windows 8

Massive vulnerability in Windows Defender leaves most Windows PCs vulnerable (CVE-2017-0290)

A vulnerability has been identified in the malware protection engine (Windows Defender) that is used in almost every recent version of Windows (7, 8, 8.1, 10, and Server 2016). Since Windows Defender is installed by default on all Windows PCs, it leaves many enterprises and users vulnerable to it.

This exploit allows remote attackers to take over the system, without any intervention by the system owner. Attackers could craft an email or an instant message, which when scanned by the vulnerable system, could lead to remotely taking over the system. Anything that can be automatically scanned by Windows Defender e.g. file shares, websites etc. could be used to attack the system. This exploit could also be written as a worm to scan other vulnerable systems and replicate it.

Microsoft has released and pushed an immediate patch against this code execution vulnerability. According to Microsoft, the risk is lower on Windows 10 and Windows 8.1 system because of its security feature to protect against memory corruption on these systems.

You are advised to perform a manual check whether your PC has been updated. To do so, go to “Windows Defender settings” and if the Engine version number is 1.1.13704.0 or higher means the system is patched. For others, you need to act immediately to install the latest updates to avoid being vulnerable to future attacks.

You receive a “The User Profile Service failed the logon” error message

Symptoms

When you log on to a Windows 7-based or a Windows Vista-based computer by using a temporary profile, you receive the following error message:

The User Profile Service failed the logon. User profile cannot be loaded.

Solutions

Fix the user account profile

Machine Start on Safe Mode
Click Start
Type ‘Regedit’
Open ‘Registry Editor’ Windows
First Take Backup on Registry
Click ‘File’ -> ‘Export’ -> ‘Latestdateregbak’ (i.e 29092013regbak) save.
After Taking Registry Backup

In Regisrty Editor

Expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
In the navigation pane, locate the folder that begins with S-1-5 (SID key) followed by a long number.
Click each “S-1-5” folder,
Locate the “ProfileImagePath” entry in the details pane, and then double-click to make sure that this is the user account profile that has the error.

If you have two folders starting with S-1-5 followed by some long numbers and one of them ended with .bak,
you have to rename the .bak folder. To do this, follow these steps:
Right-click the folder without .bak, and then click Rename. Type .ba, and then press ENTER.

Right-click the folder that is named .bak, and then click Rename. Remove .bak at the end of the folder name, and then press ENTER.

Right-click the folder that is named .ba, and then click Rename. Change the .ba to .bak at the end of the folder name, and then press ENTER.

If you have only one folder starting with S-1-5 that is followed by long numbers and ends with .bak. Right-click the folder, and then click Rename. Remove .bak at the end of the folder name, and then press ENTER.

Double-click the folder without .bak in the details pane, double-click RefCount, type 0, and then click OK.

Click the folder without .bak, in the details pane, double-click State, type 0, and then click OK.

Close Registry Editor.
Restart the computer.
Log on again with your account.

Courtesy :- Microsoft Corportation

Posts

Massive vulnerability in Windows Defender leaves most Windows PCs vulnerable

Massive vulnerability in Windows Defender leaves most Windows PCs vulnerable (CVE-2017-0290)