|
There are isolated problems with current patches, but they are well-known and documented on this site. |
So the other day we had folks reporting issues with Defender and Western Digital drivers. Today Citrix Broker service was flagged as malicious and wel
[See the full post at: Patch Lady – Defender not having a good week]
Susan Bradley Patch Lady/Prudent patcher
In addition to the issue reported here, MS Security Essentials recently (ca.~July 28) began to quarantine MVPS HOSTS file and other customized HOSTS files derived from MVPS HOSTS. Perhaps because on about half of my 27 endpoints on my home network had been using MS’s Security Essentials w/o issue for years either I did not configure more verbose warnings or could set and forget, but it was not until I saw strange behavior for expected HOSTS file changes and nothing happened that I looked farther and found ALL of my customized files had been silently removed, then unable to edit. I had to painfully on each endpoint allow this file by wildcard which I hated doing punching holes in a security layer but I’d rather have the HOSTS file under MY control containing what I want instead of MS. Of course I also use DNS blackholing but like the belt and suspenders especially for portable endpoints not always on my DNS. On one hand good for MS doing some recon on modified HOSTS files which could be a result of malicious actors, but bad because this changed what was in my experience years of consistent behavior and did so w/o any notification unless you looked on each asset for what was in quarantine AFTER the fact and unexpected behavior resulted. Taking several rounds of 20 questions to “allow” but still finding the HOSTS file on some endpoints again quarantined, finally resorting to wild carding the file finished off making the decision to dump MS Security Essentials on those computers it had previously not caused problems.
With over 20 years experience in a scientific computing environment managing thousands of Windows computers for scientific work on a government network and also on my home network now that I am retired, consistent computing platforms that can be predictably managed support the mission. Inconsistent behavior especially because of unannounced/untested changes made by the OS (or other software) vendor and even back-doored in do the bad guys work for them and break things. Disgusted with this mess and glad to be retired but more than a little annoyed the shell game continues. Stop it!
Same as geekdom here (Win10Pro v1909 x64 Build 18363.959 (Baseline) / 18363.1016 (Beta Testing)),
Antimalware Client Version: 4.18.2007.8
Engine Version: 1.1.17300.4
Antivirus Version: 1.321.1424.0
Antispyware Version: 1.321.1424.0No Windows Defender errors.
That new 4.18.2008.4 platform that Susan and others are talking about is likely a BETA being pushed through whatever preview/fast ring/insider initiatives are currently happening. It may or may not be the next engine to supersede the current one (4.18.2007.8).
IMHO, hacking the Registry (by adding a few REG_DWORD keys) to “flag” the system as a candidate to automatically get a BETA engine to auto-install might not be the smartest move. I would just wait a few more days… When the next engine is “ready” it will be made available through the Catalog, at the usual location:
https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623
Ironically, the supporting KB article at
https://support.microsoft.com/en-us/help/4052623
is also slightly behind: it is still referring the previous engine (4.18.2005.5, made available at the Catalog on June 3rd, 2020).
Regarding Redmond’s decision to began flagging some customized HOSTS files as “malicious” one may workaround the “issue” by manually defining an explicit exclusion rule:
(it may also be viable doing that for multiple endpoints, through a script that ‘reg add”s the rule – although it is a bit tricky as it involves dealing with ownership and permissions, etc)
Note however that, because this rule would also allow malware to silently add malicious entries as well, the HOSTS file should always be closely monitored for any unexpected changes.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Notifications