Microsoft releases VML fix for Windows 98

98 Guy wrote:
chrisv wrote:

Thus a Win98 user using AVG has a strong possibility of
being infected.

You get what you pay for.

Which means XP users back between 2002 to 2004 got screwed.

No argument. XP was probably the most fragile OS ever. SP1 fixed most of the
stability problems though. I was an early implementer... painful!

But I was refering to AVG. It has always been the King of False Positives
while missing real viruses.


Win-98 was a much better bang-for-the-buck compared to XP.

Arguably it still is.

Wait until Microsoft owns your desktop with Vista, with it's orwellian
media rights management infrastructure.

It will have to offer more than what I know so far to get me to install
Vista. There's a good chance that you'll have to upgrade most, it not all of
your apps because of that media rights stuff.

98 Guy wrote:
"David H. Lipman" wrote:

Win9x/ME is based upon a 16bit memory pool. It uses up that
memory pool quite quickly.

Win 98 has 5 heaps (which collectively are called "resources"),

Which *5* heaps? Can you specify them - by name?

"Bill in Co." wrote:

Which *5* heaps? Can you specify them - by name?

16-bit User heap
32-bit User window heap
32-bit User menu heap
16-bit GDI heap
32-bit GDI heap

The above 2 16-bit resource heaps are the cause of "insufficient
resource" messages. They are for compatibility with Win-95, Win 3.x,
and DOS applications. In time, as more of those apps were abandoned
and replaced with 32-bit applications, Win-98 users encountered fewer
and fewer insufficient resource situations. I haven't seen an
insufficient resource message in at least 4 or 5 years.

But Win-98 haters will continue to bash Win-98 because of the
insufficient resource condition that resulted because of backwards
compatibility with 16-bit apps. It's long since been a bogus
argument.

David H. Lipman wrote:
From: "Dan"


| Fantastic, I followed your instructions and saw the two colored boxes
| with Internet Explorer and it works fine. Good point about making the
| original vgx.dll to a vgx.bak file just in case it is needed in the
| future for some reason which I highly doubt. Thanks so much for going
| to the trouble of keeping 98SE machines secure. I now have a bunch of
| work in patching all the 98SE machines at school. grin P.S. I
| wonder when 2000 goes into unsupported mode as well if the XP and then
| Vista patches will be able to be deconstructed and broken down into
| pieces and used like this patch has been by us.

Sorry Dan but if you are STILL using Win98 in a school environment by the time Vista comes
out then the school is a fool !


You can call us fools all you want David but the truth must come
out. Check out what secunia.com says about so called security in XP
Pro., XP Home and Windows 2000 Pro. and compare it to 98SE. In
addition, it is nice to have the backwards compatibility with 98SE for
the older Windows 3.1 programs and DOS programs the school possesses.
You mean you want the Albuquerque public schools and all public
schools in the United States to get rid of their older 98SE machines
that still work for newer ones that will not support the older software.
Give us a break, David, the public schools are not so rich as to be
able to afford brand new XP Pro. computers all the time and in addition
let all the perfectly good software go to waste (Windows 3.1 and DOS
software that the schools still have). This would be a crying shame if
it happened. Think of the amount of garbage that would be generated by
this action.
Actually, Microsoft is the real fool here for not yet listening to
my wise advice about having a Classics series that will run on older
computers as well as modern ones and be as backwards compatible as 98SE.
It must be based on the 9x source code and it can indeed be done. It
should actually be Microsoft's duty to do this for the good of all
humanity. It in no way would threaten XP's and Vistas forth coming
legacy because it would be aimed at users who still want their old
programs to run and cannot run them anymore on XP machines. This is all
too common and I have heard from many computer friends that I know about
how they want this to happen and are interested in more simplicity than
ever bloated and complicated code that is being released in newer
software. This is what democracy in America is all about. The consumer
gets to choose and the marketplace should be based on supply and demand.


http://secunia.com/product/22/


View Indepth Details For This Product:
Display Summary Only
Secunia Advisory Statistics (All time)
2006
2005
2004
2003
List of Secunia Advisories (All time)
2006
2005
2004
2003
Send Feedback

Vendor Microsoft

Product Link N/A

Affected By 153 Secunia advisories

Unpatched 18% (28 of 153 Secunia advisories)

Most Critical Unpatched
The most severe unpatched Secunia advisory affecting Microsoft Windows
XP Professional, with all vendor patches applied, is rated Highly critical

http://secunia.com/product/16/

Vendor Microsoft

Product Link N/A

Affected By 138 Secunia advisories

Unpatched 18% (25 of 138 Secunia advisories)

Most Critical Unpatched
The most severe unpatched Secunia advisory affecting Microsoft Windows
XP Home Edition, with all vendor patches applied, is rated Highly critical


http://secunia.com/product/1/

Vendor Microsoft

Product Link View Here (Link to external site)

Affected By 131 Secunia advisories

Unpatched 15% (19 of 131 Secunia advisories)

Most Critical Unpatched
The most severe unpatched Secunia advisory affecting Microsoft Windows
2000 Professional, with all vendor patches applied, is rated Highly critical

http://secunia.com/product/13/

Vendor Microsoft

Product Link N/A

Affected By 32 Secunia advisories

Unpatched 9% (3 of 32 Secunia advisories)

Most Critical Unpatched
The most severe unpatched Secunia advisory affecting Microsoft Windows
98 Second Edition, with all vendor patches applied, is rated Less critical

---------------------------------------------------------------------

David, I tri-boot with 98SE, XP Pro. and Windows Vista Ultimate 32 bit
that is being tested mainly for security issues but also for ease of
use. I am a Microsoft shareholder so I want Microsoft to do well.
Microsoft is extremely tough to crack but I feel any company can be made
to do what is right if enough pressure is applied. I plan on testing
Office 2007 soon as well. In addition, I plan to expand my field to
learning about Apples and Linux. The truth must come out!

Where are those 5 documented? Do you happen to have a web reference
handy?

98 Guy wrote:
"Bill in Co." wrote:

Which *5* heaps? Can you specify them - by name?

16-bit User heap
32-bit User window heap
32-bit User menu heap
16-bit GDI heap
32-bit GDI heap

The above 2 16-bit resource heaps are the cause of "insufficient
resource" messages. They are for compatibility with Win-95, Win 3.x,
and DOS applications. In time, as more of those apps were abandoned
and replaced with 32-bit applications, Win-98 users encountered fewer
and fewer insufficient resource situations. I haven't seen an
insufficient resource message in at least 4 or 5 years.

But Win-98 haters will continue to bash Win-98 because of the
insufficient resource condition that resulted because of backwards
compatibility with 16-bit apps. It's long since been a bogus
argument.

David H. Lipman wrote:
From: "98 Guy"

| "David H. Lipman" wrote:

Sorry Dan but if you are STILL using Win98 in a school environment
by the time Vista comes out then the school is a fool !

| No, the school is not a fool.

| If the school did move to Vista, then the taxpayers would be fools.

| Does electronic page-turning really need Vista? Or XP?

| Do you really want to see school boards throwing out perfectly good
| PC's and replace them with the Cray's that they'll need to run Vista?

You can defend this POV all you want but, Win98 is a DEAD OS and as time goes on, it will
be left behind, more and more.
Sorry, but you will have to face that fact.


Not if I can help it, David. I will be a mover and shaker and if my
work cannot succeed with Microsoft then I will move my 9x coding to an
open source company that is interested.

Dustbin Ko0k wrote:
Dan wrote:
thanatoid wrote:
Great. Does this mean you will FINALLY stop torturing everyone
here with your incessant prattling on this largely irrelevant
subject?
It is not irrelevant.

Actually, it is.
Were you a victim?
Do you know anyone who was a victim?



An illogical post to be sure.

David H. Lipman wrote:
|
| Actually, it is.
| Were you a victim?
| Do you know anyone who was a victim?
|

I know victims. It is NOT irrelevant. This is a IE problem, not an OS problem.
Microsoft has decided to cut-off support for Win9x/ME. However that does NOT make Win9x/ME
users less vulnerable. If one visits a VMFill Exploit based web site, they can be infected
in seconds and since many of the sites are using NEW malware, their respective AV software
may not detect tghe malware. As of my last test, the most commonly used freebies didn't
recognize an HTML file known to use the VMFill Exploit. Thus a Win98 user using AVG has a
strong possibility of being infected.

This thread is very rellevant !


Thank you David and I agree with you completely on the point of
relevance of this thread.

David H. Lipman wrote:
From: "chrisv"



| You get what you pay for.

Well AntiVir does OK on the file I submitted.

AVG and Avast -- still don't get it !

I keep saying, of the freebies, AntiVir is better !

Not listed in the below Virus Total report is Trend Micro:
l00p.html.1 [EXPL_EXECOD.A]



Complete scanning result of "l00p.html.1", processed in VirusTotal at 09/28/2006 04:26:28
(CET).

[ file data ]
* name: l00p.html.1
* size: 86923
* md5.: 66ddd835cb6a6ab4d561c0cbd9c8450a
* sha1: 65c76f6b3a6853527ee60ee004234d43c2d3bcb4

[ scan result ]
AntiVir 7.2.0.18/20060927 found [HTML/Dldr.Go.MG.3.B]
Authentium 4.93.8/20060928 found [HTML/VMLFill@expl]
Avast 4.7.892.0/20060927 found nothing
AVG 386/20060927 found nothing
BitDefender 7.2/20060928 found [Exploit.HTML.Execod.A]
CAT-QuickHeal 8.00/20060927 found [CVE-2006-4868]
ClamAV devel-20060426/20060927 found nothing
DrWeb 4.33/20060927 found [Exploit.VMLFill]
eTrust-InoculateIT 23.73.7/20060928 found [JScript/Veemyfull!exploit!Trojan]
eTrust-Vet 30.3.3103/20060927 found [JS/Veemyfull!exploit]
Ewido 4.0/20060927 found [Not-A-Virus.Exploit.HTML.VML.d]
F-Prot 3.16f/20060928 found [HTML/VMLFill@expl]
F-Prot4 4.2.1.29/20060928 found [HTML/VMLFill@ex]
Fortinet 2.82.0.0/20060927 found [HTML/MS06.XMLNS!exploit]
Ikarus 0.2.65.0/20060928 found [Exploit.HTML.Execod.A]
Kaspersky 4.0.2.24/20060928 found [Exploit.HTML.VML.d]
McAfee 4861/20060927 found [Exploit-VMLFill]
Microsoft 1.1603/20060928 found [Exploit:HTML/Levem.C]
NOD32v2 1.1780/20060927 found [HTML/Exploit.VMLFill]
Norman 5.80.02/20060927 found [JS/VMLexploit]
Panda 9.0.0.4/20060927 found [Exploit/VML.A]
Sophos 4.10.0/20060928 found nothing
Symantec 8.0/20060928 found [Bloodhound.Exploit.78]
TheHacker 6.0.1.085/20060928 found [Trojan/Exploit.VML]
UNA 1.83/20060927 found nothing
VBA32 3.11.1/20060927 found nothing
VirusBuster 4.3.7:9/20060927 found [JS.ExpDL.A]



Thanks for the post, David. I used to use AntiVir but I gave it up and
moved to AVG when AntiVir had some problems on my system. The one thing
I really like about AVG is how it scans my 98SE part of my machine for
viruses while Windows 98SE is still loading.

chrisv wrote:
David H. Lipman wrote:
From: "chrisv"



You get what you pay for.
Well AntiVir does OK on the file I submitted.

AVG and Avast -- still don't get it !

I keep saying, of the freebies, AntiVir is better !

Totally agree.

AVG has always been a bit of a joke... Avast swings from good to bad.

The list os scan results is a good reason I started using NOD32 years ago...
and it contributes to why I have never been infected in spite of attempts
made. Being careful and aware are still the best tools though.


Not listed in the below Virus Total report is Trend Micro:
l00p.html.1 [EXPL_EXECOD.A]



Complete scanning result of "l00p.html.1", processed in VirusTotal at
09/28/2006 04:26:28 (CET).

[ file data ]
* name: l00p.html.1
* size: 86923
* md5.: 66ddd835cb6a6ab4d561c0cbd9c8450a
* sha1: 65c76f6b3a6853527ee60ee004234d43c2d3bcb4

[ scan result ]
AntiVir 7.2.0.18/20060927 found [HTML/Dldr.Go.MG.3.B]
Authentium 4.93.8/20060928 found [HTML/VMLFill@expl]
Avast 4.7.892.0/20060927 found nothing
AVG 386/20060927 found nothing
BitDefender 7.2/20060928 found [Exploit.HTML.Execod.A]
CAT-QuickHeal 8.00/20060927 found [CVE-2006-4868]
ClamAV devel-20060426/20060927 found nothing
DrWeb 4.33/20060927 found [Exploit.VMLFill]
eTrust-InoculateIT 23.73.7/20060928 found
[JScript/Veemyfull!exploit!Trojan]
eTrust-Vet 30.3.3103/20060927 found [JS/Veemyfull!exploit]
Ewido 4.0/20060927 found [Not-A-Virus.Exploit.HTML.VML.d]
F-Prot 3.16f/20060928 found [HTML/VMLFill@expl]
F-Prot4 4.2.1.29/20060928 found [HTML/VMLFill@ex]
Fortinet 2.82.0.0/20060927 found [HTML/MS06.XMLNS!exploit]
Ikarus 0.2.65.0/20060928 found [Exploit.HTML.Execod.A]
Kaspersky 4.0.2.24/20060928 found [Exploit.HTML.VML.d]
McAfee 4861/20060927 found [Exploit-VMLFill]
Microsoft 1.1603/20060928 found [Exploit:HTML/Levem.C]
NOD32v2 1.1780/20060927 found [HTML/Exploit.VMLFill]
Norman 5.80.02/20060927 found [JS/VMLexploit]
Panda 9.0.0.4/20060927 found [Exploit/VML.A]
Sophos 4.10.0/20060928 found nothing
Symantec 8.0/20060928 found [Bloodhound.Exploit.78]
TheHacker 6.0.1.085/20060928 found [Trojan/Exploit.VML]
UNA 1.83/20060927 found nothing
VBA32 3.11.1/20060927 found nothing
VirusBuster 4.3.7:9/20060927 found [JS.ExpDL.A]



I have heard a lot about Nod32 and will have to check it out someday.