Important Announcement if you are running Windows

[Vekseid]

Microsoft announced a particularly stunning security vulnerability this morning. It's actually a part of the overall Hacking Team leak and has been discussed for some weeks now, and has been in the wild for some years.

For some reason I completely spaced and had assumed that this was constrained to Flash, because, well, it's Adobe.

Remote kernel mode code execution in a font library that's been a part of Windows since Windows 2000. It doesn't matter what browser you use - Internet Explorer has supported embedding Opentype fonts in its own proprietary way since 5.5, and all other browsers have supported it for many years now.

If you are running Vista or later, please run Windows Update and ensure your system is up to date.

If you are still stuck on Windows XP or 2000, you will want to upgrade or switch to a non-Windows system.

This is easily the most serious vulnerability to ever be revealed for Windows. All you have to do is visit a bad or hijacked website.

As an aside, if you have Adobe Flash installed, I would highly recommend removing it. The more people who get rid of Flash, the more websites will stop relying on it, and the less you'll miss.

Likewise, if you have Adobe Acrobat Reader installed, consider replacing it with Sumatra PDF or Foxit Reader.



Be safe, people.

Also, since not everyone is going to click the announcement, please make sure your friends and family are aware of this (here and elsewhere).

[Caitlin]

Ouch, well that explains why Windows updated last night while it usually updates on Tuesdays. I disabled Flash when I learned of the vulnarability in it, but this bug is new to me as well. Thanks for the update!

[Blythe]

Thanks for the update; I had no idea about any of this.  :-\

Also gonna ditch Adobe Reader and pick up Sumatra while I'm at it.

[persephone325]

Not sure if it's because I'm dumb, or just tired. But I don't understand what's happening. >.<

[Stella]

Thanks for sharing. I appreciate it!

[Vekseid]

Not sure if it's because I'm dumb, or just tired. But I don't understand what's happening. >.<

The vulnerability is in the code that turns font data into the characters you see on your screen. In Windows, this code runs with absolute privilege - it has more access to your own system than you do.

Microsoft released a fix on Windows Update, but not everyone has it set to automatically reboot their machines at a whim, and not everyone who does has it working.

[Haibane]

Now I am worried. I can't run the update (I get an error when I try and run it) and Windows Update isn't running either even though I have set it to do so.

Win 7 Home Premium.

EDIT: Here's my Win Update settings - all looks fine:



But here is the problem:



Restarting the PC makes no difference.

Help! (please)

[Renegade Vile]

*Winces* Lovely.

[Fenrisulfr]

If you right click on "my computer" and pick "manage", then go to "services" and look for "Windows Update". Is it started? Is it set to "Automatic".

It has to be set to automatic to start automatically at a reboot. So any other setting will result in that error. Change it to automatic if needed.

If it is not started, try to start it and see if it is possible or if you get any error messages.

It is also worth to look in the event viewer, that you also can find through the window you started by picking manage. But I'm not sure how easy it is to understand.

[jouzinka]

Now I am worried. I can't run the update (I get an error when I try and run it) and Windows Update isn't running either even though I have set it to do so.

Win 7 Home Premium.

EDIT: Here's my Win Update settings - all looks fine:



But here is the problem:



Restarting the PC makes no difference.

Help! (please)

Restart the computer, hit F8 when it starts, select "Safe Mode with Network" and try to update in safe mode.

Alternateluy, visit www.eset.com and rn their antivirus online check, get rid of the junk, if it finds any, and try again.

[Peripherie]

Thank you Veks, I really appreciate the heads up!

I have know about the issues with Adobe flash but I do know that many things that I use also use Flash. I've tried to read up on it and apply updates when I have heard (rightly or wrongly) that it is important to do so. I'm fine with removing it but does anyone know what kinds of big things actually use it (as in, what major things am I not going to be able to do/see if I get rid of it)?

Sadly I have no way of updating the computers I use for/at work. I know they use an outdated OS and I know they use Adobe. (It is a VERY large organization and it isn't as simple as me passing along this information and I may not have the ability to update anything. Even if I do some things are restored each time I boot it up.)

[jouzinka]

http://www.transitionblog.com/4-most-amazing-alternatives-to-adobe-flash-player/

Here are some amazing alternatives to Flash.

[Vekseid]

Thank you Veks, I really appreciate the heads up!

I have know about the issues with Adobe flash but I do know that many things that I use also use Flash. I've tried to read up on it and apply updates when I have heard (rightly or wrongly) that it is important to do so. I'm fine with removing it but does anyone know what kinds of big things actually use it (as in, what major things am I not going to be able to do/see if I get rid of it)?

Sadly I have no way of updating the computers I use for/at work. I know they use an outdated OS and I know they use Adobe. (It is a VERY large organization and it isn't as simple as me passing along this information and I may not have the ability to update anything. Even if I do some things are restored each time I boot it up.)

Most major websites are moving to webm/h.264 for video and animation ('gifv'). There's even a standing request for us to do it at E here - I will see if I can get that into Elkarte (should be fairly easy).

The only major video websites that were still using flash the last time I did a survey were pornhub, youporn, redtube, etc. Everyone else uses html5 embedded video.

The big difference is older sites like Homestar Runner and Albino Blacksheep, as well as flash game sites.

[AmberStarfire]

Thanks Veks. I'll disable Flash, at least for the time being (until this is sorted out, if it can be). I have the full version of Adobe Acrobat so I'd rather not get rid of it.

[King Serperior]

Is Firefox considered a Windows program?  I am not computer-savvy, so I am now really scared.  I have already removed Flash just to be safe.  Does this mean that ALL Adobe programs have gone bad?  If so, I'll immediately remove the only other Adobe I have installed:  Adobe Reader XI

I'll be looking into the alternate options though.

[Vekseid]

Is Firefox considered a Windows program?  I am not computer-savvy, so I am now really scared.  I have already removed Flash just to be safe.  Does this mean that ALL Adobe programs have gone bad?  If so, I'll immediately remove the only other Adobe I have installed:  Adobe Reader XI

I'll be looking into the alternate options though.

If you're running Windows, it's a Windows program.

I recommend replacing Reader with one of the two programs I suggested above. Adobe Reader has had its share of vulnerabilities. My sister's machine got owned through an embedded .pdf.

Now I am worried. I can't run the update (I get an error when I try and run it) and Windows Update isn't running either even though I have set it to do so.

Win 7 Home Premium.

EDIT: Here's my Win Update settings - all looks fine:



But here is the problem:



Restarting the PC makes no difference.

Help! (please)

If you try the steps others have mentioned, you might see more insightful information/errors.

More seriously, your situation is the sort of thing I'm trying to reach out to and/or prevent. : /

[Ritsu]

Most major websites are moving to webm/h.264 for video and animation ('gifv'). There's even a standing request for us to do it at E here - I will see if I can get that into Elkarte (should be fairly easy).

The only major video websites that were still using flash the last time I did a survey were pornhub, youporn, redtube, etc. Everyone else uses html5 embedded video.

The big difference is older sites like Homestar Runner and Albino Blacksheep, as well as flash game sites.

Also Pandora Radio uses Flash.

[Geraint]

Likewise, if you have Adobe Acrobat Reader installed, consider replacing it with Sumatra PDF or Foxit Reader.

Thanks Veks for the timely warning.

I have a question about PDF readers though.  I've looked at the ones you mentioned, but have also seen the PDF-XChange Viewer mentioned prominently in reviews when I was researching them.  Was there a particular reason you didn't include it?  Should it be avoided?

Thanks

[Vekseid]

Thanks Veks for the timely warning.

I have a question about PDF readers though.  I've looked at the ones you mentioned, but have also seen the PDF-XChange Viewer mentioned prominently in reviews when I was researching them.  Was there a particular reason you didn't include it?  Should it be avoided?

Thanks

Just haven't used it myself.

Because they're not official Adobe products, sometimes one of the free readers is missing important features, so viewing newer pdfs could sometimes be a problem. I haven't had that issue in years, though.

[Angelus]

Thanks for giving several f#$%! and giving us such information. I'll definitely be using this advice to increase my computer's safety as well as my immediate fams' n' friends'. <3 <3 <3 -glompsVekwithsomuchluffs-

[Geraint]

Just haven't used it myself.

Because they're not official Adobe products, sometimes one of the free readers is missing important features, so viewing newer pdfs could sometimes be a problem. I haven't had that issue in years, though.

Thanks Veks, I appreciate the guidance. :D

[Wistful Dream]

Eek, this sucks, we have to use Flash at work, but at least we use Foxit (which is a great PDF reader for anyone that's curious, I use it on a daily basis and it has wonderful tools). Would this issue be affecting the Google OS at all?

[AmberStarfire]

If this is being caused in relation to/by embedded fonts, I wonder if there is any threat posed by fonts available on online font sites like Fontsquirrel.

[Inkidu]

Whoo-boy. I'm in full cleaning mode. I'm all updated and running every kind of scan I've got access to.

[Golden Spider]

The vulnerability is in the code that turns font data into the characters you see on your screen. In Windows, this code runs with absolute privilege - it has more access to your own system than you do.

Microsoft released a fix on Windows Update, but not everyone has it set to automatically reboot their machines at a whim, and not everyone who does has it working.

This explains why it wants me to upgrade again when I just did so Saturday. Thank you. If I didn't hear about this I probably would've put it off for a couple days

[Thesunmaid]

My home computers are scanned weekly for viruses and malware and I am very careful about things..I am sort of anal about my home computers..sadly my work computer is another story..we still have to use internet exploder for my main work tool although we go get to have fire fox for everything else..and the techs are working on getting us off IE...i am paranoid since we can't update IE at all right now because if we do it will fuck up and not work with our tool..sort of ridiculous. But at least the programming people are working on getting us off IE.

I also have to use adobe for some things but this is not my personal computer so not really my problem if it breaks or fucks up.

[AmberStarfire]

I have to admit, I kind of like Adobe stuff. I have all sorts of Adobe software on my machine. It's probably my favourite software out there.

I'm actually wondering to what extent Adobe stuff is the issue, whether it's just Flash and potentially Acrobat Reader that are the issue, or if it's more the Adobe fonts, or a library that's going to be running through the breadth of their software.

Maybe I should research that online rather than asking questions here.

[PennySludt]

i stopped running automatic updates on windows because every time it updated, google chrome would quit working and i'd have to revert to an older version of my backup to get it to run again. what am i doing wrong?

[Mithlomwen]

Another question from the technologically challenged. 

For places that use Adobe flash (like the games on Facebook as an example) will one of the alternatives work?

[Angie]

Nice of Veks to hit us with a warning even when it's not something E related. Just goes to show how much he cares ;D

I do have one question: How does one fuck up so badly that your font data is providing an open backdoor? Maybe it's because I don't understand programming (yet, I'm about to start classes), but this seems like an easy thing to not have happen. I mean it's font data, that doesn't sound like something that could easily screw up.

[Haibane]

If you right click on "my computer" and pick "manage", then go to "services" and look for "Windows Update". Is it started? Is it set to "Automatic".

It has to be set to automatic to start automatically at a reboot. So any other setting will result in that error. Change it to automatic if needed.

If it is not started, try to start it and see if it is possible or if you get any error messages.

It is also worth to look in the event viewer, that you also can find through the window you started by picking manage. But I'm not sure how easy it is to understand.

Thanks for helping. I followed your instructions. It was set to Automatic (Delayed Start), however when I set the start type to Automatic in the properties and reboot it always reverts to Automatic (Delayed Start) again and I get the same error.

I will try again running it from safe mode.

Veks - do you know if Adobe Air has vulnerabilities? Its the variant of their flash player used on the BBC iPlayer website and I can't live without that!

All other Adobe products on my PC are history and I'm using Unity Web Player now. Thanks to everyone who has made these cool suggestions.

[Vekseid]

What does it say when you try to start the service manually?

And honestly, I'd poke the BBC and ask them to get with the decade. >_>

[Xanatos]

I was also curious about Youtube. I am on it every day. If I ditch Flash, for say Unity, would my viewing be effected? I read a small blurb, here https://www.youtube.com/html5  saying that some or all vids support html5, but I'm really not as tech savvy as I should be. I don't know if that answered my question or not. Though, I thought html5 was just a replacement for the old way to house/build/whatever for the internet and not necessarily a video/graphics display software.

[Blythe]

I was also curious about Youtube. I am on it every day. If I ditch Flash, for say Unity, would my viewing be effected? I read a small blurb, here https://www.youtube.com/html5  saying that some or all vids support html5, but I'm really not as tech savvy as I should be. I don't know if that answered my question or not. Though, I thought html5 was just a replacement for the old way to house/build/whatever for the internet and not necessarily a video/graphics display software.

I use Chrome and have ditched Flash. Youtube works just fine for me. ^^

[persephone325]

Another question from the technologically challenged. 

For places that use Adobe flash (like the games on Facebook as an example) will one of the alternatives work?

^This.

[jouzinka]

I ditched Flash for Unity and while I have experienced some troubles so far, youtube and FAcebook are not one of them.

Some platforms are written for Flash only and that does affect games, but you will never know with those until you try. It's an uninstall-install away, only.

[Fenrisulfr]

Thanks for helping. I followed your instructions. It was set to Automatic (Delayed Start), however when I set the start type to Automatic in the properties and reboot it always reverts to Automatic (Delayed Start) again and I get the same error.

Delayed Start should work as well.

To try starting it manually, you can right click on it and chose start.

I will try again running it from safe mode.

I hope it help and "shake things loose" so it start working again.

As I mentioned, there might be some information in the event viewer. Unfortunately, I don't have any English Window installed so I'm not sure I will be able to write up an instruction, that make sense, on how to search it.

[Vampyre Valkyrie]

*Groans* On one of my computers I run XP.

[Haibane]

What does it say when you try to start the service manually?

I get the same error with every setting, saying the service is not running.

And honestly, I'd poke the BBC and ask them to get with the decade. >_>

I know. I've had to reinstall Adobe Flash Player because the BBC uses it exclusively for their iPlayer and all the videos on their news pages, apparently. I've sent them an e-mail but I expect this was Adobe slipping them a wad of cash to get a monopoly deal. *sigh*

Fenrisulfr - no go. No setting I try will make the Win Updater run. What is the Event Viewer please?

...right click on it...

Apologies for seeming slow - right click on what? I see no clickable options in the Update window.

[Fenrisulfr]

*Groans* On one of my computers I run XP.

Do you use it connected to the Internet or only offline? If the computer is never connected, it isn't a problem.

Is it because you need XP (and Windows) for some specific application? As I guess it is an older machine, it could be worth running a lightweight Linux on it, to extend its life.

[jouzinka]

Haibane, you can also try using this: https://support.microsoft.com/en-us/kb/2730071

Fenri, I ran Win 7 on a laptop that would now be 9 years old when it first came out as beta version. If it's necessary to change system, I'd try Win 7 first, personally, for users.

[AmberStarfire]

There's a reason it may not be running. I think Hairy had this problem a while ago and there's a certain service it requires to run, and it won't if that's missing off your computer. At the time it seemed this was probably down to a virus scanning program he used that has a tendency to remove files if it feels they're compromised, which unfortunately includes Windows files.

You could try accessing the updates directly from the Microsoft site and see if they work. It might tell you why if they don't.

The other thing is sometimes Windows draws the conclusion you're not using an official copy, even when you are. I think it's some of the file cleaning programs that come with antiviruses and the like that can remove needed information. If you right-click on My Computer (or This PC) and go to Properties, it should bring up a page and it will have a badge saying use an official copy of Windows if it seems to think you're not. I think that can sometimes lock out updates.

[Vampyre Valkyrie]

Do you use it connected to the Internet or only offline? If the computer is never connected, it isn't a problem.

Is it because you need XP (and Windows) for some specific application? As I guess it is an older machine, it could be worth running a lightweight Linux on it, to extend its life.

I'm running XP because I'm broke and have no money to update...at all. The computer is old enough that it still says IBM (not Lenova) and has no internal wireless (I have a piece of hardware I have to plug into it to use.) It's an old ass ThinkPad. I use it to post on E...that's pretty much it...cause it won't really let me do anything else.

[Fenrisulfr]

Fenrisulfr - no go. No setting I try will make the Win Updater run. What is the Event Viewer please?

The Event Viewer is a log function in Windows. You can reach it through one of these...
* Right click on "My Computer". Pick "Manage" and then you have Event Viewer in the list.
* In the Control Panel, go to "Administrative Tools" and it should be there
* Click on the windows button and pick run (or hold down the windows key on the keyboard and press R), then type Eventvwr and press enter.

My guess is that it might be in the System log.

Apologies for seeming slow - right click on what? I see no clickable options in the Update window.

On the "Windows Update" service. It should be a start button where you can pick Automatic/manually/disabled, which is the same alternative.

[Fenrisulfr]

Haibane, you can also try using this: https://support.microsoft.com/en-us/kb/2730071

Nice. :-) I agree to begin in that end.

Fenri, I ran Win 7 on a laptop that would now be 9 years old when it first came out as beta version. If it's necessary to change system, I'd try Win 7 first, personally, for users.

The risk is with all updates, it won't run well. And it is a risk that, unless it is possible to borrow someones license, it will cost money to test.

So it is a trade off between having to learn new things and cost.

[Fenrisulfr]

I'm running XP because I'm broke and have no money to update...at all. The computer is old enough that it still says IBM (not Lenova) and has no internal wireless (I have a piece of hardware I have to plug into it to use.) It's an old ass ThinkPad. I use it to post on E...that's pretty much it...cause it won't really let me do anything else.

The wireless hardware might be problem to find new drivers for.

If you happen to know someone who might have an extra harddrive lying around, it is possible to test to install it with something else (Win7 or Linux) and see how it works. Then if it don't work, it is just to plug your disk back.

[Vekseid]

I get the same error with every setting, saying the service is not running.

Err no, as Fenri is getting at, I mean trying to actually start the service yourself, not running Windows Update.

I know. I've had to reinstall Adobe Flash Player because the BBC uses it exclusively for their iPlayer and all the videos on their news pages, apparently. I've sent them an e-mail but I expect this was Adobe slipping them a wad of cash to get a monopoly deal. *sigh*

Usually it's the developers that push these sorts of things. : /

[Fenrisulfr]

In the link jouzinka posted, it mention Windows Update relies on two other services. Bits and Wuauserv (not sure what the "friendly names" are for them)

Windows 7 and earlier versions

    Click Start, and then click Run.
    In the Open box, type cmd, and then press Enter.
    At the command prompt, type the following commands, and press Enter after each command:
        net start bits
        net start wuauserv

[LtRipley]

Yeah that explains the out of nowhere update the other day

[Rogue]

*debates switching the XP to ubuntu* *is irked* *grumbles*

[Haibane]

Thank you everyone for all the advice and suggestions. It's very late here in Blighty so I must get to bed. I will look at this afresh tomorrow when I get home from work. Thank you all again! *hugs*

[gaggedLouise]

*is also on XP (SP3) from home and mutters, even though she figures her next pc will probably be loaded with either Windows 10 or Ubuntu*

[Oreo]

May I have permission to copy your opening message to my facebook page?

[Dimir]

Well I guess it's time for another Malwarebytes scan. Thanks for informing us about this.

[Alexiel]

Does anyone know if all Adobe programs are affected by this? For example, I use Adobe Photoshop CS5 for work and it's installed on my home computer. Is that something I should consider getting rid of asap? Thanks in advance for anyone who can/does answer that for me.

[AmberStarfire]

Does anyone know if all Adobe programs are affected by this? For example, I use Adobe Photoshop CS5 for work and it's installed on my home computer. Is that something I should consider getting rid of asap? Thanks in advance for anyone who can/does answer that for me.

I use it too and there's no way, no how I'd get rid of it.

I don't know how many Adobe programs it will affect but it sounds like it's mainly Flash and any files that might use embedded fonts (and the only types I know of that do that are PDFs and E-books), which would be flavours of Acrobat (including the Reader).

[Alexiel]

I use it too and there's no way, no how I'd get rid of it.

I don't know how many Adobe programs it will affect but it sounds like it's mainly Flash and any files that might use embedded fonts (and the only types I know of that do that are PDFs and E-books), which would be flavours of Acrobat (including the Reader).

Thanks for replying to my question, Amber. I feel the same way about cs5, and don't know what I would do without it. The other things shouldn't be an issue, so I'll keep cs5 for now and see what happens with it all. Thank you again!

[kylie]

     Sorry if this was covered, but is there a specific update number (KB.......) that is the thing to have right now?  Can we download it direct from the Microsoft sites?

     At the moment, I'm having trouble installing a couple of the .NET Framework updates (error 80070BC9).  I ran the generic update installer FixIt recommended by the Windows routine, but that didn't seem to help.  Ran Malware Bytes scan and didn't find anything especially strange (just PowerISO, but I installed that and I don't think it's evil?).  I'd really like to solve this without invoking Microsoft Security Essentials or Windows Authentication, as I'm on a black Windows and have those both turned off. 

     Everything else labeled Important has installed fine (except I haven't bothered upgrading Internet Explorer from 10 to 11 yet, as it's a secondary browser for me and I like to stagger things particularly while in China). 

     Thanks for the update.  Uninstalled Adobe -- the constant updates were a pain anyhow.  Sumatra looks alright enough, at least at a glance.

[Geraint]

     Sorry if this was covered, but is there a specific update number (KB.......) that is the thing to have right now?  Can we download it direct from the Microsoft sites?

     At the moment, I'm having trouble installing a couple of the .NET Framework updates (error 80070BC9).  I ran the generic update installer FixIt recommended by the Windows routine, but that didn't seem to help.  Ran Malware Bytes scan and didn't find anything especially strange (just PowerISO, but I installed that and I don't think it's evil?).  I'd really like to solve this without invoking Microsoft Security Essentials or Windows Authentication, as I'm on a black Windows and have those both turned off. 

     Everything else labeled Important has installed fine (except I haven't bothered upgrading Internet Explorer from 10 to 11 yet, as it's a secondary browser for me and I like to stagger things particularly while in China). 

     Thanks for the update.  Uninstalled Adobe -- the constant updates were a pain anyhow.  Sumatra looks alright enough, at least at a glance.

The specific Windows update is KB3079904 though it comes in different specific packages for the different supported systems.

As for IE11, I let Microsoft install it and regretted it within hours, as it caused more display problems than added anything I perceived as valuable.  I uninstalled it and blocked it from downloading again. 
I'm quite happy with IE10 and Microsoft continues to update it regularly.  Maybe Microsoft has fixed IE11 by now, but I'd say don't bother, especially if downloading is a problem.

Maybe someone else can help you with the .NET Framework updates, as I don't know.

[kylie]

The specific Windows update is KB3079904 though it comes in different specific packages for the different supported systems.

I downloaded it from three different pages on Microsoft (one said x64-based systems, but the other did not, the third one does not say x64 or x-anything at all but adds "for Embedded Standard 7" in the title).  All three times, the app said it wasn't compatible with my system.  I only have 32 bits, but I do have Win 7 SP 1.

      I wonder if it might be necessary to upgrade the .NET first??  Pretty clueless otherwise.

[Geraint]

      I downloaded it from three different pages on Microsoft (one said x64-based systems, but the other did not, the third one does not say x64 or x-anything at all but adds "for Embedded Standard 7" in the title).  All three times, the app said it wasn't compatible with my system.  I only have 32 bits, but I do have Win 7 SP 1.

      I wonder if it might be necessary to upgrade the .NET first??  Pretty clueless otherwise.

Try this:
Windows 7 for 32-bit Systems Service Pack 1
https://www.microsoft.com/downloads/details.aspx?familyid=37315ad0-a892-49e2-a945-29e0e6004504

And here's the applicable security bulletin:
https://technet.microsoft.com/library/security/MS15-078

[kylie]

     Thank you, but I think I was there.  I did it again, anyway.  It says the same thing when I open the downloaded file:  "This update is not applicable to your computer."

[Xanatos]

I use Chrome and have ditched Flash. Youtube works just fine for me. ^^

Danke for the answer. I think I shall try Unity then, since it seems the most cross-platform friendly and the biggest for Win, other than Flash (as far as I am aware).

Thanks to the other(s) who answered as well.

[Geraint]

     Thank you, but I think I was there.  I did it again, anyway.  It says the same thing when I open the downloaded file:  "This update is not applicable to your computer."

Ah well, sorry; perhaps someone more knowledgeable can help you.  Good luck.

[Lorelei Adelaide]

Great.

[Vekseid]

Does anyone know if all Adobe programs are affected by this? For example, I use Adobe Photoshop CS5 for work and it's installed on my home computer. Is that something I should consider getting rid of asap? Thanks in advance for anyone who can/does answer that for me.

Only the components that will process data from untrusted sources - Acrobat Writer/Pro and the various Flash development programs (Flex/Flash Builder, Flash Catalyst, Flash Pro).

There have been other vulnerabilities in various CS components but these are generally harder to pull off even if someone knows you, knows the exploits, knows how to make use of them, knows you use a specific (unpatched) version of CS and you trust them enough to open files that they send you.

[Haibane]

Haibane, you can also try using this: https://support.microsoft.com/en-us/kb/2730071

Thanks! I found that BITS wasn't running. That's Background Intelligent Transfer Service if you want to know Veks.

I still haven't updated but all the pieces are in place now and running.

BTW I found out I have had no Windows updates since February 2011  :-[

I cannot update this particular file as presumably my system is so out of date. I just hope the Win Updater grabs a huge stack of updates next time it runs.

[Darwishi]

Sooo.. what if you can't ditch Flash? XDD  I'm an animator.  Part of making a living relies on Flash Pro CC, is there some way that I can just... avoid everything without totally uninstalling everything Flash related?  I have similar issues with uninstalling Adobe Acrobat DC...

[jouzinka]

How about running it on virtual PC only - when you work?

[Darwishi]

Do what to who for how many jelly beans?

[jouzinka]

Meeeeeeeeeeeeeee, all dem jelly beans. XD I wants dem, I hoards dem.

[Darwishi]

What is this virtual PC you speak of?

[jouzinka]

Hmmm... think of it as a PC within a PC or a remote desktop if you've ever used it? Basically you create a new machine within your machine, but without all the risks to your physical machine.

[Darwishi]

I've only ever seen that done on Linux machines, but that doesn't stop me from having no idea how to do it.  Wouldn't that also steal memory from my current system?

[sleepingferret]

Virtual PCs only "steal" or use memory when you're running them.  When you close them down, they no longer use memory.

So unless you need to have a Virtual PC be running an application constantly as well as your machine remain functional to run other applications simultaneously memory usage by a Virtual PC shouldn't be a concern.

[Vekseid]

Sooo.. what if you can't ditch Flash? XDD  I'm an animator.  Part of making a living relies on Flash Pro CC, is there some way that I can just... avoid everything without totally uninstalling everything Flash related?  I have similar issues with uninstalling Adobe Acrobat DC...

Well, Windows 7 Professional comes with free virtualization software. It's rather slow, and agonizing if you don't have an ssd.

If your living relies on it than there's not much to say, I'm afraid. The writing is seriously on the wall for flash, though. : /

[Fenrisulfr]

Some alternatives for the windows platform (well, they work for more platforms...). The main drawback is that each virtual machine will require quite a bit of space on the hard drive.

Commercial product: VMWare Workstation, http://www.vmware.com/se/products/workstation/

Open source: VirtualBox, https://www.virtualbox.org/

VMWare is somewhat more efficient, but VirtualBox is good. From licens point of view, the virtual installation is a full installation.

Both have "Snapshots", which means you can store the current state of the computer, install programs and do testing, then revert back to the snapshot which removes anything that have been done since that point.

Both gives the option to share folders with the underlying operative system.

[TamaRose]

I find Silverlight to be awesome but that is just my personal opinion.

[Fenrisulfr]

And about relying on flash as an animator? Are we talking about using tools that are made in flash, and have not found any good substitute yet; or developing animations in flash?

If the former, I'm sure there will be more and more tools available that don't rely on flash.

If the later, I guess you should look into, for example, HTML5 and CSS. A lot of things that required flash is not possible to make without it. Still, it is the problem with every browser interprets things its own way and Internet Explorer have been lagging behind.

[Darwishi]

I'm going to have to PM some of you, or start a new thread, about this virtual desktop thing.  I do some other work that could benefit from multiple "computers" and only needs roughly 2GB of RAM each. 

That said, I do animation for clients that want to use Flash.  I've been pushing them away from Flash for years because it's clunky and a pain to work in versus, say, After Effects.  I may just uninstall it and use it when a job comes along? Does that work or would it still need to be on a Virtual PC?

Also, all of my "fun" photos are on Photobucket.  Will uninstalling Flash really mess up that site? And by fun, I mean all of the photos that I link to characters and such.  I'd move them, but I'm pretty sure they number in the thousands. >.>

[jouzinka]

Uninstalling flash might affect your usage of Photobucket when you browse (but wouldn't they have moved to HTML5 by now?), but hotlinks/hyperlinks and your files on their servers will be untouched.

[Darwishi]

I just know that if flash crashes then it's really hard to use photobucket.  Basically my experience with it will be unusable due to no Flash.  I need to copy the image urls somehow...

[Oniya]

I need to copy the image urls somehow...

Right-click, 'Copy Image Location', Paste into Notepad?

[Vekseid]

Photobucket does a lot of crazy crap. I don't know why anyone still uses it, personally.

[Oreo]

I only use it to put frames on my pictures, then I delete the picture and upload it to my wiki.

[Haibane]

I still can't update. BITS is running, Windows Updater is running... it just tells me the service isn't running when I try to update. I now have no idea what to try.

[Vekseid]

Try the fixit? https://support.microsoft.com/en-us/kb/2730071

[jouzinka]

I had no problem digging this out of the depths of my 'bucket with Unity as a substitute for Flash. I think I posted the link to an article with the best substitutes for flash on the first or second page.

[Geraint]

I had no problem digging this out of the depths of my 'bucket with Unity as a substitute for Flash. I think I posted the link to an article with the best substitutes for flash on the first or second page.

Actually, I have had no trouble at all so far with Photobucket, without Flash or any substitute.

I can post pictures (including drag and drop) and find and retrieve links to post, which is pretty much all I do there.  I suspect that is because their ads seem to work all too well without flash.  It's the ads there that control the experience, as they always have priority over allowing work with pictures.

And it doesn't even nudge me to install Flash.

edit.  I should probably clarify that I didn't see any new problems with Photobucket after uninstalling Flash  and not replacing it with anything else.   But it may well be that I simply don't use the parts that need flash. 

Photobucket still has a lot of problems, but I have a decade's worth of content stored there.  And one can still load a picture, grab a link and display it here in less than a minute (assuming one doesn't try to do it in prime time). 

[AmberStarfire]

I've also found Photobucket to be a very good, free site. I haven't tested it out since I got rid of Flash so I might try it and let you know. I've been using Imageshack much more lately and it works fine, but it's not free (after an initial trial).

[Edit] Photobucket works fine without Flash but ew, they've got more ads and popup windows now. That's new. It didn't used to be riddled with stuff like that.

[Darwishi]

Yup, Photobucket works without Flash, which is good!  I actually like it since I can crop on Photobucket when I feel like using a picture...rather than saving it to my desktop on my beastly computer (I have a laptop too that's purely for writing on E), and then using Photoshop to crop it, and then upload it again.  Too many extra steps.  While PB has a lot of ads, it doesn't bother me all that much...it's free and they need money somehow. =P  Plus, that little edit feature is nice.

[Haibane]

Photobucket works fine without Flash but ew, they've got more ads and popup windows now. That's new. It didn't used to be riddled with stuff like that.

Get an ad-blocker for your browser. I have one and it's without equal (apart from Lazarus). I never see ads on the internet, anywhere, ever. Not on Photobucket, not on YouTube. Nowhere.

Try the fixit? https://support.microsoft.com/en-us/kb/2730071

Yes. All this does it make sure BITS is running. Mine wasn't and now it is thanks to this link but I still can't update :(

EDIT: I have BITS running, Updater is running and set to update at the same time each day. I sat by my PC as that time came and went... and nothing. Anyone got any more suggestions please?

[AmberStarfire]

Get an ad-blocker for your browser. I have one and it's without equal (apart from Lazarus). I never see ads on the internet, anywhere, ever. Not on Photobucket, not on YouTube. Nowhere.
Yes. All this does it make sure BITS is running. Mine wasn't and now it is thanks to this link but I still can't update :(

EDIT: I have BITS running, Updater is running and set to update at the same time each day. I sat by my PC as that time came and went... and nothing. Anyone got any more suggestions please?
[/quote

An adblocker is a good idea. Can you click on 'check for updates' and will it show the updates you need successfully, or doesn't it let you reach that step?

[Haibane]

Amber, I get this message:

https://elliquiy.com/forums/index.php?topic=233237.msg11472338#msg11472338

I also can't install the update manually from the MS website. I found out two days ago my Windows 7 installation has had no updates of any kind since Feb 2011. This is why it may refuse to apply the current update.

My problem now is I can't get it to perform any updates.

[jouzinka]

Is reinstal an option for you, Haibane?

[AmberStarfire]

Amber, I get this message:

https://elliquiy.com/forums/index.php?topic=233237.msg11472338#msg11472338

I also can't install the update manually from the MS website. I found out two days ago my Windows 7 installation has had no updates of any kind since Feb 2011. This is why it may refuse to apply the current update.

My problem now is I can't get it to perform any updates.

Are you sure that you don't have any malware on your PC, blocking it? What kind of antivirus and firewall do you use (usually it's Windows or the one that comes with the antivirus software)?

And are you sure BITS and that other process (wuauserv) are running? Like in this article: https://support.microsoft.com/en-us/kb/2730071

[Haibane]

I use AVG and after advice in this thread also installed ESET NOD32. ESET found 8 threats but they were all in software I had downloaded, stored in my "Downloads" directory but never used. I just deleted all the affected products.

I ran MBAM today and it found nothing.

I use the built-in Windows firewall.

Yes, BITs and wuauserv (which is Windows Update itself) are running. I have gone through that article's instructions.

Jouzinka - you mean reinstall Windows? I suppose I could but I've never done it and am scared to in case I lose stuff.

[AmberStarfire]

Have you tried running it from safe mode + networking?

It sounds like you've covered most of what you could do already.

Sometimes antiviruses can block things but it shouldn't, especially when you're using the Windows Firewall.

[Haibane]

I made a bit of progress just now. On an MS help page I found out my Windows Updater was out-of-date. So I updated my updater and its now up-to-date. I rebooted and windows updated... something... it was very quick though (about 30 secs). I didn't think it took anywhere near long enough. I then went to my Windows Update and.. I get the same error message. *pulls hair out and bites the door frame in frustration*

[Twisted Crow]

Stupid question but... Are Adobe Flash and Macromedia Flash the same thing?

[Fenrisulfr]

Stupid question but... Are Adobe Flash and Macromedia Flash the same thing?

Yes. Adobe acquired Macromedia in 2005.

[Fenrisulfr]

I made a bit of progress just now. On an MS help page I found out my Windows Updater was out-of-date. So I updated my updater and its now up-to-date. I rebooted and windows updated... something... it was very quick though (about 30 secs). I didn't think it took anywhere near long enough. I then went to my Windows Update and.. I get the same error message. *pulls hair out and bites the door frame in frustration*

After the reboot, were the services still started? If not set to automatic, they won't start when the system starts up. So it could be that there are a few updates that will need their own reboots.

[Twisted Crow]

Well guess I'm getting rid of Flash, then. Thanks for the heads up, Veks. And thanks for the info Fenrisulfr. :-)

[AmberStarfire]

I made a bit of progress just now. On an MS help page I found out my Windows Updater was out-of-date. So I updated my updater and its now up-to-date. I rebooted and windows updated... something... it was very quick though (about 30 secs). I didn't think it took anywhere near long enough. I then went to my Windows Update and.. I get the same error message. *pulls hair out and bites the door frame in frustration*

Search this file on your computer. Don't make changes to it but it might have some information on what's going on:
windowsupdate.log

I think it's in the Windows folder. At least on 8 it is, but if you try and run it or search it, it should open it up.

[Yano2mch]

Interesting...

For the longest time I've had Windows Update disabled, since I don't particularly trust MS anymore... Course I also have FlashBlock enabled on Firefox so Flash doesn't affect me unless I give it permission to. Quite annoying more and more sites require Javascript AND Flash to view anything on the site. Where has all the simplicity gone?  Quite annoying...

[Sessha]

 I'm pretty dumb when it comes to computer code. So did MS actually fix the problem with an update or what? I'm totally confused here folks.

[hellrazoromega]

As an aside, if you have Adobe Flash installed, I would highly recommend removing it. The more people who get rid of Flash, the more websites will stop relying on it, and the less you'll miss.

The sad part is so many people won't . Steve Jobs tried for years to end Flash and if a guy that influential could not end it, I have to wonder if anything other that a widely publicized and costly hack can. "People in the know," may take Flash off but the average member of the sheeple won't and Adobe will shamble on, as it always has. I'd have taken Flash off long ago but sadly too many sites I need to visit for my living use it ( and don't have non Flash version--*grumble*)  and I am stuck not being able to change until they do*sigh*. I wish you luck in getting [a significant number of] people to change, I really do, because what you say it true, if less people use it change will be inevitable. It's just that I have heard this call many times before and still there is Adobe.  :(

[Oniya]

One side benefit I just discovered to removing Flash is that a number of those irritating 'pop-under' ads use it - and therefore can't fully load. 

Victory!

[gaggedLouise]

If I've understood this right, the fonts that would be dangerous have to be specially crafted and then used on a page where you'd have to access them (that is, open the actual document or video where they're used). So then, does that mean the following?

1) the 'type infection' is not contagious to ordinary fonts. Somebody might craft a font that looks a lot like a well-known font, but it would only be the "crooked font" that carried the attack.

2) the font would have to be used in something you actually click on or start? A specific article, a video clip or a pdf file you'd open. The attack mode isn't simply a drive-by attack from some random webpage or embedded clip in the page, as soon as the wider page is accessed.

or even (since Adobe has featured so much in the discussion)

3) the fonts affected would mostly be special fonts used in graphic and video images (and crafted by the hackers, see above), not in straight written text documents, articles or blog posts, but rather as "show fonts" in Flash and other images?

If all three of those are true it would sort of limit the severity of the threat a bit, at least when it comes to day-to-day internet surfing.

[Yano2mch]

I'm pretty dumb when it comes to computer code. So did MS actually fix the problem with an update or what? I'm totally confused here folks.

Not long ago I watched the history of the computer virus, quite an interesting semi-documentary. Quite simply Microsoft gave security the middle finger for years and years, until more recent internet viruses were quite rampant, forcing restarts on computers before they could get patched, and making systems that you'd think wouldn't need windows were failing (like elevators). Hospitals, railroads got closed down for a period of time while they couldn't do anything.

At some point I think starting with XP they actually started to take computer security somewhat seriously... But really base systems with no protections, user account differences and you always running as root/admin and you could sneeze on their system and infect it. So many features for 'convenience' that end up being totally backwards... autorun for example, I hate it, and it was an easy way to infect computers be it flash drive or cd's.


Here's a link, flash free!(I think) If it's JS free as well it won't ask you annoying questions and just provide the links for the raw videos.

One side benefit I just discovered to removing Flash is that a number of those irritating 'pop-under' ads use it - and therefore can't fully load. 

I remember getting flashblock years ago BECAUSE of flash ads. I'd open several pages so I could get download links and flash would run on every one of them as ads, and bring my laptop to a total and utter crawl. Disable flash and everything works hunky-dory.

[gaggedLouise]

Well, from reading around some about this vulnerability it seems that the first two points I listed in the next-to-last post are accurate. The attack doesn't spread over to legit fonts, and to run the risk of getting the machine infected you'd have to actually visit a page, or open a document, a video etc, that's been set up with a "poisoned font" deliberately included. The threat won't make any kind of random page you've visited several times before suddenly toxic, and one has to count on that webmasters and web security people at e.g. news sites, Youtube, Amazon, Facebook and so on will be upping their antennas for infected content.

[Oniya]

Hate to say it, but there have been several times that Mr. Oniya has gone to a site that 'he's gone to many times before' and had a warning pop up about some virus or other getting blocked.  And this was before the whole Flash thing came out.  Just consider how much content gets put up on Elliquiy every day.  Then multiply that by a metric crap-ton, and you have how much content gets put up on a site like Facebook.  Now, consider the logistics of visiting and scanning each link that the entire user-base posts to one of these sites - realtime, so that a post doesn't sit there and get clicked on by a thousand people while it waits in the 'to be scanned' queue (if the site vets after posting), or so people don't post the same thing five times in a row because 'their post didn't go through!' (if the site vets before posting.)

[Al Terego]

For those that are still running XP:

There is a registry hack that makes your Windows XP masquerade as the XP-based "Windows Embedded POSReady 2009" which is supported until April 9, 2019 (and before you ask, POS means "Point Of Sale" rather than the arguably more apt "Piece Of Shit")

Check here:
http://www.zdnet.com/article/registry-hack-enables-continued-updates-for-windows-xp/

Or just google: posready registry hack

This vulnerability appears to be patched (http://tinyurl.com/ndg2tew)

[Vekseid]

If I've understood this right, the fonts that would be dangerous have to be specially crafted and then used on a page where you'd have to access them (that is, open the actual document or video where they're used). So then, does that mean the following?

1) the 'type infection' is not contagious to ordinary fonts. Somebody might craft a font that looks a lot like a well-known font, but it would only be the "crooked font" that carried the attack.

Yes

2) the font would have to be used in something you actually click on or start? A specific article, a video clip or a pdf file you'd open. The attack mode isn't simply a drive-by attack from some random webpage or embedded clip in the page, as soon as the wider page is accessed.

No, it's been possible since IE 5.5, Firefox 3.6, Chrome since it's inception, etc. to embed a font directly into a web page. So all you have to do is visit a malicious page and you have code running in kernel context.

[Peripherie]

I deleted Adobe Acrobat Reader and downloaded Foxit but had numerous problems, from printing to saving to the program just stalling/freezing on me. I removed it and downloaded Sumatra and haven't had any issues.

Just wanted to provide that feedback unless someone else was going to delete Acrobat and wanted some info on the ones Veks suggested (and thank you for that!).

[Vekseid]

Yeah, I normally use Sumatra but have had problems with a few pdfs where I needed Foxit to view them properly.

Sumatra is extremely lightweight.

[Geeklet]

There is a site I visit that requires flash to be viewable, but something Ive discovered, which might help other people too, is that there is a Chrome Extension called FlashControl, which can disable anything that requires flash automatically, but still allow it to be viewed with a click if you desire to see it.

[Haibane]

I use Sumatra and give it a +1 as well.

[Yano2mch]

Sumatra is extremely lightweight.

I love Sumatra, been using it for years. I sorta found it curious how Adobe PDF Reader will take something like a minute to load and get everything going, when Sumatra is instant, and gives me everything I need. If we can drop flash altogether I'll happily forget Adobe exists.

[Vekseid]

There is a site I visit that requires flash to be viewable, but something Ive discovered, which might help other people too, is that there is a Chrome Extension called FlashControl, which can disable anything that requires flash automatically, but still allow it to be viewed with a click if you desire to see it.

Gwuh, there's an equivalent for Firefox too, called Flashblock. Had completely forgotten about it : /

[Geraint]

Gwuh, there's an equivalent for Firefox too, called Flashblock. Had completely forgotten about it : /

There's a way of setting Internet Explorer to do the same, as long as you don't mind a box popping up at the bottom of the screen every time you visit a site with Flash asking you if you want to enable it for that site.

On a sidenote, I'm running 64bit Windows 7 Professional and IE10 and have Flash entirely removed, but am finding that my computer plays flash files anyway (from a site Veks identified as still using flash) though with a somewhat different looking player.  I can't figure out what is playing them, as I haven't installed another Flash player, but it's not Adobe and I'm not going to complain ... especially as it seems to play them better.

[Yano2mch]

On a sidenote, I'm running <snip> IE10 and have Flash entirely removed, but am finding that my computer plays flash files anyway (from a site Veks identified as still using flash)

Hmmm is IE10 HTML5 compliant? I heard more features were added to help with multimedia and getting around flash perhaps loading a local/default player instead of using adobe's plugin as a middleman (But for non-video I'd be a little more scared).

But I'm not fully certain on this. You might check the task manager, see if any interesting programs are open that weren't open before...

[Oreo]

I have noticed that flash/Youtube still plays, but any page on E or the net that I open that has a video or gif takes at least 45 seconds to load the thread/page. Also the page never stops loading, the load indicator keeps circling.

[Geraint]

I have noticed that flash/Youtube still plays, but any page on E or the net that I open that has a video or gif takes at least 45 seconds to load the thread/page. Also the page never stops loading, the load indicator keeps circling.

That happened for me when I had Flash. :D

[Oreo]

That happened for me when I had Flash. :D

Funny that! It's starting to make me question whether I want to open certain threads or FaceBook.