Merged: Windows XP SP2 - discuss it here!

OK forget XP, I'm sticking with 2000 now

And may move to Linux or Lindows.

[Paul K]

Originally Posted by welwynrose

don't know if this has already been mention but apparently in the sp2 licence agreement there is a line that states that you agree to microsoft monitoring your computer and informing homeland security of any illegal activity they might find

Really? Anyone want to look through it and see if they can find it? I don't have time to do it at the mo

I may aswell have a read.

[Richard M]

Interesting, apparently AMD64 owners are advised to stay away from SP2 altogether.
I've have zero problems even though I have DEP running for everything, apart from the mild annoyance of the Sec Centre telling me I have no software firewall every time I start up.
I'm quite happy with SP2, even if the only useful features are the DEP and the Sec Centre warning me when AVG needs to be updated - fair play that's some clever programming they've got going on there.

[SMHarman]

Originally Posted by Paul

Really? Anyone want to look through it and see if they can find it? I don't have time to do it at the mo

A search for the word homeland revealed 0 matches.

[Pea-Pod]

I've downloaded SP2 from Automatic Update and so far so good, no real physical difference, but the knowledge of having better security running in the background, is worth the download in itself.

[MadGamer]

Originally Posted by searchsecurity.techtarget.com

Microsoft decries recent reports of flaws in Windows XP Service Pack 2 as "misguided" and "not accurate" and said it wants to clear the air so users can separate fact from fiction.

The software giant responded Wednesday to the past week's wave of media attention over researchers who claimed to find flaws while testing SP2, Microsoft's much anticipated security overhaul of Windows XP. The most notable report focused on a "highly critical" drag-and-drop flaw discovered by a researcher known as "http-equiv."

The vulnerability, affecting Internet Explorer, is caused by "insufficient validation of drag-and-drop events issued from the 'Internet' zone to local resources," Copenhagen, Denmark-based security firm Secunia said in an advisory. "This can be exploited by a malicious Web site to plant an arbitrary executable file in a user's startup folder, which will get executed the next time Windows starts up." Secunia has given http-equiv's claim high billing on its daily vulnerability list and said the flaw has been confirmed on a fully patched system with Internet Explorer 6.0 and Windows XP SP1 and SP2.

Adding to the media buzz was a Microsoft list of applications that need tweaking to function properly with SP2. Because of the size and scope of SP2, experts have warned enterprises to study it on test computers and work out the compatibility issues before downloading it onto their networks. A Microsoft spokeswoman sought to calm "undue concern" over SP2 in an e-mailed statement Wednesday.

"Some articles have posted that claim there is a highly critical vulnerability that would allow a malicious user to spoof the Windows Security Center in Windows XP SP2. This claim is not accurate," she said. "To clarify, there is not a vulnerability in the Windows Security Center. In order for an attacker to spoof the Windows Security Center, he or she would have to have local administrator rights on the computer."

She added, "If an attacker were granted access to a user's system, either by being granted them or attaining them by enticing a user to open a malicious attachment, the criminal actions the attacker could pursue include many that are far more interesting than spoofing the Windows Security Center. In Windows XP SP2, we have added functionality to reduce the likelihood of unknown applications from running on the user's system including turning Windows Firewall on by default, data execution prevention and attachment manager in Outlook Express, to name a few."

Despite Microsoft's efforts to calm nerves, the reported SP2 flaw continues to get attention. Secunia updated its advisory on the drag-and-drop vulnerability Wednesday, saying that while the proof of concept showing how the flaw can be exploited depends on the user performing a drag-and-drop event, "it may potentially be rewritten to use a single click as user interaction instead."

Meanwhile, the Bethesda, Md.-based Internet Storm Center said it has been receiving reports that the vulnerability discovered by http-equiv is being actively exploited in the wild. "If you run across this on a fully patched box, please submit the offending URL and any dropped (dragged 'n' dropped in this case) malcode to the ISC," the Internet Storm Center advised.

[Paul K]

Saw that on another forum, the problem with the response given by MS is that a lot of home users run an admin account by default since it allows them to install softeware easier and make settings changes without changing accounts. That's not MS's fault but it does mean that the vulnerability is a little more open to abuse than they would like

[downquark1]

Done here - no problems

[bigitup_j]

i'm sticking with SP1 for now, until Windows bring out patches for SP2. i have a firewall - zonealarm, so i feel nice and safe!

[Paul K]

Originally Posted by bigitup_j

i'm sticking with SP1 for now, until Windows bring out patches for SP2. i have a firewall - zonealarm, so i feel nice and safe!

As long as you are up to date with all the other previous patches and updates then firewall and anti-virus is all you need to worry about if you want to wait.

[Ramrod]

Originally Posted by bigitup_j

i'm sticking with SP1 for now, until Windows bring out patches for SP2. i have a firewall - zonealarm, so i feel nice and safe!

Me too

Originally Posted by Paul

As long as you are up to date with all the other previous patches and updates then firewall and anti-virus is all you need to worry about if you want to wait.

I am.......I'm gonna wait.

[bigitup_j]

i'm fully up to date, and check the windows update website once a week. but auto-update is off...no sp2 for me!!

[mrm1]

Originally Posted by mrm1

Just installed XPSP2 RC2 and so far so good. Xp now loads quicker than it did before (or at least it seems to). Only problem I have is the windows "critical stop" sound plays at the end of boot up, but every thing seems to work properly. tempereraly stopped this by switching the sound off until I work out whats happening.

Just installed SP2 final and am still getting the same "Critical stop" sound. It happens after the desktop has loaded, but every thing seems to be running as befor. Checked the event logs but no problems shown there. Checked running services and every thing that was running befor is running now. Checked device manager, and no problems listed there either.

If i disable every thing that starts at boot time in MSCnfig, the sound still plays. I can print, browse LAN and web, write CD's and watch TV on my hauppauge card with no problem.

I have no idea what is causing it. Any idea's ?????

[Fred_Smith]

Just to let you know you can stop security centre from nagging you about this by doing the folllowing:-

Control panel --> Security Centre --> Click change the way security center alerts me (note US spelling ... ). Then unclick all the alerts.

Hope this helps