KB836528 - Texas fertilizer?

Windows Update offers KB836528 (Mydoom, Zindos, and Doomjuice Worm Removal
Tool) as a critical update with the following ominous message:

The appearance of this update means that your machine is likely infected
with one or more of these worms.

How do they come to this conclusion? My up-to-date anti-virus product does
not agree and gives the machine a clean bill of health. What are MS playing
at? Producing bogus critical updates will not encourage confidence in
users.

Terry

Ian
Tue Aug 17 14:01:17 CDT 2004

Terrycymru <me@privacy.net> wrote in news:1mm9jnayw86h0$.fstdfza4bzhx.dlg@
40tude.net:

> Windows Update offers KB836528 (Mydoom, Zindos, and Doomjuice Worm
Removal
> Tool) as a critical update with the following ominous message:
>
> The appearance of this update means that your machine is likely infected
> with one or more of these worms.
>
> How do they come to this conclusion? My up-to-date anti-virus product
does
> not agree and gives the machine a clean bill of health. What are MS
playing
> at? Producing bogus critical updates will not encourage confidence in
> users.
>
> Terry
>

In case you or other newsgroup participants didn't read the Knowledge Base
article...

What the article says (in part):
The Windows Update Web site and Automatic Updates will offer you version
4.0 of the Mydoom Worm Removal Tool if your computer appears to be infected
with Mydoom.A, Mydoom.B, Mydoom.E, Mydoom.F, Mydoom.J, Mydoom.L, Mydoom.O,
Zindos.A, Doomjuice.A, or Doomjuice.B, or if your computer contains
remnants of an infection, such as registry keys that are left behind.

Notice that you don't have to be currently infected, there just have to be
"remnants of an infection".

You can read the entire article at

http://support.microsoft.com/default.aspx?scid=kb;en-us;836528

to see the details of what the removal tool looks for (and presumably what
the update software looks for), and what the removal tool removes.

--
Ian Shef
These are my personal opinions and not those of my employer.

Shane
Tue Aug 17 18:30:19 CDT 2004


"Terrycymru" <me@privacy.net> wrote in message
news:1mm9jnayw86h0$.fstdfza4bzhx.dlg@40tude.net...
> Windows Update offers KB836528 (Mydoom, Zindos, and Doomjuice Worm Removal
> Tool) as a critical update with the following ominous message:
>
> The appearance of this update means that your machine is likely infected
> with one or more of these worms.
>
> How do they come to this conclusion? My up-to-date anti-virus product does
> not agree and gives the machine a clean bill of health. What are MS
playing
> at? Producing bogus critical updates will not encourage confidence in
> users.

Besides what Ian says, what on earth makes you think your AV is perfect? Not
that MS updates are, but if you think your AV not finding anything means
your machine, beyond any doubt, has no infection, you need to get
realistically paranoid.

Shane

Terrycymru
Wed Aug 18 00:43:10 CDT 2004

On Wed, 18 Aug 2004 00:30:19 +0100, Shane wrote:

> Besides what Ian says, what on earth makes you think your AV is perfect? Not
> that MS updates are, but if you think your AV not finding anything means
> your machine, beyond any doubt, has no infection, you need to get
> realistically paranoid.
>
> Shane

I trust the latest versions of F-Prot and McAfee Stinger more than
Micro$oft. FYI I practice safe hex and don't use garbage like Internet
Explorer or Outlook Express. I have never had an infection in 15 years of
PC use. However, I have had my machines messed up several times by dodgy
Windows Updates!

Terry

Shane
Wed Aug 18 00:48:56 CDT 2004


"Terrycymru" <me@privacy.net> wrote in message
news:fgch6ivyc7oi$.1c111sdodyfxo$.dlg@40tude.net...
> On Wed, 18 Aug 2004 00:30:19 +0100, Shane wrote:
>
> > Besides what Ian says, what on earth makes you think your AV is perfect?
Not
> > that MS updates are, but if you think your AV not finding anything means
> > your machine, beyond any doubt, has no infection, you need to get
> > realistically paranoid.
> >
> > Shane
>
> I trust the latest versions of F-Prot and McAfee Stinger more than
> Micro$oft. FYI I practice safe hex and don't use garbage like Internet
> Explorer or Outlook Express. I have never had an infection in 15 years of
> PC use. However, I have had my machines messed up several times by dodgy
> Windows Updates!
>

Yes, I use those - and several others. I use F-Prot for DOS and have long
recommended it, but the F-Prot engine isn't that great. While Stinger is
only a removal tool with a fairly limited detection range (compared to Trend
Micro's Sysclean, at least). But even if those two were the best AV tools
there'd ever been, just because they pass your machine is not conclusive
proof of zero infection. No AV is 100% reliable or effective. If you know
about Safe Hex you surely know that - yet your original post indicates
otherwise.

Shane