Prevx 3.0 with SafeOnline build 3.0.5.220 (Windows 0-day exploit fix)

Just auto-updated to .220 RC. This build protects against the new windows vulnerability as posted by TH https://www.wilderssecurity.com/showthread.php?t=287495

Thanks Prevx for a quick counterstrike

 

Actually it's out live and you can download it from the Prevx site download: http://info.prevx.com/downloadcsi.asp PrevxHelp will as always give us a full changelog!

TH

 

Thanks for info I have updated to build 3.0.5.220.

 

Also an Update to the Prevx Blog: http://www.prevx.com/blog/162/Windows-day-exploit-QA-session.html

TH

 

Even the Free Facebook version has been updated to 3.0.5.220 http://www.prevx.com/safebook.asp

TH

 

The only change in this build is the added protection over the exploited registry key. Protection is provided even if you only have the free version installed and it will generically block this entire class of zero-day threats even if you leave your system unpatched (and at this point, I'm not aware of there being any patch for the vulnerability, which can infect your PC from a limited user account).

 

I've got 3.0.5.220 installed, however I had to uninstall the previous build and then install this latest version.
Not a big deal-just thought someone should know.
Thanks.
Hugger

 

@Prevx: Does new build protect HKEY_USERS\EUDC? (source: here)

 

Why am I still on .219 - doesnt auto update work anymore?

 

It takes sometimes a while to get auto updated as Prevx is deploying updates progressively. Anyway you can download it from the link above and manually update.

 

OK.

This version, when in a protected website, kills UAC's Secure Desktop. I have set it for maximum protection, both http and https (default for the latter). Heuristics also set to maximum.

This did not happen with previous version, with the exact same settings.

Windows 7 Ultimate 32-bit

 

Yes, that is the only change

I'm not sure what this would be - are you seeing the desktop as black in the background or is there another issue? We have not made any other changes so I'd be surprised if there was something else like this that has just started happening in .220.

 

What's happening is that, when having a protected website opened, when I elevate some application that requires administrative rights, no Secure Desktop appears; it only appears the box to enter credentials. The Secure Desktop is gone. But, if I don't have any protected website opened, then the Secure Desktop appears just fine.

 

So today mine updated to .220. If I understand this correctly - the update has been available since at least since 25th - free Facebook version auto updates around the 26th - my paid version auto updated today 28th.

So my questions are:

-Must paying Prevx users browse these forums to get there info and ability to - immideatly after its availability - download up to date protection?
-Are the free versions auto updated before the paying customers versions?
-Is the time between the fix beeing available to download and it actually being auto updated along 3 days what i must expect?

Im a bit confused. Or was I already protected from this with payed .219 and thats why I had to wait until last?

Best Regards

 

We don't automatically push out updates immediately to ensure that there aren't any false positives against any Prevx files and that there are no issues in the changed version. You can click "Check for Updates" or download the new version, but most of our users don't - and this is by design to manage potential problems.

 

No more news yet?

I already uninstalled and reinstalled, but same happens. As I mentioned, when I have a protected web site opened, and then start an application with administrator rights, the Secure Desktop (the black background screen) won't appear, only the box to enter credentials.

And, if I leave the protected website, then all is OK.

 

I guess it might be due to screen anti-logging capability of Prevx.

 

If you lower protection to High and then reboot, does that fix it? I suspect you're right in that Prevx is preventing Windows from seeing the screen.

Thanks!

 

I cannot lower and reboot now, because it's not installed in the system I use, rather on a relative's. But, with previous version this did not happen, with maximum settings. Why now, if nothing but the exploit protection was added?

 

I can understand this when updates are just regular program patches. However when there is acute vulnerability which is used to spread 0-day malware the update routine should be different. In those cases paying customers shoud be top priority, first ones who get the update. This is just my humble opinion.

 

I'm really not sure - it's possible that something else on the system could affect it but there were no other changes in .220.

 

This is odd. One other relative with the same exact setup as the other, has no issues of what-so-ever.

Clearly something that I'd like to solve, without decreasing SOL security.

 

Agreed!

 

Unfortunately we still have to follow the same procedures - pushing out a software update immediately is generally a bad idea. For example, if Symantec had a false positive on pxkbf.sys because it was not whitelisted and we pushed out the update to all users immediately, we would suddenly have several million users with a completely broken keyboard. We have to be cautious when releasing new updates - even though .220 was only one line of code different from .219, there is still a wide range of potential problems if other vendors mis-identify our components.

 

-Edit-

Would it be possible to make Prevx not interfere with the Secure Desktop, even if you cannot reproduce it there? I dislike having to reduce SOL settings.