Windows may install updates without asking

Antispam e-book is our free bonus to you

To celebrate the Windows Secrets Newsletter’s 200th issue — which was published on June 4 — we’re giving away this month a revised 3rd edition of Spam-Proof Your E-Mail Address. My 32-page PDF e-book, suitable for printing and storing in a three-ring binder, explains tricks anyone can use to reduce 97% of the spam that an e-mail address would otherwise attract. The e-book sells for $9.95, but all subscribers can download it completely free, now through July 1, as part of our festivities. To get yours, simply use the link below, update your preferences page with current information, and a download page will appear. Enjoy! —Brian Livingston, editorial director

All subscribers: Set your preferences and download your bonus

Windows may install updates without asking

By Scott Spanbauer

Windows XP and Vista have started installing updates at shutdown, in certain cases, without displaying a warning or requesting permission, according to reports by several readers.

The forced-install behavior has been witnessed at least three times by Windows Secrets editors, but Microsoft says its procedure for Automatic Updates hasn’t changed in the last 10 months.

The behavior seems to occur only if a Windows user has Automatic Updates configured to “download updates but don’t install them” or “notify me but don’t install them.” If updates are scheduled to occur automatically, with no notice to users, the silent installation of updates would be expected.

Most Windows patches are desirable and have few unwanted side effects. A few updates, however, are known to disable or conflict with other software. For this reason, many individuals and companies require that all upgrades be researched or tested before anything is installed.

Numerous conflicts have caused users to take a cautious approach to updates. For example, WS contributing editor Susan Bradley reported in her July 10, 2008, column (paid content) that Microsoft patch MS08-037 completely disabled the Internet connection of machines that use the ZoneAlarm firewall. Many users can’t afford this kind of interruption of service and prefer to study each update before approving its installation.

Delaying the acceptance of Windows patches allows you to gauge the risk of each individual update. It buys you time to read — in Susan’s articles, for example — about any problems that early adopters have reported with specific patches.

The forced-install behavior, in which Windows applies updates at shutdown time without requesting approval, is a concern to people who need to control the patch process. Normally, configuring Automatic Updates not to install patches without approval causes Windows to merely check for updates rated “Important” or “Recommended” whenever the computer is connected to the Internet (optionally downloading the patches for later installation).

Once Windows determines that patches are available, the operating system normally displays an icon in the taskbar’s notification area, alerting you that updates are awaiting your review and approval. (The icon is yellow in XP, blue in Vista, as shown in Figure 1.) When the forced-install situation occurs, however, this icon never appears and users receive no prompt that updates are queued for installation.

Figure 1. Notifications to users, including Windows’ new-updates icon (at left in this image), fail to appear if a forced-update situation has occurred.

Worst of all, when a user initiates a shut-down or reboot process in this situation, all pending updates are installed immediately, ignoring the user’s “don’t install” setting.

Why ‘surprise installs’ may recently have begun

One theory to explain the forced installs is that the large number of patches Microsoft released on June 9 overwhelmed the Redmond company’s download servers. Ten separate security bulletins, some including numerous versions of patches, were announced that day — an unusually high number.

The extra demand may have caused some downloads to be incomplete. Incomplete downloads are known to disable the notification icon and possibly the approval dialog that’s supposed to appear during shutdown.

Microsoft described in Knowledge Base article 910340 on Dec. 5, 2007, how an incomplete patch download can prevent the notification icon from appearing.

The document says: “During periods of heavy download traffic, the Automatic Updates service can reschedule download requests on a day-to-day basis…. The Automatic Updates service is designed to resume and complete the download as quickly as possible. Usually, the update will usually be downloaded and installed in several days.”

This explanation is little consolation for Windows users who — due to company policy or any other reason — want to avoid installing the latest build of .NET Framework, Internet Explorer 8, or any other update that has known issues. If the forced-update bug strikes you, however, any updates that are in the queue will be installed without the opportunity for you to review them.

Microsoft has aroused scrutiny in the past for installing upgrades even though users have set Automatic Updates to “don’t install.” Windows Secrets was the first publication to report in a Sept. 13, 2007, article that Automatic Updates silently installs nine small executable files to upgrade itself, regardless of the AU setting.

In a follow-up story two weeks later, WS associate editor Scott Dunn reported problems caused by a silent AU upgrade that Microsoft began in July 2007. The new executable files prevented security patches from successfully installing on Windows XP if the Repair function of XP’s install disc had been run.

Paul Pottorff, senior product manager of Windows Update, stated in an e-mail interview that no similar silent upgrade has been installed by Automatic Updates since August 2008. He explains that there’s been no change to Windows’ auto-update routine since then that would explain the recent reports of forced installs.

(Microsoft announced its August 2008 silent AU upgrade on July 3, 2008, and Scott Dunn analyzed the AU stealth patch in an article on Aug. 14, 2008.)

“The behavior we expect to see is for users to be notified about updates that are available for them to install,” says Pottorff. “If there is only a throttled update, they shouldn’t be notified. If there are any other available updates, they should be notified. The presence of a throttled update does not prevent Automatic Updates from notifying users about other not-throttled updates. Furthermore, this behavior has been the same for a long time and hasn’t even been touched for more than 9 months.”

At this point, I’m unable to make the behavior reproducible or demonstrate the exact conditions under which forced installs occur. Until a better explanation of the aberrant update behavior is provided, however, I’m calling it an unpatched bug.

How to prevent forced installs from occurring

To work around the possibility that Windows will install updates the next time you shut down or restart your PC, you need to understand the update options Windows offers. The update options in XP are:

• Automatic — automatically download recommended updates for my computer and install them.
• Download updates for me, but let me choose when to install them.
• Notify me but don’t automatically download or install them.
• Turn off Automatic Updates.

The equivalent settings in Vista (see Figure 2) are:

• Install updates automatically.
• Download updates but let me choose whether to install them.
• Check for updates but let me choose whether to download and install them.
• Never check for updates.

Figure 2. Users who’ve selected one of the two “let me choose” options are reporting that Windows has forced updates onto their systems.

Choosing the first option, which installs updates without user intervention, is designed to refresh your system with the most-crucial security patches. However, many PC security experts (including Susan) recommend that advanced users choose the second or third option. Either alternative is supposed to give you the opportunity to research the latest updates before you apply them.

The forced-update problem doesn’t appear to be rampant, but it can severely affect users whose systems are incompatible with certain updates.

If you consider it important to research patches before they’re installed, one possible workaround involves selecting AU’s option 2 or 3. Then, run Microsoft Update (a superset of Windows Update, both of which require IE) and specify every patch to be installed or not installed — every time you plan to shut down or reboot. Running Microsoft’s updater should eliminate any queued downloads that might install unexpectedly.

You might think that you could eliminate forced updates by selecting Turn off Automatic Updates (in XP) or Never check for updates (in Vista). You would then check manually for updates at least once a month, using Microsoft Update or one of the third-party update services described in the WS Security Baseline.

Besides the headache of having to check manually for patches, however, a problem with disabling Automatic Updates is that Windows constantly nags you about it. A bold red “X” is repeatedly displayed, whether or not you’re savvy enough to decide for yourself whether you wish to use Automatic Updates or a third-party patch checker. (See Figure 3.)

Figure 3. Disabling Automatic Updates, perhaps because you prefer to use a competing update checker instead, results in constant nag warnings from Windows.

Readers who have additional evidence about forced updates in XP or Vista should report the information using the Windows Secrets contact page.

Scott Spanbauer writes frequently for PC World, Business 2.0, CIO, Forbes ASAP, and Fortune Small Business. He has contributed to several books and was technical reviewer of Jim Aspinwall’s PC Hacks.

More good reasons to leave Office on the shelf

By Dennis O’Reilly

In his June 18 Top Story, WS contributing editor Scott Spanbauer presented several free and low-cost alternatives to Microsoft’s ubiquitous productivity suite.

If you need more reasons to shutter your Office apps, take a look at some of the suggestions that poured in from readers in response to the story.

The opportunity to save a few hundred dollars sounds appealing any time, but it’s especially attractive in an era of double-digit unemployment figures. That’s why the tremendous response of readers to Scott’s story in last week’s newsletter on Office alternatives wasn’t a big surprise.

Among the people offering yet another reason to give the free OpenOffice.org application suite a try is J.D. White:

• “Re: Scott Spanbauer’s excellent summary of MS Office alternatives: I ordered this Vista Home Premium computer with MS Office 2007 Premium installed. I found that Word did not open usable versions of some previous Word documents (2000 and 2003), especially a six-panel mailable brochure (it scrambled and moved both graphics and text).

  “OpenOffice 2.4, however, opened it flawlessly and allowed accurate display, updating, and printing. Moral: OO handled older Word documents better than Office 2007 opened older .doc files. Also, OO opens the widely used .odt file, and version 3.1 even opens the obnoxious Office 2007 .docx while Office 2007 is just now discovering .odt. Also, OpenOffice has long given the option of saving as a PDF.

A reader named David is another OpenOffice.org convert:

• “I switched to OpenOffice a few years back when Office 2K started fighting with other apps like Google Desktop. Even without any apps open, the computer would freeze for a couple of minutes on cut and paste activities. I asked MS about the issue and they told me to buy an upgrade.

  “I’ve used OpenOffice for fancy mail merges, complex spreadsheets, and a large book with a Master document, producing automated table of contents, index, and end notes. That did require using the ODF format, though.

  “The only issue I’ve had is with your suggestion to set file format defaults to MS Office formats. On three occasions, I’ve had large .xls format spreadsheets hiccup in OpenOffice and lose multiple tabs. Fortunately, I use FileHamster, which backs up on each save.

  “I’ve since migrated to using ODF format for spreadsheets and have found the files much smaller, faster, and completely reliable. I simply Save As Office formats or print to PDF when I share. Also, given my past experiences with not being able to open older MS file formats, I like the idea of using ODF as an archive format.”

For a closer look at OpenDocument (ODF) support in Office 2007 and OpenOffice.org 3, see Andrew Z’s post on the OpenOffice.org Ninja blog.

Save money by choosing Office Home and Student

As Scott pointed out in his article, few Office users need more than the basic features in Word, Excel, and PowerPoint. You can get these three apps plus the OneNote note-taking program for a lot less than the price of the full-blown Office suites, as Jeri Stodola points out:

• “You spoke at great length about the high cost of Microsoft Office and the free alternatives. However, you failed to mention the low-cost Office version — Office Home and Student 2007 — which includes Word, PowerPoint, Excel, and OneNote.

  “This [version] can be found for $100 to $150 and can be installed on three PCs! You don’t have to be a student to purchase this — no ID is asked for. I don’t think that $33 to $50 per computer is a bad price for Office.”

You’ll find more information about the Home and Student version of Office 2007, plus a link to a 60-day trial, on the Microsoft Office Online site. Also, you can buy this version of Office for only U.S. $79.99 on Amazon.com. (Note that the program is for noncommercial use only and doesn’t qualify for upgrades to future Office releases.)

For more on Windows software discounts, see Scott Dunn’s April 12, 2007, Top Story.

Not everyone’s a fan of OpenOffice.org

There are plenty of reasons to like OpenOffice.org, not the least of which is the price — or lack thereof. Still, some people argue that you get what you pay for. Ken McLeod is among their number:

• “Yes, there are free alternatives to Office, but …

  “(1) OOo is nowhere near up to the standard of Office. It’s slow, buggy, and just plain ugly. (And, btw, I hate Office as a program due to the bloat and unintuitive interface in its most recent incarnation.)

  “(2) Online alternatives are sloooooooow even with a fast connection, particularly if you use any degree of complexity in a spreadsheet, etc. How like Earth people to find the worst possible way of doing something (for the user) and then make it sound like God’s gift to mankind.

  “(3) An overlooked alternative is WordPerfect Suite (Corel), which, while not free, is generally more competitively priced and is and always has been a better product than Office.”

Visit Corel’s site for more on WordPerfect Office, including a link to the trial download of the Standard Edition.

David Neeley recommends that OpenOffice.org users not standardize on Office file formats:

• “I enjoyed Scott Spanbauer’s article on alternatives to MS Office. I disagree with one of his suggestions, however — that folks standardize on MS Office file formats in OpenOffice.org. …

  “I have many ebooks on my computer that were originally in MS .doc format; opening them in OpenOffice.org and saving them in Open Document Text (.odt — the OpenOffice.org default) resulted in saving about two-thirds of the disk space with no loss of content.

  “I’ve been using OpenOffice.org extensively for about three years now, both in Windows and Linux. Many of its capabilities surpass MS Office — for example, autonumbering works much better in OpenOffice.org and has been broken in every version of MS Office for at least a decade. (I worked for some years as a technical writer and had to wrestle with workarounds many times in MS Office).

  “Additionally, I haven’t had to deal with Access databases, but this article by Solveig Haugland explains how to connect Access databases with OpenOffice Base.

  “However, there are also many articles online involving the use of Base as a front end for more-powerful databases such as MySQL or PostGresQL. That gives even more power and flexibility.”

It’s nice to have choices, and there would appear to be plenty when it comes to productivity software. If only software developers could get that file-compatibility thing worked out!

The Known Issues column brings you readers’ comments on our recent articles. Dennis O’Reilly is technical editor of WindowsSecrets.com.

Saving the world, one surprise ending at a time

By Katy Abby Red herrings, plot twists, and cliffhangers are all part of the joy of losing yourself in a good movie or TV show. The story line weaves intricately through your mind, casting aside all outside thoughts and distractions as you breathlessly await the next revelation. So when some thoughtless cretin ruins the surprise with a careless comment, the results can be devastating. Fortunately, there’s a group of folks who’ve dedicated their lives to silencing these “spoilers” once and for all. Take a look at this College Humor original short; after seeing how seriously these guys take their jobs, you’ll never let the cat out of the bag again! Play the video

Use ReadyBoost and pagefiles on flash drives?

By Fred Langa The low number of reads and writes supported by USB devices means active caching on a flash drive is a bad idea. Moreover, Microsoft’s much-vaunted ReadyBoost won’t improve the performance of most Windows systems, making this “speed-up” technology more trouble than it’s worth.

Pagefiles wear out flash devices in no time

Windows Vista ships with ReadyBoost, a kind of flash-drive system cache that’s supposed to speed up the operating system. You can read more about it on Microsoft’s Vista Features page. A reader named George asks a logical question about the technique:

• “I’m using an 8GB USB thumb drive for ReadyBoost. ReadyBoost uses only 4 gigs of this space. How about using the free space as a pagefile?”

Flash drives have a finite life; most common flash devices provide as few as 10,000 write cycles. That might sound like a high number, but it’s nothing when you’re talking about constantly accessed pagefiles and ReadyBoost types of caching.

To put it another way, system caching is a heavy-duty task, and most flash drives are intended only for light-duty file sharing and such. That’s why I recommend that you avoid selecting the ReadyBoost option in the AutoPlay dialog that appears when you insert a flash device into a USB port. (See Figure 1.)

Figure 1. Take a pass on the AutoPlay option that appears when you plug in a flash drive and Vista offers to enable ReadyBoost.

ReadyBoost has other problems: It simply doesn’t do all that much for performance on most systems, and it’s a lot more finicky than most people realize. For example, tests were conducted by Patrick Schmid for the Tom’s Hardware site. He found that, while ReadyBoost can help some apps launch faster, the improvement is nowhere near the jolt you get by upping your system’s RAM.

For more on ReadyBoost limitations, see the article “ReadyBoost works, but not a miracle” on the IStartedSomething site.

Because of these factors, I don’t use and don’t recommend ReadyBoost. Moreover, I would never put my frequently accessed pagefile on a device that supports so few reads and writes.

New custom-built PC hangs frequently

Dian C. Smith’s new PC isn’t behaving properly:

• “Recently, I had a new computer built. I use Uni-Blue to clean my Registry and to make the system run faster. But now — regardless of what program I’m running — my system hangs after a short while and won’t budge, even with Ctrl+Alt+Delete.”

Normally with a new PC, I’d suspect the hardware for hard hangs like this. But you indicated that your problem showed up only after running a clean-up/tune-up tool. So let’s start with software.

In PC troubleshooting and repair, you have to balance the amount of time you invest in finding and fixing the problems versus the likely return. If this were happening on a well-maintained PC that had been in long, trouble-free service, you’d probably want to carefully track the problem to its root cause in order to preserve your well-honed setup, personalizations, and other tweaks.

With a new system, that’s not the case. You haven’t yet spent much time getting things just right, so your investment of time and effort is still relatively low. That’s why it may be simpler, faster, and more certain just to whack the original installation and start over from scratch or — better — from your last known-good backup. In fact, that’s what I recommend you do.

Given that these problems occurred after using a specific cleanup tool, I also suggest you avoid using that particular program again; some system-maintenance utilities are too aggressive and can torpedo perfectly good setups.

If the problem recurs again after a fresh install or after you reinstall a known-good setup — and without the use of that Registry cleaner — then we’re back to checking your hardware for the source of the glitch. The three most-likely candidates are the system’s fans, connectors, and power supply.

A dead, slow, or too-small fan can cause overheating, which would lead to the “runs for a while and then hangs” symptom. Make sure all the fans are working.

Likewise, a loose or otherwise-bad connection can cause intermittent trouble. I suggest you unplug and reinstall all the connectors inside your PC, making sure all plug-in cards, chips, and other devices are firmly and squarely seated in their sockets.

A flaky power supply can also cause this problem. If the above steps don’t help, swap out the power supply with one you know works. If your PC is new enough to be under warranty, whoever built the unit should be able to help you exchange the power supply.

I’m usually all for step-by-step troubleshooting. But sometimes the cost of a careful diagnosis in time, labor, and dollars just doesn’t make sense. When a new PC or new setup fails, the best, fastest, and least-costly approach is often simply a clean-slate do-over.

A baffling problem with Acrobat updates

R. Bellin’s copy of Adobe’s Acrobat PDF software doesn’t seem to update fully, even when it indicates that it has:

• “I have Acrobat installed. When I open the program and check the version, it shows it’s the most recent. However, if I check the program version or the version of any of the DLLs in the directory from Windows Explorer, they all show an earlier version.

  “If I run Software Inspector [Secunia’s software-update service], it too shows an earlier version, and Secunia insists that the program is insecure. I’ve been in contact with Secunia support about this, and they’re clueless as to this baffling problem.”

I suggest you fully uninstall Acrobat and run a reputable Registry cleaner — such as one of the programs reviewed by Scott Spanbauer in the Sept. 11, 2008, Best Software column. This will ensure that all vestiges of Acrobat are gone. Then if you really need Acrobat, reinstall the program using a fresh download from the Adobe site.

Note that Acrobat and other Adobe software titles have a less-than-stellar reputation among many computer-security professionals. Perhaps an alternative PDF app would serve you better.

There are many free or lower-cost alternatives to Acrobat for creating and editing PDFs. For example, there’s the open-source PDFCreator — which you can download from the product’s page on the Open Source as Alternative site — and the free Foxit Reader — available from the vendor’s site — that replaces the Adobe Reader PDF viewer.

Becky Waring reviewed in her July 3, 2008, Best Software column several products that convert paper documents into searchable PDFs or Office files. You’ll also find links to reviews of other Acrobat alternatives on the Associated Content site.

Partition trouble causes incredible slowdowns

Holland McPeake’s PC is experiencing almost-unbelievable delays due to partition trouble:

• “My system ran fine until I decided to upgrade the HD by replacing the existing 400GB drive with a 750GB drive. I also have a second 750GB drive in a removable case that I planned to use as a clone backup.

  “I installed the new 750GB drive and cloned the existing 400GB drive to the new drive with Acronis True Image Home Edition. I then used Partition Magic 8 to resize the partitions on the new drive.

  “Ever since, when I try to start True Image or other programs which first go out and look at drives, there’s a very long pause — I’m talking hours. For example, when TI starts, it evaluates each drive but this takes 4+ hours. The same thing happens with Ashampoo Burning Studio: hours of delay.

  “The Acronis people have had me do numerous things, mainly sending them reports, updating the program, etc., but they gave no help in resolving the problem. This has been going on for six months.

  “In frustration, I emptied the C: partition and reinstalled Windows from scratch. No change — problem’s still there. I cloned the problem drive and used the new cloned version. No change — still long delays…. [Editor’s note: Many other troubleshooting steps were omitted for brevity.] I’ve scanned the drive with NOD32 and found no viruses.

  “Please, oh please, have some ideas on what I can do! You’re my last hope!”

I’m your last hope? I feel like Obi-Wan Kenobi!

The good news is, I think I know what happened. The bad news is, the fix may be a pain in the partitions.

Third-party partitioning tools don’t always play nice with each other — or with Windows. I’ve seen cases (some on my own PCs and some specifically with Partition Magic) where a partitioning tool will happily run to completion, but then a different partition-management tool — or even Windows itself — will report errors with the new partition structure.

In your case, Holland, I’m guessing the problem is caused by either Partition Magic or Acronis doing something slightly nonstandard. Naturally, each program will point the finger at the other.

Before we get to the hard but almost-certain fix, there’s a long-shot repair that might be quicker and simpler: Use XP’s Recovery Console to run the fixboot and fixmbr commands. (Of course, make a full backup first.) These commands can sometimes sort out issues with the boot sector, master boot record, and partition tables by resetting things to the correct Windows format.

Again, there’s not a high probability that the fix commands will put things right, but the process is quick and easy to try. You’ll find full instructions in Microsoft Knowledge Base article 314058.

If fixboot and fixmbr don’t work, copy the data off the troublesome drive in a nonimage format; this lets you replace the drive’s contents without also copying the munged partition structure. Reformat the drive and use the XP setup program to create the initial partitions. For instructions, see KB article 313348. You may also want to use the disk-management tool in XP’s Management Console; see KB article 309000 for the details.

Once you’ve recreated the partitions, you’ll have to go through the hassle of setting up Windows and reinstalling your software — sorry! Finally, copy your data files back to the reformatted drive partitions and you should be good to go.

In the future, avoid mixing and matching different partition-management tools. Find one that works well with Windows and your setup and stick with it.

Oh, and, uh (donning hooded robe): May the Force be with you!

Fred Langa is editor-at-large of the Windows Secrets Newsletter. He was formerly editor of Byte Magazine (1987–91), editorial director of CMP Media (1991–97), and editor of the LangaList e-mail newsletter from its origin in 1997 until its merger with Windows Secrets in November 2006.

Utilities help clear temp files, stymie Trojans

By Ryan Russell Great free and low-cost software can keep your browsing private, your temp files cleared out, and your system protected from malware. Some vendors deliberately make their free versions hard to find, but for such cases I’ll show you where to find the downloads — on the official sites or elsewhere on the Web.

The no-cost way to clear out temp files

My May 28 column described ADDPC’s free Temp File Cleaner utility. It was recommended by Joe Montgomery, a reader who helps friends and associates with their PC problems for fun and profit. (You can download Temp File Cleaner from ADDPC.)

That column struck a chord with several readers who were good enough to share with me their favorite free cleanup tools. Mike Burns recommends IE Privacy Keeper, which — despite its name — works with Firefox, too. The program uses a traditional installer and is privacy-focused, as the name implies. For that purpose, it’s fairly thorough.

IE Privacy Keeper allows fine-grained control over which files you do and don’t delete. It also lets you customize file and Registry cleanup, so you can use the utility as your one-stop PC-maintenance tool. The program remembers your previous settings but takes a while to set up. IE Privacy Keeper is available from Browser Tools.

Robert Flanagan let me know about Temp File Deleter, a program he appears to have created himself. This tool is a lot more specialized and cleans a smaller number of locations than most other cleanup utilities, but it purports to find and remove temporary ActiveX downloads, bits of old Microsoft Office installs, and temp folders buried deep within your system’s files.

I wasn’t able to test this on the Windows XP virtual machine I use to evaluate software, because the VM lacks leftover items such as these. However, Temp File Deleter does seem to clean out detritus that other such utilities miss. The program runs without having to be installed and is ready to use upon download. Get your copy from Add-Ins.

My favorite reader-recommended cleanup tool is one Rob Gazy told me about: ATF Cleaner, which deletes temp files. The product’s page claims the program works only on Windows 2000 and XP, but it nonetheless provides specific notes about running it on Vista.

ATF Cleaner requires no installation; just download it and go. The utility cleans out junk left behind by IE, Firefox, and Opera: select from the menu the program you want to sanitize and click Empty Selected. Even though ATF Cleaner dates to 2006, it works just fine. Get your copy from Atribune.

These three programs show that for some jobs, multiple tools are better than one.

Playing ‘Where’s Waldo?’ with ZoneAlarm Free

Frank Foster wrote in to tell me he thinks the ZoneAlarm firewall program is no longer free. After checking the vendor’s site, I was able to find the download link for the version of ZoneAlarm that’s free for noncommercial use, but doing so wasn’t easy.

If you go to the ZoneAlarm Free Firewall page, you’ll find it says “free” in several places and even lists the conditions (individual, not-for-profit) under which you can use the free version. If you click the Download Now button, however, you’re taken to a page where you’re presented with a 15-day trial of the ZoneAlarm Internet Security Suite with TrialPay. Clicking that option signs you up for TrialPay, under which you view ads rather than pay cash for the ZoneAlarm suite.

Instead, click the download button in the right pane under Get Basic PC Protection: Basic Firewall Only. You can download the program without having to jump through hoops by visiting the product page at Download.com or the equivalent page on Softpedia.com.

I installed the free version, and have been using it on a test VM for several days. It works like it’s supposed to. It does invite you to upgrade to a trial or pay version with more functionality at every opportunity though, including when you’re just updating the free program.

Another Trojan remover for your security kit

Laura Bahr’s favorite tool for removing Trojans is Simply Super Software’s Trojan Remover, which the company claims will run on all 32-bit versions of Windows from 98 to 7 (in Microsoft’s backwards numbering scheme). In my testing, the program downloaded, installed, and updated normally. The initial download is 8MB, and the update’s a few hundred kilobytes.

Trojan Remover’s 30-day trial provides you with more than enough time to determine whether you’re willing to pay $24 for the first year of use and $17 for subsequent years. The vendor’s site is simple and straightforward. I get the impression that it’s a small shop selling only this one product.

The program ran well and quickly on my test machine. To run the utility through its paces, I infected my test PC with a random piece of malware I found on the Internet. The malware, which didn’t appear too complicated, modified my Hosts file to point to malicious sites. The tool detected the infection and offered to clean it out.

I’m definitely going to keep Trojan Remover in mind the next time I suspect one of my PCs has picked up a rootkit or Trojan. You can download the trial version of Trojan Remover from the product’s download page on the Simply Super Software site.

The Perimeter Scan column gives you the facts you need to test your systems to prevent weaknesses. Ryan Russell is quality assurance manager at BigFix Inc., a configuration management company. He moderated the vuln-dev mailing list for three years under the alias “Blue Boar.” He was the lead author of Hack-Proofing Your Network, 2nd Ed., and the technical editor of the Stealing the Network book series.

The correct way to install Vista Service Pack 2

By Susan Bradley Any service pack can be problematic, but Vista Service Pack 2 (SP2) provides some extra-special challenges. Vista SP1 offered clear benefits, including better performance, but with Vista’s second service pack you may just want to hold out for Windows 7’s release later this year.

Don’t be in a hurry to install Vista SP2

Microsoft recently began pushing Service Pack 2 to Vista users via Windows’ Automatic Update service. However, a few days ago I learned that MS seems to have backed off on offering SP2 to everyone. I’ll track the status of this and report on it in a future column.

Meanwhile, if you have Automatic Updates enabled, you may at any time see SP2 among the updates you’re offered — if you haven’t already. This service pack suffers from a few problems. In his June 4 Known Issues column, WS technical editor Dennis O’Reilly described some of the problems that early Vista SP2 adopters have reported.

As most of my readers know by now, I usually recommend setting Automatic Updates to download new patches but ask before installing patches. This gives you an opportunity to uncheck “Vista SP2” until we’re relatively certain that all the bugs have been worked out. (For instructions on adjusting your Automatic Updates settings, see today’s article by Scott Spanbauer and Scott Dunn’s Aug. 14, 2008, Top Story.)

I think you should be very, very careful whenever you install a service pack. While Vista SP2 supposedly doesn’t make any overt changes to your system, installing the service pack is still risky. The dreaded “Stuck on update 3 out of 3” issue that we saw with Vista SP1 — documented in Microsoft Knowledge Base article 949358 — can occur as well when you apply Vista SP2. This problem is discussed in the Yahoo forum and elsewhere on the Web.

Take the following steps to minimize the chances of having a service pack trash your system:

• First, back up your PC. If you don’t already have a trusty backup program, WS senior editor Ian “Gizmo” Richards discusses various backup methods and products in his Aug. 18, 2008, Best Software column.
• Disable your antivirus software. If you can’t deactivate your AV program using the app’s own options, click Start, Control Panel, Administrative Tools, Services. Right-click the AV software entry or entries you find in the services listed in the window and choose Stop to shut down each service. (See Figure 1.) Keep in mind that you may need to stop two separate services in this window. I had to do this, for instance, to close the ForeFront program on my test PC.

  
  Figure 1. If no option to disable your AV software is offered, use the Stop option to temporarily disable its running services before installing Vista SP2.

• Be patient while your system reboots to complete the installation. With this service pack, it takes a fair amount of time to shut down and reboot in order to finish applying the update.

I’m not ready to give the go-ahead to apply Vista SP2. I’m waiting to see what the price tag will be to upgrade my company’s existing Vista PCs to Windows 7. If the upgrade price is reasonable, it might be more efficient to suffer through an upgrade to Windows 7 — with the benefit of faster boot times — than to chance Vista SP2.

Another reason to pass on the Vista service pack and jump to Windows 7 is that, unlike Vista SP1, SP2 won’t improve most systems.

Version 3 makes iPhones much more secure

Version 3 of Apple’s iPhone software adds such features as landscape typing and the ability to cut and paste text. But the best reason to install this update as soon as you can is the new version’s patches for 46 security holes. Apple describes the fixes in its advisory.

One of the holes allows a script on a Web page to hijack your phone, causing it to dial a number that places a huge charge on your long-distance bill.

To update your iPhone, plug it into a computer that has iTunes installed. The update will be offered to you automatically. (See Figure 2.) Once the update installation is complete, you’ll see several new applications that are discussed on the official iPhone site. After the update, you may need to rearrange some of the icons on the main iPhone screen if you find that your application shortcuts are no longer where you expect them to be.

Figure 2. Apple’s iPhone patch will be offered to you automatically when you plug the phone into a PC with iTunes installed.

Intermedia.net, a hosting company specializing in outsourcing Exchange e-mail, currently recommends against deploying the iPhone update. The company’s rationale is reports of lost e-mail when users sync their iPhones with corporate Exchange servers. In my limited testing with the iPhones I support in my offices, however, I saw no problems synching with an Exchange server.

Firefox and Chrome updates fix critical holes

These days, it seems that when one browser gets an update, they all do. In the case of Firefox, several security holes are being patched in version 3.0.11, as explained in the Mozilla Foundation’s advisory. Likewise, Google’s Chrome browser, which shares some WebKit software with Apple’s Safari browser, has been updated to plug some vulnerabilities, as detailed in a company blog post.

Chrome should automatically update in the background to version 2.0.172.31. To check, launch the browser, click the settings icon in the top-right corner (it looks like a wrench), choose About Google Chrome, and confirm that you’re using the latest release. (See Figure 3.) If the browser isn’t up-to-date, you’ll see a button to install the latest update.

Figure 3. Confirm that Chrome has updated to the latest version via the About Google Chrome screen.

963707
.NET patch finally gets a Firefox fix

WS editorial director Brian Livingston gave guidance in a June 4 article about a problem with Service Pack 1 for Microsoft’s .NET Framework 3.5. That service pack silently installed on Firefox an extension called Assistant 1.0, with no warning to users. Even worse, the extension’s Uninstall button was grayed out due to a Microsoft error (although the Disable button still worked).

As Brian explained, Microsoft quietly released a patch for .NET 3.5 SP1 that enabled the extension’s Uninstall button. Users who want the most-secure Firefox possible could use the Uninstall feature to eliminate the risk that a security hole might be discovered in .NET 3.5 that could compromise Firefox, too.

This week, Microsoft will push out the patch, which previously required a manual download, to everyone. The update is described in KB article 963707.

Let me repeat my warning about .NET patching. You may wish to remove .NET, but the only sure way to determine whether you truly need it (and the updates for it) is to remove .NET and see whether any application stops working. If you have Intuit’s QuickBooks installed — especially a version from 2006 to 2009 — I guarantee that removing .NET will make the application fail.

MS09-019 (969897)
An Outlook/IE printing mystery solved

After applying security bulletin MS09-019, an update described in KB article 969897, one Small Business Server consultant found that his clients could no longer print from Outlook or Internet Explorer. He was able to reproduce the problem on his own machines and contacted Microsoft’s support department via the Redmond company’s e-mail case site.

It turns out that Microsoft’s Software Inventory Analyzer program was the culprit. As described in an Ask the IE Support Team blog post, once the consultant removed the inventory software, his clients were able to print again. Microsoft’s support staff also indicated that a Registry key added by the program may conflict with blogging software.

If you find that you suddenly can’t print from certain apps, check to see whether you have Microsoft’s software-inventory program installed. If so, remove it to see whether the problem goes away.

The Patch Watch column reveals problems with patches for Windows and major Windows applications. Susan Bradley recently received an MVP (Most Valuable Professional) award from Microsoft for her knowledge in the areas of Small Business Server and network security. She’s also a partner in a California CPA firm.