The Windows Start menu super guide — Part I

A definitive guide to the mysteries of Windows 7

No doubt about it, Windows 7 is the most advanced Windows Microsoft has ever built. But for new Win7 users, discovering the operating system’s many new capabilities is a challenge. David Pogue’s opus, Windows 7: The Missing Manual, describes every aspect of Windows 7, from basics such as the Start Menu to advanced applications such as setting up Win7 on a network. This month, O’Reilly Media is providing all Windows Secrets subscribers an excerpt from the book: Chapter 3, Searching & Organizing Your Files. It covers how to use Windows Search, moving and copying files, and burning CDs and DVDs from the Win7 desktop. If you’d like to download this free excerpt, simply visit your preferences page and save any changes; a download link will appear. All subscribers: Set your preferences and download your bonus Info on the printed book: United States

Windows Secrets' top tips for Windows XP

Since 2004, the Windows Secrets Newsletter has given its subscribers thousands of tips for getting the most out of the Windows operating system. Windows XP Survival Guide: Keep your XP system running for the long haul is made up of our best stories on maintaining and troubleshooting Microsoft’s most successful operating system to date. The major chapters of the Windows XP Survival Guide e-book include: Maintaining Windows XP Troubleshooting XP Win7 and XP: Living in both worlds All subscribers: Purchase The Windows XP Survival Guide for only $9.95 through your Windows Secrets shopping cart (an E-junkie online-commerce site).

The Windows Start menu super guide — Part I

By Woody Leonhard

Since the debut of Windows 95, the Start menu has offered an easily navigated and extensible haven for all the programs we don’t use every day.

In Part 1 of a series of stories on getting the most out of Windows’ Start menu, we start with the basics: pinning applications, folders, and files.

Future installments will cover just about everything you need to know about the Start menu — how to use it, change it, gussy it up, and dress it down. The Start menu is something we use dozens of times a day. Take a few minutes and make it look the way you want it to!

Although Win7’s Start menu has a slightly different look from Windows XP’s classic design, in many ways they work the same. And though the techniques covered in this series focus on Win7’s version, you’ll find that many of these tips apply to XP’s Start menu as well.

Classic version or new, the Windows Start menu has three major sections (shown in Figure 1), each giving different approaches to navigating Windows.

• Left column: This section holds items (programs, folders, and files) that you use frequently. Those above the faint line are items pinned there by the user; those below the line are recently invoked programs — at least those programs started via the Start menu — and automatically added by Windows.
• Right column: This list provides shortcuts to many of Windows 7’s predefined folders and libraries plus quick access to key features such as the Devices and Printers panel and the Control Panel. Most Windows users probably think it’s a fixed list, but it’s not — you can customize it.
• Bottom: In addition to the Shut down button found in Windows XP, the bottom of Win7’s Start menu now has the always-useful Search programs and files box.

Figure 1. The Windows 7 Start menu is made up of three sections to make finding applications, folders, files, and system tools easier.

Let’s start by taking a look at how you can change the left-hand list of programs, folders, and files. If you want to make the changes apply to different user accounts on a PC, you have to be logged in with administrator rights.

Making simple changes to the Start menu

First, a note about terminology. All versions of Windows between Win95 and WinXP had a button in the lower-left corner of the desktop emblazoned with “Start.” In Vista and Win7, Microsoft replaced the classic square Start button with a frilly (and unlabeled) round button, which practically everyone except Microsoft refers to as the “orb.” (Surprisingly, you can even change the orb.) To minimize confusion, I’ll tell you to click Start — which on Win7, of course, means to click the orb. Fair enough?

Changing much of the Start menu is a cinch. Here’s a review of how to make several of the most common Start menu changes:

• To change the picture of the current user (the picture in the upper-right corner of the Start menu — a daisy by default), simply click it. Windows takes you through the necessary steps.
• To remove a program from the pinned list in the upper-left corner or the most recently used list below, right-click the entry you don’t want and choose Remove from This List.
• To add a program to the pinned programs list, navigate to the program (by clicking, say, Start/All Programs), right-click the program and choose Pin to Start Menu.
• If you bought a new computer with Windows 7 preinstalled, the computer maker might have sold one of the spots (or maybe two or three spots) on the Start menu to another product vendor. You can always delete those pesky Start menu advertisements by right-clicking them and choosing Remove from this list.

Amazingly, that covers about 80 percent of the questions I get about the Start menu.

Pinning to the Start menu — the rest of the story

There’s much more to the pinned list than first meets the eye.

The All Programs menu is the easiest place to find and pin applications, but you can also use Windows Explorer or the Start menu’s Search box. Once you’ve found the program file, simply right-click it and choose Pin to Start Menu.

If you want to pin a program currently on your Taskbar onto the Start menu, the simple right-click trick doesn’t work. When you right-click a Taskbar icon, you get the jump list — and there is no option to Pin to Start Menu. But there’s a trick. All the items on your Taskbar are stored as shortcuts in the folder

c:usersyour nameAppDataRoamingMicrosoftInternet ExplorerQuick LaunchUser PinnedTaskBar.

Navigate to that folder in Windows Explorer, right-click on the item you want to put on your Start menu, and choose Pin to Start Menu. Voilà !

If you pin a program on the Start menu by right-clicking on it and choosing Pin to Start Menu, Windows creates a separate, pinned copy in the Start menu. Your original — the program you right-clicked — stays where it was. If you right-click a program listed in the recently used section of the Start menu and move it to the pinned section, again: the original program doesn’t move, but Windows does take the entry off the recently used list.

You can put pinned programs into any order you like. When the program, file, or folder gets pinned, it appears at the bottom of the pinned pile. To change the order, just click-and-drag the program to any other spot in the pinned list.

Even better, you can give your pinned programs names that you prefer. Right-click the program and choose Properties. On the General tab, change the name in the top box to whatever you want to show on the Start menu.

Pinning folders and files to the Start menu

Many online help sites tell you that you need to edit the Registry or create a complex shortcut to pin folders to the Start menu. In Windows 7, you don’t need to do any of that. Just click and drag the folder to the pinned list as I explain here, and you’re done. The same trick works for files, too. While the technique I mention here isn’t exactly undocumented, it’s certainly not well known.

To pin a folder or file — or just about anything else — to the Start Menu, navigate to the folder or file and left-click it. Now drag it down to the Start orb. Hover for a moment or two, and the Start menu opens. Keep dragging the file or folder up to the pinned list. Settle on the location you’d like, and drop the file or folder. (There is, unfortunately, not a simple way to pin a folder to the taskbar.)

If you pin an Office template file to the Start Menu — a Word .dotx or Excel .xlt file, for example — every time you select the template in the Start Menu, Windows will start the application (Word, Excel, PowerPoint, whatever) with a new document based on that template. That’s the fastest way I know to work with form letters.

The drag-and-drop trick also works on programs that don’t show Pin to Start Menu when you right-click on them. It’s really that easy.

In Part 2 of this series, I’ll show you how to take control of your most recently used programs list and change the All Programs menu. In Part 3, I’ll look at changing the items on the right side of the Start Menu.

Have a favorite Start menu trick? Post it! Drop by the Lounge and show us your stuff.

Ribbon creep or Ribbon triumph: Which is it?

By Kathleen Atkins From its introduction in 2007, the Office Ribbon has had its vigorous detractors, tepid supporters, and rare champions. But with each iteration of Office and Windows, the Ribbon survives and spreads.

This week in the General Productivity forum, Loungers set up a poll and quizzed one another about their attitudes and experience with the Ribbon. The ensuing discussion emits more wisdom than heat, which is a fine way for a discussion to go. More»

The following links are this week’s most interesting Lounge threads, including several new questions to which you might be able to provide responses:

☼ starred posts — particularly useful

If you’re not already a Lounge member, use the quick registration form to sign up for free. The ability to post comments and take advantage of other Lounge features is available only to registered members.

If you’re already registered, you can jump right into today’s discussions in the Lounge.

The Lounge Life column is a digest of the best of the WS Lounge discussion board. Kathleen Atkins is associate editor of Windows Secrets.

All that jazz in NOLA — in case you missed it

	By Kathleen Atkins If you forgot to festoon yourself in feathers and beads, failed to put on your mask and pick up your bassoon, and (furthermore) forbore to shimmy on down to the riverside, the folks in this video did it all for you — at Mardi Gras this week, down in New Orleans. Dance a little!   Play the video

When Win7's internal diagnostic utilities fail

By Fred Langa Windows 7’s Reliability Analysis Component (RAC) and related software usually work silently in the background, unnoticed by Win7 users — until something goes wrong with these diagnostic apps. Here’s how to repair or disable the RAC system, should it fail — and how to access its reliability-analysis records when it’s working as designed.

What’s RACTask, and what’s it doing in my PC?

Reader Steve Lutz ran across a part of Windows 7 most users have never heard of.

• “While troubleshooting a Win7 PC with shutdown problems, I found out about a little-known program, RacTask, which runs in the background and can cause systems to slow down or freeze for several minutes.

  “Apparently, it compiles ‘reliability analysis’ information, which can be viewed via the Win7 Action Center. I would like to know whether routinely deleting the data from this app would avoid the slowdowns and hangs.”

Win7’s Reliability Analysis Component automatically collects data on any failures that occur within Windows, applications, or other system areas.

RAC is run by RACAgent, which in turn is triggered by RACTask in Task Scheduler. It normally runs once at power-on and then once every hour thereafter.

RAC and its associated components rarely fail. In fact, the whole RAC system is normally so unobtrusive, most users don’t even know it’s there. But when it does cause trouble, you can reset RAC — or even disable it.

But before I explain how to do that, let’s take a quick look at what RAC is supposed to do.

To access your system’s reliability analysis, click the Win7 Start orb, type Action Center in the search box, and press Enter. Click the Maintenance heading (under the “Review recent messages and resolve problems” heading at the top of the the Action Center dialog window), and then click View reliability history (highlighted in yellow in Figure 1.)

Figure 1. Here’s where to access data collected by Win7’s Reliability Analysis Component.

After a moment, the Reliability Monitor will open and display a graph along with information. The graph may not show much on a smooth-running system, or it may display any number of problems. Figure 2 shows an example of a system that’s experienced several issues.

Figure 2. This system’s Reliability Monitor shows a pattern of recurring crashes in Internet Explorer. Clicking on an event’s symbol brings up additional information.

Clicking on any of the trouble symbols — the red-circle Xs, the yellow triangles, etc. — in the Reliability Monitor window displays an explanation of the event in the Reliability details section, below the graph.

RAC’s Reliability Monitor can reveal informative failure patterns — which programs are failing, how often, in what sequence, and more. This can be especially useful in troubleshooting failures that happened when you weren’t there — or in diagnosing failures on someone else’s PC and you’re coming in cold with no idea of the machine’s history.

On the other hand, RAC may not do you much good if you already know that a certain application is crashing often. In that case, you can disable RAC without any unwanted consequences. Microsoft’s TechNet article, “Understand and manage the RACAgent scheduled task,” tells you how.

If you want to retain RAC but suspect it’s causing its own problems, resetting its database usually clears them up. It’s easy to do, as explained in this item in the Microsoft Answers forum. (That item also tells you how to enable RAC, if it’s currently disabled on your system.)

With those simple changes, RAC should go back to being unobtrusive once more!

System Restore not running automatically

Erik Olesen asks:

• “In your [Feb. 9] article, ‘What, exactly, does System Restore protect?,’ you say, ‘System Restore runs at least once every 24 hours, or when you start your PC after it’s been off for more than 24 hours.’

  “But not on my Win7. It runs only when one of the other triggers occurs.

  “How can I get it to run automatically?”

The at startup and once every 24 hours runs of System Restore are triggered by Task Manager. If Task Manager is disabled, or if you’ve removed or disabled the System Restore task, you’d get the symptoms you describe.

You can access and adjust Task Manager and its scheduled tasks using the methods described in Microsoft’s Help & How-to page, “Troubleshoot Task Manager problems.”

There’s also a less likely — but still possible — alternate explanation. System Restore’s automated restore points are created only during idle time. If constant background activity is preventing your system from idling, System Restore may never auto-start.

Sources of constant activity can include things such as backups or antivirus scans; background work associated with distributed processing networks such as Folding@home (site), SETI@home (site), and the like; long downloads and file-sharing torrents; and so on.

In these cases, disable or suspend the background activity and System Restore should then run normally.

.Net error prevents MS Office upgrade

Ed Nottingham ran into a frustrating problem.

• “I purchased an MS Office upgrade to move from Version 2007 to Version 2010 Professional. When I attempted to install it, I received the message:

  Error 1935. An error occurred during the installation of the assembly component {844EFBA7-9382-A01F-C8B389A1E18E}. HRESULT: 0x80070003.

  “I ran sfc/scannow and applied the recommended .Net repair, and I tried other solutions.

  “Most recently, I attempted to install a Raxco PerfectDisk 12.5 upgrade (from Version 12) and received the same error message.

  “I even tried the Fred-recommended, nondestructive reinstall of Windows 7 [July 14, 2011 Top Story], and after an hour or so this install also failed.

  “I’ve installed and run other programs without any problems.”

Error 1935 indicates a .Net problem; but clearly, it’s one your initial repairs weren’t able to fix.

Don’t feel too badly. The whole .Net ecosystem has been a mess from day one. Although .Net components usually install OK on clean systems, once the updates begin, all bets are off. As my colleague, Susan Bradley, states, “When it comes to patching, .NET is .ANNOYING.” See, for example, her Oct. 28, 2010, column or her June 30, 2011, column or — oh, heck! .Net problems come up again and again in her writing. No doubt about it, .Net is a pain.

But with a skosh of luck, your Error 1935 problem may be easy to fix by downloading and installing a fresh copy of the current .Net components. Microsoft offers a Web-based .Net installer on a Download Center page or a classic, standalone installer on another Download Center page. Either one should get you a current, fresh setup.

If the problem persists, your best bet might be to try uninstalling .Net and starting over. That can be tricky because the different versions of .Net are not separate installations (as they appear in Control Panel) but interdependent, connected layers of code.

The MSDN article, “Uninstalling .NET Framework 3.5 SP1,” explains some of the hassles — and workarounds — you may run into when uninstalling .Net. (It’s specific to version 3.5, but the general information is valid for all current .Net versions.)

MS employee Aaron Stebner has also written helpful articles on this subject, such as “How to uninstall the components of the .NET Framework 3.5 SP1” (MSDN blog entry) and the extremely comprehensive article, “Unified .NET Framework Troubleshooting Guide.” Stebner also has posted a follow-on article, “What to do if other .NET Framework setup troubleshooting steps do not help.”

I suggest you first make a complete backup — preferably a system image (see the May 12, 2011, Top Story, “Build a complete Windows 7 safety net” ) — and then work through the steps discussed above to get .Net off your system.

If you’re using automatic updating in Windows Updates, you might want to temporarily disable it (MS how-to info) so your system won’t try to put things back while you’re removing them.

After each removal step, use a reliable Registry Cleaner (e.g., CCleaner; site) to ensure that your Registry is cleansed of references to the .Net components you’re removing.

I also suggest you uninstall the apps that brought this problem to light. In your e-mail, you mentioned Office and PerfectDisk, but you should remove any others that experienced trouble as well.

Once your system is as clean of .Net and the failed software as you can get it, reboot, run the Registry cleaner again, reboot again, and then try reinstalling .Net via one of the two download links listed above.

Once .Net is installed and up to date, reboot, run the Registry cleaner one last time, and do a final reboot. Your system should now be free of .Net problems.

Next, try installing the software that previously caused trouble. Add them back onto your system one at a time (i.e., don’t run multiple, simultaneous installs.)

Last, make a habit of always checking Susan Bradley’s columns for ongoing coverage of .Net woes. She’ll scout out new updates for you, let you know when they’re safe to install, and offer suggestions and workarounds for some of the most common trouble that can — and too often does — crop up with this problematic software.

Aggressive repair scams still out there

Martha Burke received an odd phone solicitation.

• “I had a call tonight from a man claiming to be with “Window System.” He said I have an error in my computer that could be dangerous. He asked me to go to my computer while I was talking with him so he could fix it.

  “I’m worried this could be fraud or a scam. What do you think? He said his company got an alert that my computer was having problems.”

Unless you’ve signed up for some kind of remote monitoring and repair service — and you’d know, because you would have had to authorize it and pay for it — then this is almost surely a scam.

Unsolicited, out-of-the-blue, inbound offers to take over and repair your PC — whether via Web popup ad or phone call — can be extremely dangerous. Just say no!

For more information, see the April 7, 2011, Top Story, “Liza Moon infection: a blow-by-blow account.”

Smart configuration tricks for Win7 Explorer

By Lincoln Spector You can’t do much on a computer without a file manager, and Win7’s Windows Explorer is one of the best. But with a few tweaks and adjustments, you can make Explorer fit your particular computing style.

There’s little to complain about with Windows Explorer — that small, essential program you use a hundred times a day to find, open, copy, move, and delete files. It’s simple and direct, allows you multiple ways to view and sort your files, and even shows you their content (if they’re in a format of which Microsoft approves).

With Windows 7’s Explorer, the search field is always at hand and the indexed searches are remarkably fast. The navigation pane on the left gives you quick access to all your folders and drives, as well as your local network. You can even launch the DOS command-line environment within the folder of your choice.

But there are areas where Explorer could be better. Here are seven configuration tricks that can improve the world’s most popular file manager.

Stop keeping records of your searches

You’re probably familiar with Windows Explorer’s search capabilities. Just type windows secrets, for example, into the Search field in the upper-right corner of the Explorer window, and up come all files with that text string. (I have a lot of them on my computer.)

For your convenience, Windows Explorer saves these searches. Start typing a new search, and recent searches pop up to save you from the hassle of more typing.

But what if you don’t want to preserve records of your searches (on a shared PC, for example)? On the Professional or Ultimate versions of Windows 7 (but not the Home versions), you can turn this feature off to protect your privacy.

To do so, click the Start orb, type gpedit.msc, and press the Enter key. That brings up the Local Group Policy Editor. Navigating the left pane of the Editor as if it were Windows Explorer, go to User Configuration/Administrative Templates/Windows Components/Windows Explorer. Once there, click the Settings column head to alphabetize the list of settings, shown in Figure 1. (This makes the next step much easier.)

Figure 1. You can turn off saved searches in the Local Group Policy Editor.

Find and double-click Turn off display of recent search entries in the Windows Explorer search box, and select Enabled.

Figure 2. To disable saved searches, select the Enabled option.

How to choose and fix your folder formatting

You probably already know that Windows Explorer offers eight file-viewing formats (Large icons, List, Details, and so on). To change these, click the More options dropdown list in the Explorer toolbar or right-click a blank spot in the main, right pane (the one with folders and files in it). Select View, then pick your choice.

But when you go to another folder, you have to do this all over again. You might prefer Details, but Windows is absolutely convinced that you’re partial to Large icons.

So now you have to tell it that your last selection is also the new default: select Organize in Explorer’s toolbar, then Folder and search options. (Windows XP users will now recognize this familiar dialog box.) Click the View tab and then click Apply to Folders.

That seems to set the look of your folders — until you go to another folder and still get Large icons.

Here’s what’s happening. That Apply to Folders button applies only to one particular kind of folder. Windows 7 recognizes five different folder types (General Items, Documents, Pictures, Music, and Videos) and guesses what kind of folder you’re working with based on the contents. Windows doesn’t always guess right.

So if a folder still isn’t displaying the way you want it to, correct Windows’ assumption. With the folder open, select Organize, then Properties. (You can also right-click the folder and select Properties.) Click the Customize tab and, near the top of the dialog box, select the appropriate kind of folder from the drop-down box under Optimize this folder for:, as shown in Figure 3.

Figure 3. Set the folder type from the folder’s Properties/Customize/Optimize this folder for: option.

You might want to check the Also apply this template to all subfolders check box immediately below the drop-down list. It will make whatever folder type you set the default for new folders inside that one. In fact, you might simply want to make this change to My Documents.

Open Windows Explorer where you want it

When you first click the taskbar’s Windows Explorer icon, the program opens by default in Libraries. That’s great for many Win7 users, but it may not be your preferred default location. (For example, I’ve set mine to open up in my DropBox folder.)

Here’s how to change that setting. Right-click Explorer’s taskbar icon, right-click the Windows Explorer option (near the bottom of the jump list), then select Properties.

In the Properties box’s Shortcut tab, look for the Target setting. It contains %windir%explorer.exe as its text. You’ll need to keep that string of characters, but you want to add a path after it.

That path must point to a particular location on your hard drive. Here’s one way to get the right path: Launch Windows Explorer and navigate to the desired location. Right-click the Address Bar at the top of the window and select Copy address as text. Return to Explorer’s Properties/Shortcut box and its Target field. Insert a space after .exe and paste the text into the Target field (see Figure 4).

Figure 4. You can set the location Explorer defaults to by pasting the location into its Properties/Shortcut settings dialog box.

Keeping folders at hand on the taskbar

Now that you’ve chosen and set your Windows Explorer default location, you may want to make other locations easy to get to as well.

Right-click the Windows Explorer taskbar icon again. You’ll notice that, under the Frequent heading, the resulting jump list contains a list of folders you’ve visited recently. (As you open other folders, those in the jump list might eventually drop off.)

Above the Frequent list, there might a Pinned category. (And if there isn’t, you’re about to create one.) The folders in this list won’t disappear unless you manually remove them.

To move a folder from the Frequent list to Pinned, either drag and drop the folder or right-click it and select Pin to this list. You can arrange the order of the items in the Pinned list by dragging their icons up and down.

Navigate easily to a favorite folder in Explorer

In addition to pinning a folder to a permanent Pinned list, you can also place a frequently visited folder into an easily found location within Windows Explorer.

Windows Explorer’s left pane is called the Navigation Pane because you can use it to move easily among folders, drives, and networks. The top section of that pane is titled Favorites, and that’s where you can put shortcuts to your favorite folders. (Favorites has been around for years, but with all of Win7’s new navigation options, we might easily forget to use it.)

To add a folder to Favorites, just drag it there. It doesn’t move the actual folder; it just creates a shortcut. To remove a folder from Favorites, right-click that shortcut and select Remove from the drop-down menu. (The shortcut will be gone, but the real folder is left untouched.)

You can also add folders to the next section down — Libraries. See Fred Langa’s March 25, 2010, article, “Tips on working within Windows 7’s Libraries,” for details.

Selecting multiple files — one-handed!

Of course you know how to select multiple, noncontiguous files — you hold down the keyboard’s Ctrl key with one hand while you click files with the other.

Windows 7’s version of Explorer offers a better way: every file has its own little check box, and you need only use your mousing hand to check those boxes.

At least, that’s how it would work if you could see the little check boxes for each file. Here’s how to make them appear. In an Explorer window, click Organize, Folder and search options, and then the View tab. In the Advanced settings box, scroll down until you find Use check boxes to select items. Check the selection box to enable this option. Back in Windows Explorer, the check boxes appear only as you mouse over folder or file names.

See and edit your file extensions (carefully)

This is old advice, but it bears repeating. Every file in Windows has a name and an extension, separated by a period. The name tells you what’s in the file; the extension tells Windows what kind of file it is and what program to load it into.

But Windows 7 hides the extensions of most files to avoid novice errors. Accidentally changing an extension can render a file unreadable until someone thinks to change it back. But hiding extensions also makes it impossible to see, at a glance, whether you’re dealing with a .doc, .docx, or .rtf.

To make file types visible in Windows Explorer, select Organize/Folder and search options/View. In the Advanced settings box, uncheck Hide extensions for known file types.

But be careful how you rename files. Don’t edit anything to the right of the period without good reason.

Everything you do on a computer involves files. Once you’ve enacted these improvements to Windows Explorer, you’ll be well equipped to maintain full control of all your files and folders.

PC security Golden Rule: patch early, patch often

By Robert Vamosi We’ve gotten good at updating our Windows and Office software — so good that criminals are looking elsewhere. A new report suggests that patching your non-Microsoft applications might be just as important to a secure computing environment as keeping Windows and Office up to date — if not more.

Most vulnerabilities are in third-party products

As malware continues to evolve, keeping an eye on application updates is just as critical as maintaining security software. For years, that meant keeping your eye mostly on Microsoft. But with the regular monthly Patch Tuesday Windows security updates and Windows 7’s underlying security improvements, Windows and Office are no longer the attractive targets for cyber criminals they once were.

According to security vendor Secunia (site), the primary threats to PCs have shifted to third-party applications distributed by software developers large and small. In its 2011 annual report (free registration required) on the changes in computing security, Secunia found that from 2006 through 2011, its end-point vulnerabilities count tripled, to over 800. (Secunia defines end points as “the access points to all business-critical data, and are therefore lucrative targets for cybercriminals.”)

The report states that “A majority of these (79 percent), were found in third-party (non-Microsoft) programs.” It concludes that securing only “the operating system and Microsoft programs leaves end-points at considerable risk.”

The authors of the report looked at vulnerabilities that had either received a Common Vulnerabilities and Exposure (more info) designation from the MITRE Corporation or been noted by Secunia as valid vulnerabilities. The report does not weigh in on the time software vendors took to patch these vulnerabilities. But it does state that “programs with low market share are also at risk” for vulnerabilities. (The “low-hanging fruit” theory for malware implies that cyber criminals go after the most popular applications because that will give the best returns.) So if you’re not updating all the software on your PC, then your risk for getting malware might be getting worse, not better.

Vulnerabilities don’t necessarily become malware

It must be noted that not all software vulnerabilities lead to exploits that become malware. First, there’s the problem of actually exploiting the vulnerability. In some cases, taking advantage of a vulnerability can occur only under rare circumstances. In other cases, an exploit requires user interaction. Some exploits don’t make it to full malware status because there’s no practical way to propagate them.

That said, it’s still important to track vulnerabilities. The increase in vulnerabilities could be evidence that some vendors are still wrestling with security issues within their software-development life cycles. Vendors with extremely modest — or even declining — numbers of vulnerabilities are probably well versed in security best practices. Unfortunately, most end users don’t know this insider information; they’re simply left confused and exposed if the software they use isn’t patched in a timely fashion.

Some positive software-vulnerability trends

Secunia’s report showed vulnerability trends for the top 20 software vendors, most of which are household names.

In the five years from 2006 to 2010, Microsoft, for example, showed a 17 percent increase in reported vulnerabilities. In 2011, however, it showed an impressive decrease of 20 percent. By comparison, Apple showed a five-year increase of 12 percent and a 17 percent decrease in 2011. HP wins the Most Improved honors with a five-year, five percent increase and a commendable 34 percent decrease last year.

Microsoft, Apple, and HP all have dedicated security teams that issue patches frequently. These companies have worked internally to make their respective software programs more secure and robust, eliminating common vulnerabilities such as buffer-overflow and remote-access errors. That doesn’t mean they are perfect — it just means that their vulnerability counts are currently headed in the right direction.

Rapid updates lead to modest software successes

Mozilla, which makes the popular Firefox browser, showed a five-year increase of 26 percent and just a two percent increase over last year. Mozilla recently moved toward a rapid development life cycle, issuing five or six new versions of the browser in 2011 alone, as reported in my July 28, 2011, column. This may have kept the number of vulnerabilities from increasing last year.

Adobe, on the other hand, showed a 106 percent increase between 2006 and 2010 and a 16 percent decrease through 2011. Vulnerabilities in its Flash and Reader applications have been widely reported. Fortunately, the company has recently (particularly within the last year) taken steps to improve the security of its software. It’s also retroactively improving security through regular patching cycles — currently every three months, but also when necessary.

Troubling vulnerability trends among big players

Google showed an astounding 800 percent increase over the five-year period, along with a 116 percent increase in 2011. This in no way suggests that Google lacks a competent internal security team or produces consistently vulnerable applications. It more likely indicates that the rapid growth of the company, along with the launch of its Android OS, has increased its potential points of attack. (And, as with any new operating system, Android undoubtedly has some security bugs that need to be worked out.)

The worst record in Secunia’s report belongs to Xerox, which had a 330 percent five-year increase and a phenomenal 2,050 percent jump in 2011. One explanation might be the increased revelations of printer vulnerabilities within the past year. Printer software has been neglected for years, but with more printers connecting to the Internet, these peripherals are becoming attractive ways for criminals to access personal and corporate networks remotely.

Use update monitors designed for home users

The good news, according to Secunia, is that 72 percent of vulnerabilities had patches available on the day of the disclosure. The problem is, there’s no uniform policy in pushing out these updates to end users. And a Windows taskbar popup announcing the availability of an update might not be immediately acted on by an end user.

There are services that check whether your PC has the latest reported software versions from various vendors. Secunia, for example, provides an onscreen report and includes links to application-update sites. We’ve recommended its Personal Software Inspector in our most recent Windows Secrets PC Security Baseline and in other security articles. PSI is free for personal use.

Another option is CNET TechTracker (site), which is free but includes advertising from CBS Interactive partners.

Or you can stay old-school and simply be more vigilant for software updates for your printer, browser, and numerous other applications. To paraphrase what they say in Chicago around election time: Patch early, patch often.