Important security update - Quicken 2008 for Windows

Intuit is notifying customers that we have created a solution for a potential security vulnerability in some of our Windows-based tax, consumer and small business software. We know of no cases where someone has taken advantage of this vulnerability. However, if exploited, it could allow a hacker to access the data on your computer. Downloading the update below will eliminate this vulnerability, so it's important for every customer to install.

The vulnerability involves code that is part of the Help function in Quicken 2008 for Windows. 

If you have ever installed Quicken 2008 for Windows on your computer you should download and install Intuit's patch, which will immediately eliminate the vulnerability. (For a French version of the patch, click here.)

The patch is approximately 1MB and should download in about 20 seconds on broadband connections.

Technical Support Contact Information

If you encounter any problems installing the patch:

• U.S. customers: Refer to Support options for Quicken.
• Canadian customers: Please call 1-877-844-1515.

What if I've uninstalled one of these products and no longer use it? Do I still need the patch?

As a precaution, we recommend that customers who have installed any of the above products download the patch, which fixes a program called AnswerWorks, a third- party software package used by Intuit and other software companies. This action will eliminate the vulnerability in the event that other software on your computer is also using the affected versions of AnswerWorks.

If you have uninstalled Intuit's products and prefer instead to verify that the affected versions of AnswerWorks are not on your computer, please follow the steps below. If the affected versions are not on your computer, no patch is necessary.

To determine if AnswerWorks Version 4.0 or Version 5.0 is installed:

1. Right-Click on your "Start" menu and select "Explore."
2. Open the following folders in order: Local Disk (C:) > Program Files > Common Files. (Note: You may receive a message when you open your Program Files folder that "These Files are Hidden." Go ahead and click on the "Show the Contents of This Folder" link.)
3. If you find a folder called "AnswerWorks 4.0" or "AnswerWorks 5.0" in your Common Files directory, Intuit strongly recommends that you apply the patch.

How do I download and install the patch?

All affected users of Intuit products should download the security patch here.

When the page appears:

1. Click the "Download" button to start the download, or choose a different language from the drop-down list and click "Go."
2. Select "Open" or "Run This Program From its Current Location" to begin installing the patch immediately. Restarting your computer is not required.
3. If you don't have time to install the patch, or don't want to restart your computer, you can select "Save" or "Save This Program to Disk" and the patch file, called What.exe, will download to your hard drive. To finish the installation, you'll need to open that file to run the patch.

How do I check that the security patch has been applied?

To make sure the patch as been applied and that either AnswerWorks 4.0 or AnswerWorks 5.0 are installed on your system, do the following:

If the security patch has been applied, the AnswerWorks 4.0 control will be at file version 4.0.0.101 or 4.0.0.102. You can check the version number by following these steps:

1. Right-click on your "Start" menu and select "Explore."
2. Open the following folders in order: Local Disk (C:) > Program Files > Common Files. (Note: You may receive a message when you open the Program Files folder that "These files are hidden." Go ahead and click on the "Show the Contents of This Folder" link.)
3. If you find a folder called "AnswerWorks 4.0," open it.
4. Right-click on the AWAPI4.dll (or AWAPI4) file and select "Properties."
5. Click the "Version" tab. If the file version is 4.0.0.101 or 4.0.0.102 the patch was installed successfully.

If the security patch has been applied, the AnswerWorks 5.0 control will be at file version 5.0.0.7 or higher. You can check the version number by following these steps:

1. Use Windows Explorer to navigate to the directory - c:\Program Files\Common Files\AnswerWorks 5.0.
2. Right-click on the AWAPI5.dll file and select "Properties."
3. Click the "Version" tab.
4. Check that the File version is 5.0.0.7. If it is, this patch was installed correctly.

What operating systems are supported?

The security patch is available for all operating systems used by affected Intuit applications: Windows XP, Windows Vista, and Windows 2000. If you are running Windows 98 or Windows ME, you need to have Internet Explorer 6.0 or later installed before you can install the update. Go to the Internet Explorer 6 Downloads Web page to install a more recent version of IE.

Note:  Intuit products for Apple MacOS X are not affected.

What if I have multiple Intuit products? Do I need to download and install the patch for each one?

No, the security vulnerability is in a shared software component that is used by several Intuit products, as well as other software packages which may be installed on your computer. By downloading and installing the security patch once, you eliminate the vulnerability for all products, Intuit as well as others.

I only use the Internet on a periodic basis. Do I still need to download the security patch?

Yes. If you installed any of the affected products on your computer, the vulnerability poses a security risk regardless of whether you are currently connected to the Internet. We recommend that all affected users download and install the security patch.

How do I know if I have been hacked?

As we developed a solution to this vulnerability, and as part of our standard security practices, Intuit has been working with security firms to monitor Internet threats and hacker activities. We've found no cases where this vulnerability has been exploited.