Microsoft told Windows XP users today not to press the F1 key when prompted by a Web site, as part of its reaction to an unpatched vulnerability that hackers could exploit to hijack PCs running Internet Explorer (IE).

In a security advisory issued late Monday, Microsoft confirmed the unpatched bug in VBScript that Polish researcher Maurycy Prodeus had revealed Friday, offered more information on the flaw and provided some advice on how to protect PCs until a patch shipped.

“The vulnerability exists in the way that VBScript interacts with Windows Help files when using Internet Explorer,” read the advisory. “If a malicious Web site displayed a specially crafted dialog box and a user pressed the F1 key, arbitrary code could be executed in the security context of the currently logged-on user.”

Last week, Prodeus called the bug a “logic flaw,” and said attackers could exploit it by feeding users malicious code disguised as a Windows help file — such files have a “.hlp” extension — then convincing them to press the F1 key when a pop-up appeared. He rated the vulnerability as “medium” because of the required user interaction.

Windows 2000, Windows XP and Windows Server 2003 are impacted by the bug, said Microsoft, and any supported versions of Internet Explorer (IE) on those operating systems — including IE6 on Windows XP — could be leveraged by attackers. Previously, Prodeus had said that users running IE7 and IE8 were at risk, but had not called out IE6.

Until a patch is ready, users can protect themselves by not pressing the F1 key if a Web site tells them to, said Microsoft. ”As an interim workaround, users are advised to avoid pressing F1 on dialogs presented from Web pages or other Internet content,” said David Ross with the Microsoft Security Response Center (MSRC) engineering staff in a blog entry on Monday.

“The prompt can appear repeatedly when dismissed, nagging the user to press the F1 key,” Ross added.

The security advisory made the same recommendation: “Our analysis shows that if users do not press the F1 key on their keyboard, the vulnerability cannot be exploited.” Users can also stymie attacks by disabling Windows Help. The advisory explained how to entering a one-line command at a Windows command-line prompt to lock down the Help system.

The company took Prodeus to task for taking the bug public, something it regularly does when researchers disclose a vulnerability or post sample attack code before a patch is available.

“Microsoft is concerned that this vulnerability was not responsibly disclosed, potentially putting customers at risk,” said Jerry Bryant, a senior manager with the MSRC, in an e-mail. By Prodeus’ account, he notified Microsoft of the flaw Feb. 1, about four weeks before publishing his findings.

Microsoft has not set a timeline for a fix, saying only that, “Microsoft will take the appropriate action to help protect our customers.” The next scheduled security patch date for the company is March 9.

Although it does not rate the severity of vulnerabilities in its advisories, Microsoft noted that hackers exploiting the VBScript flaw using Windows Help and Internet Explorer could grab complete control of a Windows system. Customers running Windows Vista, Windows Server 2008, Windows 7 or Windows Server 2008 R2 are safe from such attacks, Microsoft said.

A pirated version of the new Windows 7 operating system release candidate that has been circulating around the Internet is also building out a botnet. The rogue OS, which is rigged with a Trojan downloader, at one point had around 27,000 bots in its control as of May 10, when researchers took over the command and control (C&C) server that communicated with the bots and served them additional malware. At the height of the botnet buildup, the botmaster was recruiting more than 200 machines an hour, says Tripp Cox, vice president of engineering for Damballa. The victims initially downloaded the pirated OS via popular bootlegged software sites and online forums.

On Sunday Damballa researchers grabbed control of the C&C domain, but they say this is likely just one of many versions of the rogue Windows 7 OS: “In this case, we neutralized one release version of the Trojan’ed OS,” Cox says. “So if users have an older version and install it, we’ve neutralized it from downloading additional malware.”

Cox says the main goal of the Trojan tucked into the pirated OS is to add additional malware packages to the victims’ machines in a “pay-per-install” scheme, where the software piracy ring makes money from cybercrime groups who pay them to successfully install the malware. “The pirated software is the social enticement initially, and the second state is downloading additional packages of malware installed and distributed [via] the Trojan on a pay-per-install [arrangement],” Cox says.

Windows 7 has, indeed, become the newest lure: Trend Micro researchers have reported a Trojan downloader posing as a copy of the Windows 7 Release Candidate on popular torrent sites. The Trojan appears as a file called “setup.exe” when users download what they think is the Windows 7 RC. The Trojan, dubbed “TROJ DROPPER.SPX” by Trend Micro, downloads TROJ AGENT.NICE, both of which can be detected by Trend Micro’s Smart Protection Network.

Meanwhile, software piracy is on the rise, especially in the U.S., according to a report released yesterday by the Business Software Alliance and IDC. One-fifth of all PC software in the U.S. is pirated, which is the lowest rate in the world, according to the report. But the U.S. also boasts the biggest losses from piracy, at about $9.1 billion, according to the report. And most of the bots in the pirated Windows 7 OS scheme are in the U.S., according to Damballa, with about 10 percent of the bots, followed by 7 percent in both the Netherlands and Italy.

Damballa’s Cox says most traditional antivirus software is unable to detect the pirated Windows 7 Trojan because the OS itself is infected, and because most antivirus solutions don’t yet support Windows 7. “We continue to see new installs happening at a rate of about 1,600 per day with broad geographic distribution,” Cox says. “Since our takedown, any new installs of this pirated distribution of Windows 7 RC are inaccessible by the botmaster. The old installs are accessible.”

The actual Windows 7 Release Candidate can be downloaded from Microsoft here.

Ok, so by now its probably safe to say that most people have heard of Open Office as probably the best replacement for Mircrosoft Office if you are tried of having to dish out $100+ for every new version they release. The great thing about Open Office is with every release they put out, it is becoming more and more just like Mircosoft Office and is able to do basically all the same functions and even manage to do some things that Mircosoft Office can not.

The guys over at PCMAG.com have put together a list of things that most people probably wouldn’t know about when using Open Office. These features go a long way in making some things a bunch easier while others are in there for just fun. So on to the point I shall go and give you the 7 things you probably didn’t know you could do with Open Office.

1. Edit two or more parts of a document at the same time.
2. Use Open Office to open legacy documents.
3. Play a vintage Space Invaders game.
4. Turn off the blinking light bulb.
5. Save files in Office formats by default.
6. Automate actions easily.
7. Fix those single quotes.

So there it is, the list which I think has some great features on there even I didn’t know were there. You can go HERE to read up on the article for each of the 7 features to learn how to actually do what it is talking about.

I would suggest anyone who is looking for a replacement for Microsoft Office to check out Open Office because with every release they are putting out it is getting better and better and at this point I would go as far to say that it is the best program to replace Microsoft Office (and the cheapest being it is free). You can find the free download of Open Office on there website which can be found at OpenOffice.org so go check it out and enjoy!

One of the new features announced at the recent Windows 7 Reviewer’s Workshop in LA is that Windows 7 will natively support a number of popular media formats, so that users don’t have to worry about finding, installing and downloading third-party codecs. This is an evolution in media support which is similar to the inclusion of native MPEG-2 playback in Windows Vista, providing the DVD playback functionality which was missing in Windows XP.

It’s an interesting change by Microsoft, which, in the past, has doggedly clung to the hope that Windows Media Video will end up as the prevailing video format for the internet. It appears to have finally conceded that the vast majority of people are watching downloaded stuff in DivX or Xvid — possibly a realisation driven by the enormous amount of telemetry data it has collected from users of Vista that it never had access to through XP. It has stopped short of bundling Adobe Flash support into Windows, though, as it develops its own Silverlight technology.

Windows 7 will also support H.264 video and AAC audio. The support for AAC will be welcome news for people with music and video that has been encoded in Apple iTunes, as Windows 7 will be able to play all iTunes media through Windows Media Player.Unfortunately, this won’t apply to media that has been purchased from Apple’s iTunes store, because Windows 7 can’t decode the Apple FairPlay DRM, which Apple refuses to license to anyone else. 

The ability to play back these additional formats has implications for new Windows 7 services like libraries and networked media player support, as Windows 7 users can index and search across their iTunes media without needing to use iTunes as the default player, and can send a wider variety of media content to a centralized location.

A more subtle user benefit is that by not having to download third-party codec bundles (which is convenient in itself), users can minimise the inevitable build-up of unverified software running on their systems. Most major codecs are freely available, but you often need to install multiple disparate packages to get the widest possible support for digital media — or run an ‘all in one’ CODEC installer which may also come bundled with hidden malware inside. Additionally, these CODEC packages can interfere with other, and the codecs are not necessarily optimised to run efficiently.

By bundling a wide variety of media formats into Windows 7, Microsoft has created an operating environment which negates the need for third-party codecs and should therefore run more stably and reliably. It also brings blanket support for the most popular online media formats, providing an environment in which users can start playing their favourite content immediately.

So this is some good news… as it has me and a lot of others actually looking forward to Windows 7 since it hopes to bring back some of the people who disliked Vista so much!

If a notebook runs Windows Vista, it will run Windows 7 and it will get better battery life, promises Gabriel Aul of the Windows Performance team. But PC manufacturers and device suppliers are also going to have to do their part to make a big difference to power consumption on new notebooks.

What Microsoft can do is make it easier for components in the system to go into low power mode when the system is idle. Some of that is ‘managing’ components: Windows 7 ‘parks’ CPU cores that aren’t needed, finally implements the ‘slumber’ feature on SATA drives, powers down USB ports and controllers more aggressively and even puts your Wi-Fi card to sleep if it’s turned on but not connected to a network.

Reducing the power draw

Microsoft has also changed its thinking about the system timer; in Vista this is set to 1ms, in Windows 7 it will be 15ms, which reduces the power draw by 15 per cent. General performance improvements like reducing the amount of disk activity involved in reading from the registry and starting services on demand rather than running them in the background will also improve battery life.

That applies to all software: a Vista system running ten services that come with installed applications uses 6 per cent of the CPU even when the PC is idle, compared to 1 per cent for a clean Vista installation. An extra 5 per cent of CPU utilization translates into around 4 per cent less battery life, so Microsoft is encouraging software developers to use on-demand services.

Windows 7 notebooks won’t wake up from sleep for applications that use ‘wake timers’ (except for the timer that wakes the system when the battery is so low the PC needs to hibernate). Open files from a network and CPU utilization won’t stop the screen turning off, the hard drive spinning down and the system going to sleep when you haven’t used the PC in a while; Windows 7 will only check for user input and applications like Media Center recording a long TV show. The screen will also dim to save power before turning off.

With the new version of Windows (Windows 7) set to release sometime next year, there are videos and pictures starting to popup more frequently showing off different things the new OS will be able to do for us. Well I came across this video today and it kinda caught my eye as pretty cool and something that is gonna be pretty new as working with Windows, Linux and OSX I haven’t seen any of them do this quite like this yet. But without this chatting going on too long, I will just let you see the video as they show off the new Windows 7 taskbar, so enjoy!