Proactive Security Auditor

[Tomalak]

Hi,

just wanted to inform you about a fine small utility I discovered that might be a good GUI alternative to hfnetchk:

http://www.elcomsoft.com/psa.html

Its output is not as concise as the .txt file output of hfnetchk (PSA allows exporting its results to a HTML file), but it offers IMHO a really nice overview.

Have fun with it!

[murvun]

I'm using windows 2000 sp4 german edition.

While windows update is completely happy (testet 10 seconds ago) PSA FE (date:14.3.2006) tells me 7 Bulletins not installed:

MS02-064 (KB327522) - default permissions allows trojan horse

MS04-016 (KB839643) - DirectPlay allows DoS

MS04-028 (KB833987) - JPEG (GDI+) allows code execution

MS05-009 (KB885492 and 887472) - PNG leads to Buffer Overrun

MS05-044 (KB905495) - FTP allows local transfer

MS05-050 (KB904706) - DirectShow allows remote code execution

MSXML 3.0SP7 should be installed instead of SP5

someone with same experiences? something I must do?

thanx

Edited March 22, 2006 by murvun

[tommyp]

What do the results of the microsoft baseline analyzer say?

Edited March 22, 2006 by tommyp

[murvun]

Microsoft Baseline Security Analyzer:

Windows safety updates: no missing update

[Tomalak]

Microsoft Baseline Security Analyzer:

Windows safety updates: no missing update

That's strange, PSA works perfectly for me (Win XP SP2 though, not Win 2000). Does the tool really say "missing" or just "note"? I've some of those as well, the helpfile tells about the status "note":

This is a special status. It means that PSA was not able to determine whether the patch is installed or not. This is not due to PSA error, but because the mssecure.xml file contains no information about affected files and/or registry keys for this bulletin.

So you may indeed have all patches installed and there is no discrepancy between WU/MU, MBSA and PSA.

[murvun]

Tomalak: You are right: they are only signed as a note - I did not read, what 'note' was meaned... so they are installed, but mssecure.xml contains no information, how to detect them...

All: have a nice weekend. /me is in Cyrodiil.

[murvun]

just to pull this thread on top:

Proactive Security Auditor FE (Freeware Edition) is a free, small, fast and easy to use program to assist system administrators and ordinary users to keep their computers secure by identifying what security updates are installed on local and remote machines, and allowing to download and install missing patches from Microsoft web site.

the great +++ against Windows Update and MS Baseline security Analyzer is: you don't need the service "SERVER" running! even the command line mbsacli.exe needs "SERVER" running

just my 2 cents.

Edited April 13, 2006 by murvun