also supported. The system provides interoperability across the 32/64 applications for scenarios such as cut and paste and COM. However, 32-bit processes cannot load 64-bit DLLs, and 64-bit processes cannot load 32-bit DLLs.
For more information, visit http://www.digitalproducer.com/articles/viewarticle.jsp?id=32196 and http://msdn.microsoft.com/library/default.asp?url=/library/en-us/win64/win64/running_32_bit_applications.asp

Fuzzy Lookup/Matching in SQL Server 2005

One of the new features of SQL Server 2005 is Fuzzy Lookup/Matching. This allows a query to return results that may not be an exact match, but close enough. Many people began to wonder how does this feature work. Microsoft published an article that explains this feature in detail, http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsql90/html/sql2005ftsearch.asp.

Microsoft Windows Defender

Microsoft anounced last week that the infamous Antispyware, currenly in Beta 1 testing, will be renamed to "Windows Defender" when completed and released in 2006. The RTM (Release To Market) product will not only scan a system for spyware but will also look for malicous code like keystroke loggers. Defender will be part of Windows Vista, Microsoft's latest operating system scheduled for release next year. It will also be available for download for users with Windows 2000, XP, and 2003.

For more information, please visit the TechNet blog at http://blogs.technet.com/antimalware/archive/2005/11/04/413700.aspx or ComputerWorld at http://www.computerworld.com/securitytopics/security/story/0,10801,106048,00.html?from=story%5Fkc.

New Microsoft Patches

Microsoft recently released two new patches/updates.

1. Security update for Windows XP (KB896424)Size: 0.9 MB - 2.5 MB
   A remote code execution security issue has been identified in the Graphics Rendering Engine that could allow an attacker to remotely compromise your Windows-based system and gain control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.
   More information for this update can be found at http://go.microsoft.com/fwlink/?LinkId=48901. ComputerWorld has also published an article that explains it in more detail, http://www.computerworld.com/securitytopics/security/story/0,10801,106063,00.html?source=NLT_PM&nid=106063.
2. Windows Malicous Software Removal Tool - Novemeber 2005 (KB890830)Size: 198 KB
   After the download, this tool runs once to check your computer for infection by specific, prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps to remove any infection found. If an infection is found, the tool will display a status report the next time you start your computer. A new version of the tool will be offered every month. If you want to manually run the tool on your computer, you can download a copy from the Microsoft Download Center or run an online version from microsoft.com. This tool is not a replacement for an anti-virus product. To help protect your computer, you should use an anti-virus product.
   More information for this update can be found at http://www.microsoft.com/malwareremove

Code Generator

Our last meeting was about code generators. Afterwards, I saw a link on the Microsoft site for a free generator that takes an XSD schema as input and generates sample code showing how to mark up C# and VB.Net classes so that when serialized with the XML serializer, the resulting XML will be valid according to the original schema. For more info and to download the code generator, visit http://www.microsoft.com/downloads/details.aspx?FamilyID=89E6B1E5-F66C-4A4D-933B-46222BB01EB0&displaylang=en.

Microsoft Desktop Deployment

Microsoft offers a desktop deployment package that provides many capabilities, including desktop imaging. This is especially usefull when trying to duplicate a production environment in test. Afterall, the testing environment is an important factor to achieving correct results. For more information on Microsoft's Desktop Deployment, see http://www.microsoft.com/technet/desktopdeployment/default.mspx