Security Update for Internet Explorer 11 (KB3139929)

Slashdot contains a post that claims the Security Update for Internet
Explorer 11 for KB3139929 -- released two days ago -- also includes
KB3146449, which puts an advertising banner for Windows 10 on IE
windows. The assertion is made that this is a Trojan, a form of malware.

See "Patch Tuesday Brought Windows 10 Ad Generator" at
http://tech.slashdot.org/story/16/03/10/1524238/patch-tuesday-brought-windows-10-ad-generator.


--
David E. Ross

While many tributes to the late Supreme Court Associate Justice
Antonin Scalia now fill the news media, his legacy was not
necessarily positive. See my "What Price Order, Mr. Justice Scalia?"
at http://www.rossde.com/editorials/edtl_scalia_wrong.html.

On 10 Mar 2016, "David E. Ross" wrote in
alt.windows7.general:

Slashdot contains a post that claims the Security Update for
Internet Explorer 11 for KB3139929 -- released two days ago --
also includes KB3146449, which puts an advertising banner for
Windows 10 on IE windows. The assertion is made that this is a
Trojan, a form of malware.

See "Patch Tuesday Brought Windows 10 Ad Generator" at
http://tech.slashdot.org/story/16/03/10/1524238/patch-tuesday-brought-windows-10-ad-generator.

I have installed KB3139929 on three computers. I show no listing
for KB3146449. There is no advertisement on new tabs in Internet
Explorer on any of them.

I'm skeptical about this unverified report.

Nil wrote:
On 10 Mar 2016, "David E. Ross" wrote in
alt.windows7.general:

Slashdot contains a post that claims the Security Update for
Internet Explorer 11 for KB3139929 -- released two days ago --
also includes KB3146449, which puts an advertising banner for
Windows 10 on IE windows. The assertion is made that this is a
Trojan, a form of malware.

See "Patch Tuesday Brought Windows 10 Ad Generator" at
http://tech.slashdot.org/story/16/03/10/1524238/patch-tuesday-brought-windows-10-ad-generator.

I have installed KB3139929 on three computers. I show no listing
for KB3146449. There is no advertisement on new tabs in Internet
Explorer on any of them.

I'm skeptical about this unverified report.

Reported, but not yet verified here. Usually, if
there is some badness in the wild, it gets
tallied here.

http://www.askwoody.com/tag/kb-3146449/

Paul

On Thu, 10 Mar 2016 11:07:42 -0800, David E. Ross wrote:

Slashdot contains a post that claims the Security Update for Internet
Explorer 11 for KB3139929 -- released two days ago -- also includes
KB3146449, which puts an advertising banner for Windows 10 on IE
windows. The assertion is made that this is a Trojan, a form of malware.

See "Patch Tuesday Brought Windows 10 Ad Generator" at
http://tech.slashdot.org/story/16/03/10/1524238/patch-tuesday-brought-windows-10-ad-generator.

So what now? Uninstall it? It contains a security patch, doesn't it?

--
s|b

s|b wrote on 2016/03/10:

David E. Ross wrote:

Slashdot contains a post that claims the Security Update for Internet
Explorer 11 for KB3139929 -- released two days ago -- also includes
KB3146449, which puts an advertising banner for Windows 10 on IE
windows. The assertion is made that this is a Trojan, a form of malware.

See "Patch Tuesday Brought Windows 10 Ad Generator" at
http://tech.slashdot.org/story/16/03/10/1524238/patch-tuesday-brought-windows-10-ad-generator.

So what now? Uninstall it? It contains a security patch, doesn't it?

This is the description for KB3139929:

This security update resolves several reported vulnerabilities in
Internet Explorer. The most severe of these vulnerabilities could
allow remote code execution if a user views a specially crafted
webpage in Internet Explorer. To learn more about these
vulnerabilities, see Microsoft Security Bulletin MS16-023.


Additionally, this security update includes several
_nonsecurity-related fixes_ for Internet Explorer.

The 2nd link (underlined above) does NOT go to a list of what are the
several other updates included in this security update. Instead that
link goes to a general info page (https://support.microsoft.com/). When
someone is being furtive, they are lying. Those other included updates
are NOT security fixes. So Microsoft is at it again by rolling together
UNRELATED updates. They've done this before, like melding an SSO
(single sig-on) update with an Excel update: the two updates in one were
unrelated. If you want one, you're stuck with the other (which may not
even apply to your instance of Windows or apps). Again Microsoft is
deliberately furtive about just what an update does or what it includes.

"could allow remote code execution if a user views a specially crafted
webpage in Internet Explorer". If the report is true (not yet verified
by any recognized authority or even a journalistic-level report) about
"several nonsecurity-related fixes" will include KB3146449, then
Microsoft has you trading a vulnerability for their adware. No thanks.
I'll instead rely on 3rd party software to protect my host. Obviously
Microsoft has no such real interest in doing so.

On 11/03/2016 5:07 AM, David E. Ross wrote:
Slashdot contains a post that claims the Security Update for Internet
Explorer 11 for KB3139929 -- released two days ago -- also includes
KB3146449, which puts an advertising banner for Windows 10 on IE
windows. The assertion is made that this is a Trojan, a form of malware.

See "Patch Tuesday Brought Windows 10 Ad Generator" at
http://tech.slashdot.org/story/16/03/10/1524238/patch-tuesday-brought-windows-10-ad-generator.


KB3146449 has not appeared here for download yet but its description is

"About this update
This update adds functionality to Internet Explorer 11 on some computers
that lets users learn about Windows 10 or start an upgrade to Windows 10."

Will watch for it

--
~~~~~~~~~~~~
Maurice Helwig
~~~~~~~~~~~~

On 2016-03-10 14:07, David E. Ross wrote:

Slashdot contains a post that claims the Security Update for Internet
Explorer 11 for KB3139929 -- released two days ago -- also includes
KB3146449, which puts an advertising banner for Windows 10 on IE
windows. The assertion is made that this is a Trojan, a form of malware.

See "Patch Tuesday Brought Windows 10 Ad Generator" at
http://tech.slashdot.org/story/16/03/10/1524238/patch-tuesday-brought-windows-10-ad-generator.

Thanks for the warning, I'm skipping KB3139929 (and I'll probably have
to skip all future IE updates as well). It's ok, I use IE on like 3
websites (out of the hundreds I visit with Firefox). I was hoping we
could install KB3139929 and then remove KB3146449, but it looks like we
can't...

Regards,

--
! _\|/_ Sylvain /
! (o o) Memberavid-Suzuki-Fdn/EFF/Red+Cross/SPCA/Planetary-Society-
oO-( )-Oo "It is ... It is ... sniff ... It is green." -Data

On 10 Mar 2016, Paul wrote in
alt.windows7.general:

Reported, but not yet verified here. Usually, if
there is some badness in the wild, it gets
tallied here.

http://www.askwoody.com/tag/kb-3146449/

By "here" do you mean in your own experience? Have you personally seen
the fabled ad-in-tab?

On 3/10/16 2:02 PM, Paul wrote:
Nil wrote:
On 10 Mar 2016, "David E. Ross" wrote in
alt.windows7.general:

Slashdot contains a post that claims the Security Update for
Internet Explorer 11 for KB3139929 -- released two days ago --
also includes KB3146449, which puts an advertising banner for
Windows 10 on IE windows. The assertion is made that this is a
Trojan, a form of malware.

See "Patch Tuesday Brought Windows 10 Ad Generator" at
http://tech.slashdot.org/story/16/03/10/1524238/patch-tuesday-brought-windows-10-ad-generator.

I have installed KB3139929 on three computers. I show no listing
for KB3146449. There is no advertisement on new tabs in Internet
Explorer on any of them.

I'm skeptical about this unverified report.

Reported, but not yet verified here. Usually, if
there is some badness in the wild, it gets
tallied here.

http://www.askwoody.com/tag/kb-3146449/

While it's not listed on that page, apparently, he has written about it
he

http://www.infoworld.com/article/304...ty-update.html


--
Ken
Mac OS X 10.8.5
Firefox 44.0
Thunderbird 38.0.1
"My brain is like lightning, a quick flash
and it's gone!"

Nil wrote:
On 10 Mar 2016, Paul wrote in
alt.windows7.general:

Reported, but not yet verified here. Usually, if
there is some badness in the wild, it gets
tallied here.

http://www.askwoody.com/tag/kb-3146449/

By "here" do you mean in your own experience? Have you personally seen
the fabled ad-in-tab?

Absolutely not.

I'm on the Insider edition. It appears by me not using
the Hub application, I'm not included in A/B comparison
experiments that Microsoft carries out. So if they
try to do something outrageous, I don't get to see it.

I was commenting that AskWoody acts as a magnet for
discontent. If a large number of people were seeing it,
there'd be a "me too" response.

I'm not denying that it happened, just that if this
is being delivered, not many people are seeing it
so far. I mean, they might have had intentions to
launch this far and wide, and screwed up the
Windows Update end of things, so few are
seeing it. The delivery may have been bungled.

Paul

On 10 Mar 2016, Ken Springer wrote in
alt.windows7.general:

On 3/10/16 2:02 PM, Paul wrote:
Reported, but not yet verified here. Usually, if there is some
badness in the wild, it gets tallied here.

http://www.askwoody.com/tag/kb-3146449/

While it's not listed on that page, apparently, he has written
about it he

http://www.infoworld.com/article/304...ty-update.html

All these "reports" seem to come from the same single source, and I
haven't seen any independent corroboration. It's not unimaginable,
but until I see it proven I tend to doubt it.

Nil wrote:
On 10 Mar 2016, "David E. Ross" wrote in
alt.windows7.general:

Slashdot contains a post that claims the Security Update for
Internet Explorer 11 for KB3139929 -- released two days ago --
also includes KB3146449, which puts an advertising banner for
Windows 10 on IE windows. The assertion is made that this is a
Trojan, a form of malware.

See "Patch Tuesday Brought Windows 10 Ad Generator" at
http://tech.slashdot.org/story/16/03/10/1524238/patch-tuesday-brought-windows-10-ad-generator.

I have installed KB3139929 on three computers. I show no listing
for KB3146449. There is no advertisement on new tabs in Internet
Explorer on any of them.

I'm skeptical about this unverified report.

49 is Included in 29. 49 will not appear in View Update History nor
will it be a stand-alone uninstallable item. If you don't want it,
remove the IE update and deal with the security risk. No other choice at
this time or expected in the future.

On the other hand, MSFT has been receiving quite a bit of heat on 49

--
....winston
msft mvp windows experience

Maurice Helwig wrote:
On 11/03/2016 5:07 AM, David E. Ross wrote:
Slashdot contains a post that claims the Security Update for Internet
Explorer 11 for KB3139929 -- released two days ago -- also includes
KB3146449, which puts an advertising banner for Windows 10 on IE
windows. The assertion is made that this is a Trojan, a form of malware.

See "Patch Tuesday Brought Windows 10 Ad Generator" at
http://tech.slashdot.org/story/16/03/10/1524238/patch-tuesday-brought-windows-10-ad-generator.



KB3146449 has not appeared here for download yet but its description is

"About this update
This update adds functionality to Internet Explorer 11 on some computers
that lets users learn about Windows 10 or start an upgrade to Windows 10."

Will watch for it

It won't appear as an individual update...its bundled with 3139929.

You can watch forever, you'll never see '49' being offered.

--
....winston
msft mvp windows experience

....winston? Wrote in message:

49 is Included in 29. 49 will not appear in View Update History nor
will it be a stand-alone uninstallable item. If you don't want it,
remove the IE update and deal with the security risk. No other choice at
this time or expected in the future.

Yes, I can deal with it by not installing any more fake "security"
updates ever again. I've now lost all trust in Microsoft.

On the other hand, MSFT has been receiving quite a bit of heat on 49

Your glee is palpable.

--


----Android NewsGroup Reader----
http://usenet.sinaapp.com/

Nil wrote:
...winston? Wrote in message:

49 is Included in 29. 49 will not appear in View Update History nor
will it be a stand-alone uninstallable item. If you don't want it,
remove the IE update and deal with the security risk. No other choice at
this time or expected in the future.

Yes, I can deal with it by not installing any more fake "security"
updates ever again. I've now lost all trust in Microsoft.

On the other hand, MSFT has been receiving quite a bit of heat on 49

Your glee is palpable.


It's easy to clear up and leave the security update installed. Just
click on "view all updates" and hide the Win10 one.
It worked for me.

Ed