XP virtual computing avoids dual-boot complexity

XP virtual computing avoids dual-boot complexity

By Scott Dunn It’s possible to have Vista and chow down on your XP cake, too, if you apply a free — for now — virtual machine. If you’re stuck with a Vista PC, but you really prefer using XP, I’ll show you how to set up XP as a virtual machine on Vista, plus some tricks you can use to get the most out of this setup.

Why you should give virtual machines a free try

It’s unarguable: Windows XP operates more quickly than Vista (a fact that PC World recently demonstrated even with the new Service Pack 1 installed on Vista). Additionally, no one who’s independent of Microsoft’s payroll suggests that device drivers are just as easily available for Vista as they are for XP, or that Vista supports as many software applications that people own.

It’s Microsoft’s mission to make the marketplace more Vista-friendly, which seems to be the company’s primary motivation for shutting off retail sales of XP on June 30. But many Windows users want to stick with XP, either for performance reasons or so they can use software that’s not Vista-friendly. With fewer PCs on the shelf that will run, or even support, Windows XP — and with that number dwindling each day — a way you can run XP on a Vista machine that may be your only option is a blessing.

Operating XP in a virtual machine (VM) is a great alternative for those with newer PCs that may not, out of the box, be XP-compatible. Indeed, when I explained in a Feb. 14 article how to set up a computer to dual-boot between Vista and XP, a number of readers suggested another possibility: run XP in a virtual machine.

One related fact makes this option even greater: you can prove that it works for free, using downloads from Microsoft that will function at least through July 3, 2008. (More on that later.)

The advantages of running a second operating system like XP inside a virtual machine include:

• Compatibility. You don’t have to worry about locating XP drivers for most hardware components. Vista’s drivers provide all the support XP needs within the VM.

• Faster access. You don’t have to reboot your computer to start a session running XP or another operating system in a VM.

• No System Restore bugs. Running XP in a virtual machine bypasses the fact that XP deletes Vista’s restore points, as I discussed in an article on Feb. 21.

• Safer surfing. As Windows Secrets contributing editor Mark Edwards pointed out in a May 24, 2007, article, running a browser in a virtual machine provides an extra layer of security between your virtual system and your primary OS.

In my tests, I’ve found Microsoft’s Virtual PC to be a simple and convenient way to run XP within Vista. But, if you’re interested in trying virtual-machine software from a non-Microsoft source, download the free VMware Player from (who else?) VMware.

To use the VMware Player to install Windows XP, you’ll need to install some additional software and create a couple of special files. Fortunately, self-described freelance Perl programmer John Bokman details the steps on his Web site.

How to install XP on Microsoft Virtual PC

Before beginning, make sure that you meet all of these requirements:

1. A computer with adequate muscle. Your PC needs to a be good performer, with at least 2GB of disk space and 128MB of RAM to run Windows XP. That means 128MB of RAM over and above what your current operating system demands, not 128MB total. More than 128MB of spare RAM works better. You can find the requirements on a Microsoft System Requirements page.

2. A copy of Microsoft’s Virtual PC. Virtual PC is free and — once you’ve installed the (equally free) Virtual Machine Additions — you’ll probably find the software is easy to work with.

3. A copy of Windows XP. You’ll need a Windows XP install disc to add that operating system to your virtual machine. If you’re transferring a retail copy of XP from another machine, this should not be a licensing issue. If your only copy of XP is an OEM copy, however, you may need to purchase a retail copy while packages are still available. See my Mar. 13 article for a discussion of licensing concerns.

If you only need XP (or Vista) to run in a VM for a few weeks for testing purposes, Microsoft makes preactivated images of those operating systems available for free at its Download Center.

Note, however, that this free version of XP expires on July 3, 2008. Microsoft has been giving away these short-term versions for some time, so it’s possible that another downloadable version of XP will be available when the current one expires. If you ever reinstall the OS within your VM, unfortunately, you’ll also have to reinstall any software you added to the VM.

Let’s get started with the installation process. It looks long, but if you follow my steps precisely, it’s straightforward:

Step 1: Get a copy of Virtual PC from Microsoft’s Download Center.

Step 2: Launch the downloaded setup.exe and follow the steps in the Microsoft Virtual PC 2007 Wizard.

Step 3: Launch the Virtual PC Console by choosing Start, All Programs, Microsoft Virtual PC. (In Vista, you can also click Start, type Virtual PC, and press Enter.)

Step 4: If you have no virtual machines, the New Virtual Machine Wizard starts automatically. Otherwise, you’ll need to click the New button to start the New Virtual Machine Wizard. Click Next.

Step 5: In the wizard, select Create a virtual machine and click Next.

Step 6: Type a name for your VM. If you want to change the folder that the VM (.vmc) file is stored in, type in a new path or use the Browse button. Click Next.

Step 7: Specify Windows XP as your operating system (this is the default if you’re running Vista). Click Next.

Step 8: I recommend you select Adjusting the RAM and increase the setting rather than accepting the wizard’s 128MB default. Your choice depends on several considerations, including how much RAM your system has and whether you’ll be running other applications in Vista at the same time that you’re working in the VM. You can always adjust the RAM setting later. Pick a number, enter it, and click Next.

Step 9: Reserve a chunk of hard disk space to simulate a hard drive for the VM to use. Select A new virtual hard disk and click Next for this file. (It has a .vhd extension.) The default option is to let the virtual disk expand dynamically until it reaches the size you specify. Click Next.

Step 10: Specify the size and location of the .vhd file and click Next. Then click Finish.

Step 11: Select your new VM in the Virtual PC Console window and click Start.

Step 12: When the system finishes loading the VM, insert your XP install CD or DVD and press Enter. XP setup should begin. If it doesn’t, choose CD, Use Physical Drive X: (where X is the drive letter displayed). Then press Enter again.

Step 13: Allow XP setup to proceed just as though you were installing the OS on a new computer. Installation is a faster process on a virtual machine, because the PC hardware doesn’t have to go through a hardware reboot several times during the installation.

Step 14: Once you’ve installed XP and have it running in a window, you’ll need to install some Virtual Machine Additions to give Virtual PC more features and flexibility. From the window that shows your new XP VM, pull down the Action menu, and select the option entitled Install or update Virtual Machine Additions.

Without the Virtual Machine Additions, your mouse pointer is trapped inside the VM until you press the Right-Alt key on your keyboard. With VM Additions installed, however, you can move the mouse freely between the windows.

VM Additions also enables folder sharing between your VM and the host OS, supports drag-and-drop file copying between guest and host systems, and sharing the Clipboard between guest and host systems. VM Additions also adds joystick support, provides optimized video drivers, and more.

Tricks to improve your VM experience

If you haven’t run a virtual machine before, it’s a different experience from what you’re used to. Here are a few quick-start tricks to make your XP virtual-machine journey easier:

• The new Ctrl+Alt+Delete. The Ctrl+Alt+Delete combination affects only your host version of Windows. If you need this feature within your VM, hold down the Right-Alt key and press Delete instead.

• Run full screen. To run your VM full screen, hold the Right-Alt key and press Enter. Repeat to reduce the VM to a window again.

• Make your VM hibernate. To get the equivalent of Windows Hibernate within the VM, click the VM’s Close button or pull down the Action menu and click Close. Then choose Save State when the system prompts you.

• Share folders. To share a folder between your VM and your host OS, right-click the folder icon in the bottom of your VM window and choose Share Folder. Select the folder (on your computer) that you want to share and specify a drive letter. Click OK. Within the VM, the folder appears as a network drive with the letter you assigned.

• Adjust memory. If you need to adjust the amount of memory you’re giving your VM, you must first close the virtual machine down completely, without the Save State feature. This is detailed in the following steps:

Step 1. Within the VM, choose the Start button and then the Shut Down option. Alternatively, use the VM’s Close button (or pull down the Action menu and select the Close option) and choose Turn off.

Step 2. Select the VM in the Virtual PC Console window and click Action, Settings.

Step 3. Select Memory on the left side and adjust the slider on the right side. Click OK.

Running XP in a virtual machine isn’t perfect. XP won’t run as fast in a VM as it would running by itself. In addition, VMs have a limitation that may be a deal-breaker to some: Microsoft’s Virtual PC does not support access to USB devices from within the VM. Note that VMware Player does not have this problem.

Running the free, preactivated version of XP within either Microsoft’s Virtual PC or VMWare Player can give you a sense of whether the VM approach is right for you — without spending any money.

Readers receive a gift certificate for a book, CD, or DVD of their choice for sending tips we print. Send us your tips via the Windows Secrets contact page.

Scott Dunn is associate editor of the Windows Secrets Newsletter. He has been a contributing editor of PC World since 1992 and currently writes for the Here’s How section of that magazine.

Reader tips on portable computing flow in

By Scott Dunn

In my Mar. 20 article, I described techniques for putting an entire Linux OS on a flash drive, which is almost like having a pocket computer that can run many of your favorite applications.

I mentioned some limitations and presented a warning, but readers have come to our aid with insights on protecting and using your diminutive computer accessory.

Backing up is a good idea, recovery is better

I cautioned prospective users to remember how easy it is to lose a flash drive.

One of the most practical suggestions we received is Jeff Weed’s reasonable proposal to identify your ownership. If an honest person finds your flash drive, you have a chance to get it back:

• “Whenever I get a new flash device, I always store a plain text file on the root folder with the file name !Owner-Info.txt.

  “I create it with Notepad and list my name, e-mail address, and phone number along with a statement requesting anyone who finds it to contact me. Then I set the file to be read-only so I can’t mistakenly erase it. The exclamation point (!) in the file name helps ensure that the file appears at the top of the list when someone views the files with most any file manager.

  “The plain text format (.txt) helps ensure that the file can be read on any computer.

  “Of course, all this assumes that your lost device is found by an honest person. But, even if it was stolen, an honest person may end up with it before long. Also, you might recover a flash card but not the device it was in, but that’s better than nothing.

  “I have been doing this for a few years now. I did recover a lost digital camera one time (after 6 months), because it was found by a college student who was curious enough to look at what was stored on the card.”

Good approach, Jeff. It’s simple to do, and there’s a pretty good chance an honest person who finds the device would notice your contact file.

Here’s another trick along this line: A co-worker of mine, a passionate recycler, is always trying to figure out a way to use the name-and-address labels that charities send in their donation pitches. One of these labels fits tidily on the side of a memory stick.

I’ll publish more tips as we finish testing them. Reader Weed will receive a gift certificate for a book, CD, or DVD of his choice for sending a tip we printed. Send us your tips via the Windows Secrets contact page.

Is that a good spot over there?

It’s a vehicular jungle out there, with packed traffic, surly drivers, and a paucity of parking places, all begging the question, “Where the Sam Hill is everyone going to park?” With a large portion of the population behind the wheel, there’s a growing trend that makes it seem OK for drivers to park as though they had their eyes closed. The adherents of this cult feel it’s acceptable to park diagonally, to park way too close to your car, and — if they drive a particularly gargantuan SUV — that by some anomaly of the space-time continuum their corpulent chariot qualifies as a “compact.” If you’ve ever felt powerless against these irritating infractors, fear no longer. Simply print out a citation from the following Web site (which has an unprintable name), slap said citation on the offender’s windshield, and walk away triumphantly! Visit the site

Get better results deep-cleaning Windows drives

By Fred Langa This week, I’ll add to my previous comments on free and easy ways to eliminate what the Disk Cleanup tool in Windows leaves behind. You can quickly eliminate megabytes or even gigabytes of hard-to-remove junk and boost your system performance!

‘Enhanced’ disk-cleanup settings not enough

In my Mar. 13, 2008, article, a reader asked me to update what he called my “classic” tuning and tweaking articles on Windows XP and previous versions. The reader was specifically interested in my updating those tips for Vista.

In my last column, I discussed enhanced disk cleaning: how to access and modify the settings of Windows’ built-in Disk Cleanup tool — cleanmgr.exe — to make the tool more thorough than its default settings allow.

But even the hidden, enhanced settings of Disk Cleanup leave junk behind. Windows, it seems, is conservative in eliminating files, preferring to waste some disk space rather than risk deleting a potentially important file.

That’s a sensible strategy in the short term, but over time Windows’ excessive caution leads to an enormous number of unnecessarily preserved junk files. These undeleted, unused, and unneeded files can consume prodigious amounts of space. Even worse, this can bog down your system’s performance — if you don’t attack the digital plaque.

That brings us to today’s topic: how to root out the digital debris that other cleaning tools leave behind. In some cases, you may find you can recover up to a gigabyte of formerly wasted disk space.

To start, you need to identify where these junk files accumulate on your system. One obvious place to look is in any folder named temp or variations of the word “temporary.” By definition, nothing with long-term value should be stored in a temporary folder.

One important exception is any temp folder that software installation tools use as a scratch area until the install is finished. Setup routines written by good programmers erase these temporary files. Many coders, however, don’t follow these basic disk-hygiene practices.

Before removing temporary setup files, however, check whether any program is halfway though its install process. You shouldn’t run any disk-cleaning tools until you’re sure all pending software installation tasks have finished running, including any reboot that may be required.

Once you’re sure that all installation routines have been completed, you can use the Search tool built into Windows to find temp folders that are ripe for pruning. Some common temporary folders include:

• C:UsersUSERNAMEAppDataLocalTemp
• C:ProgramDataTEMP
• C:WindowsTemp

The first line shown above is Vista-specific. In XP and earlier, the location C:Users doesn’t exist. If you use Vista, be sure to replace USERNAME with your own sign-in name in any del command.

On your own system, whether it’s running Vista, XP, or an even older operating system, you may find even more temporary folders than are shown above.

Note: If Windows Explorer is in its default state, the file manager won’t show you any files or folders that are marked “hidden” or “system.” To correct this, pull down Explorer’s Tools menu, select Folder Options, and click the View tab. In the Advanced Settings pane, select Show hidden files and folders, and click OK.

(Tip: You can also include hidden and system files when using Windows’ built-in search function. To do this when searching, make sure you first enable hidden/system files in the advanced options.)

If you’re not sure what you’re seeing inside a temp folder, check the date on which the files were last modified. The older the temp files are, the more likely it is that they’re pure junk.

Once you’ve identified temp folders that are ripe for cleaning, make a note of their full path. We’ll need this in the next step.

Get ready to rid yourself of old, temp trash

We’ll use Windows’ del command (as in Delete) to clean out these folders. (Microsoft Technet’s Command Reference has full info on this and similar commands.) We’ll use the following folder as an example:

C:UsersUSERNAMEAppDataLocalTemp

Of course, you must replace USERNAME in the above with your actual username. For example, the pathname on my PC would be:

C:UsersFredAppDataLocalTemp

Open Notepad or any text editor and compose a del command as shown below (be aware that PCs with multiple users will have different temp folders for each different user):

del /p /s “C:UsersUSERNAMEAppDataLocalTemp*.*”

In the above command, we’re specifying that the del command should delete all files (*.*) in the Temp folder. The quotation marks around the path name are necessary in case a space appears in any part of the string.

The /p switch in the command makes it pause before each deletion to request confirmation. The /s switch causes the command to include any subfolders underneath the target folder. You can use other options if you wish. (Enter help del at a command prompt to learn the syntax.)

Save this one-line text file with the extension .bat and give the file a meaningful name, such as cleanup.bat. Place the file on your desktop or in any convenient location.

Run my command with caution the first time

Before you run the cleanup command, please note that there’s an obvious danger in any mass deletion of files. As always, make a backup before you start any serious system maintenance process.

But I’ve included a safety feature in the del command shown above. When you run the batch file, the /p switch forces Windows to pause at each file and ask you if it’s OK to erase it. If you have a multitude of files in a directory, pausing repeatedly is a major pain, but pausing can prevent you from deleting files you don’t really wish to.

After you gain confidence that you’re working in the correct folder and deleting the correct files, you can abort the batch file. (To do this, press Ctrl+C.) You can then edit the command in Notepad to replace the /p with a /q. This change enables “quiet,” no-prompt, high-speed mass deletion of all the files in the folder. Again, don’t replace /p with /q until you’re 100% sure the command is working exactly as you intended.

The reason for this caution? Anything deleted via a del command does not go into Windows’ Recycle Bin. This means you can’t easily use the Recycle Bin to restore files that are deleted from the command line. Microsoft describes this behavior in Knowledge Base article 171051.

Deleted files may be recoverable with heavy-duty “undelete” tools, but such tools are neither convenient nor infallible. So, make sure your del command is working properly before you turn it loose. If you follow the steps I described above, nothing will be deleted until and unless you explicitly say it’s OK by pressing Y for each file.

As Windows executes the command, you may be surprised to see Windows recieve your approval and still refuse to clean out some temporary files. The OS denies access to any files that are in use, for example.

Access denial, in this case, is a good thing. It prevents your cleanup process from interrupting Windows’ normal and ongoing use of its temp folders.

In the case of deleted files that Vista periodically creates, the OS can automatically recreate some temp files that you may have deleted. Because of this, your cleanup will rarely empty a temporary folder completely. The process does, however, remove many of the nonessential, junk files that otherwise accumulate there.

Once your initial del command is working properly, you can extend your cleanup batch file to process additional folders in exactly the same manner. Test the command first with a /p switch, and change it to a /q only when you’re certain everything’s working OK.

Your batch file could end up including three or more commands, which might look like the following:

del /q /s “C:UsersUSERNAMEAppDataLocalTemp*.*”
del /q /s “C:ProgramDataTEMP*.*”
del /q /s “C:WindowsTemp*.*“

You also can add cleanup commands for any other folders that are ripe for cleaning, based on your explorations.

If you want to get really ambitious, you can use the operating system’s Search tool to hunt for and delete individual files with extensions signifying temporary and nonessential objects. You may already know the kinds of temporary files that are generated by the specific applications you use. If you don’t, some common patterns for temporary files are:

*.tmp   *.temp   *.gid   *.chk   *.old   *.fts   *.ftg   *.dmp   *.prv

*.___   *._mp   *.~*   ~*.*   *.??~   chklist.*   mscreate.dir

For instance, the command:

del /q “C:EXAMPLE_PATH*.tmp”

deletes all files with a .tmp extension in the folder represented by EXAMPLE_PATH. The command wouldn’t affect files with other extensions in that folder.

As a final step, you can add the following command as the last line in your cleanup batch file:

cleanmgr /sagerun:99

This command invokes Windows’ built-in Disk Cleanup tool. It invokes the enhanced, deep-cleaning settings I described in my Mar. 13, 2008, column.

You can even use Task Scheduler to run your new, custom cleanup tool automatically. The Mar. 13 article includes information on using cleanmgr and the best ways to automate your cleanup tasks.

The del command is powerful, fast, and free. Using it, however, does mean you’re operating without the safety net of the Recycle Bin.

If you’re not comfortable with that, any of the dozens of commercially available cleanup tools may be a better choice for you. But if you work carefully and follow the safety steps outlined above, the technique of building one small, customized cleanup file can give you the power to clean loads of junk off your drive easily, quickly, and without extra cost.

This can make your system far more efficient than is possible using Windows’ cleaning tools alone. You may surprise yourself and find that you’ve recovered a gigabyte of formerly wasted space!

Fred Langa is editor-at-large of the Windows Secrets Newsletter. He was editor of Byte Magazine (1987 to 1991) and editorial director of CMP Media (1991 to 1996), overseeing Windows Magazine and others. He edited the LangaList e-mail newsletter from 1997 to 2006, when it merged with Windows Secrets.

Make a bootable thumb drive that runs XP

By Mark Edwards Some users benefit from having a bootable version of Linux on a USB flash drive — but did you know it’s possible to do the same with XP? This week, I’ll tell you how and explain a few challenges that stand in your way.

How to run a copy of XP from a flash drive

Windows Secrets associate editor Scott Dunn’s published an article on Mar. 20 with a very useful explanation of how you can carry an entire, bootable operating system in your pocket on a USB flash drive.

Scott listed several flavors of Linux that are designed to run from flash drives. I myself actually have a 4GB flash drive with a full-blown copy of Ubuntu 7.10, one of the most popular Linux distributions, installed.

It works great! The software runs much faster on a flash drive than on a bootable CD, and the thumb drive is defintely more convenient to carry around.

Scott also pointed out that you can install XP on a flash drive by using BartPE (Bart’s Preinstalled Environment). A writeup from Sept. 9, 2005, is available at the Tom’s Hardware site, if you’re curious. BartPE, however, has limitations as a solution.

I know of a better way to handle the problem. My approach lets you install a full-blown copy of XP. And, once installed, you can add your chosen applications to your flash drive. You might even be able to leave your laptop at home the next time you decide to travel.

To successfully install XP on a USB drive, you’ll definitely need a how-to guide. Emanuel Schleussinger’s Ngine Software site has exactly what you’re looking for.

You’ll also need a few tools. These include:

• A system with Windows already installed;
• A CD-ROM burning application that can create an .iso image file and extract files from that image;
• Microsoft’s CAB SDK; and, of course,
• A large (4GB or larger) USB 2.x flash drive.

Keep in mind that XP requires a minimum of 1.5GB of space by itself. This is why I recommend a flash drive that’s 4GB or larger.

The process of installing XP on a USB 2 drive is somewhat tedious. The basic process is to burn an .iso image file, extract a few files from the .iso image that contain system settings, and edit the settings. Then, you repack the edited files back into the .iso image file and burn the .iso to a CD-ROM.

When you complete that process, you’re ready to plug your USB2 flash drive into a PC, boot from the .iso image file, and install XP.

For detailed instructions, visit Schleussinger’s site. He took the time to put together a step-by-step guide that’s based on the research of many people.

There’s one major hurdle, which the guide explains how to overcome. During installation, XP treats all USB devices as read-only. Only after you’ve installed XP will the OS allow you to write to USB devices. The essence of the workaround is to edit XP’s installation setup files so XP can recognize USB drives as storage devices during the setup process.

There are also a couple of philosophical issues to consider when you use this approach.

The first is Microsoft’s licensing policy. I’m not sure whether it’s legal to put XP on a flash drive and then use that instance of XP on another computer. However, information at the BartPE site seems to indicate that you may be able to use a portable XP device on another computer, with the legality depending on your particular license.

The second issue is that running XP from a USB drive on a diferent computer than the one that created the drive might trigger a requirement for activation. If so, you’d have to contact Microsoft to request a new activation.

It’s important to keep those issues in mind before you decide whether to proceed.

SpyBot’s new RootAlyzer tool is a winner

A lot of you are using SpyBot Search & Destroy to help get rid of spyware. If you aren’t using it, I advise you to check this software out.

The software runs on all versions of Windows going back to Windows 95. It also runs on mobile phones that use either Symbian, Windows CE, or Windows Mobiles operating systems.

If you haven’t updated your SpyBot Search & Destroy software recently, you should do so. The developers released a new component called RootAlyzer, which “goes through the file system, the Registry, and process related lists” in an attempt to discover rootkits. You can get a quick overview of the tool at the SpyBot forums.

Agnitum’s Outpost AntiVirus Pro speeds scans

SpyBot isn’t the only company offering new security tools. Agnitum recently announced the availability of its new Outpost AntiVirus Pro.

The software has a few interesting features, including a technique for speeding up disk scans. It also features an automatic blacklisting feature, which prevents access to malicious sites.

Agnitum says that it’s partnered with Virus Busters, which provides the software’s technology for dealing with viruses, Trojans, and other forms of malware. Agnitum itself developed the technology for spyware, adware, and AntiVirus Pro‘s other forms of protection.

What particularly caught my attention is the unique pricing model. Unlike most other antivirus vendors, Agnitum decided to license the software using a flat annual subscription fee. Other vendors typically charge you for the software plus updates. Agnitum’s flat annual subscription fee includes both the software and any updates for one year. The vendor includes free email-based support.

For $19.95, you get the right to use the software on up to three computers. Alternately, you can pay $34.95 for a license that includes up to five computers.

Proogly bypasses Web content blockers

There are all sorts of Web-filtering solutions in use today. Some filter content on-the-fly to get rid of unwanted content, whereas others block entire sites.

Some software blocks access to sites such as YouTube, Yahoo Groups, or gambling hubs to prevent employees from wasting company time. Some companies aren’t very astute about what to block and end up keeping employees from useful work URLs, too.

I recently discovered Proogly at Proogly.com.

Proogly acts as a Web-based proxy. You enter your URL into a Web form, and Proogly then acts as a go-between to deliver the content to your browser.

The tool could also come in handy if you’re trying to use a public Wi-Fi hotspot at a local library or hotel, only to discover that the hotspot is restricting access to certain types of content. Proogly could be a good site to have bookmarked for all the occasions when you can’t access a site because of filtering restrictions.

On the other hand, if you’re in charge of managing content filters in your company, then you might want to add Proogly to your blocked lists. Employees might use the site to enable casual surfing.

Note: You should never enter passwords, credit-card numbers, or other sensitive information into Web forms using intermediate sites such as Proogly. You can’t be certain who is operating Proogly (and other, similar sites). You don’t know how they handle the data that must pass between you and the destination site you’re surfing. Don’t trust proxy sites with anything except harmless information, such as the URLs of free, nonfinancial sites you wish to visit.

Mark Joseph Edwards is a senior contributing editor of Windows IT Pro Magazine and regularly writes for its Security Matters blog. He’s a network engineer, freelance writer, and the author of Internet Security with Windows NT.

QuickTime, iTunes install Safari — like it or not

By Susan Bradley The auto-update routines for QuickTime and iTunes, two programs that play multimedia files, have quietly begun installing Apple’s Safari browser unless PC users are sharp enough to turn off a little-noticed option. This week’s abomination makes me question the entire concept of trusting auto-update mechanisms as a way of seeking better security.

Updater for media players adds unwanted payload

My tracking of patches started out this week with an abomination. The latest version of the update mechanism that keeps QuickTime and iTunes software current now sports an additional and non-germane payload. The updater wants to install Apple’s Web browser, Safari, which comes in versions for Mac and Windows.

You may be accustomed to auto-update mechanisms that try to promote optional software. MSN’s Instant Messenger installer, for example, graciously offers to change your home page to MSN.com. So why is Apple’s peccadillo particularly putrid?

It’s because the company is using its security update mechanism to push Safari, which is not a security upgrade.

I know that many users are resigned to vendors using security updates as a mechanism to distribute optional programs. Besides Microsoft, Sun Microsystems is doing this to promote its implementation of Java, and a gazillion other vendors are abusing their auto-install mechanisms, too.

Where QuickTime crossed my personal line was this kicker: Apple designed the installer specifically so that its default behavior is to install the new browser. A user who accepts the QuickTime update must explicitly opt out of getting the unrequested payload. (You must notice and uncheck a check box.)

The result is that many users who thought they were updating only a piece software that they already run (namely, iTunes or QuickTime or both), found that Safari had been installed in addition. This represents software they didn’t own and probably didn’t want.

When vendors such as Apple set up default behavior like this, they betray the trust of their customers. Apple’s method is piggy-backing a pile of cross-selling activity on top of a critical security-upgrade process that demands the utmost level of concentration.

My thanks to Microsoft Watch blogger Joe Wilcox, who provides additional information about the QuickTime and iTunes payload.

Figure 1. Apple tries to pull a fast one to get you to install Safari.

Apple isn’t the only vendor that’s taking advantage of users’ inherent trust of security update mechanisms. Even some sophisticated Windows Secrets readers are tentative about installing Microsoft’s Windows Genuine Toolbar update. These readers fear that the utility will accidentally brand their machine as “nongenuine,” triggering a host of hassles.

While I haven’t found widespread problems with patch 905474 and related updates to the much-maligned Windows Genuine Advantage (WGA) program, I don’t blame folks for being wary of the WGA validation utility.

Here’s my message to all vendors wondering whether they should ape Apple and Microsoft by using a security-update mechanism to distribute other products to the widest possible audience: don’t. Don’t abuse our trust in your software like this.

And while we’re arm-waving here… Hello, Microsoft, will you stop offering up the Silverlight download to every person who goes to your home page? This is another over-the-top marketing offense that’s become quite annoying to me.

We all understand software vendors’ need to gain customers. But hijacking the most sensitive and essential security-update processes is not ethical. It’s highly disrespectful of these vendors’ most important constituents — their customers.

Vista support policy relaxed; this link can help

I have a noteworthy revision to, and a clarification of, my Mar. 20 article on Vista Service Pack 1.

Here’s the revision: I’d mentioned that on OEM systems (PCs that ship with a Microsoft operating system preinstalled), you can seek tech support only from the OEM (the PC’s manufacturer). That’s the general case for Microsoft’s operating systems, but Vista SP1 is an exception.

Microsoft now states that it will provide free support until March 18, 2009 — directly from Redmond — for SP1 installation issues.

If you have problems, by all means take advantage of this offer. Start at the Vista SP1 support Web page. Begin by pressing the button labeled Start E-Mail Request to report an “incident.”

The clarification involves the problem I had with a Vista machine on which installing SP1 suddenly required a new activation. I explained on Mar. 20 that I was required to reactivate this computer because the SP1 upgrade installed a new hardware device driver. This is true, but the OS on my system is not typical. Many Vista installations that are more vanilla than mine won’t have to go through that extra hassle when SP1 is installed.

My system was a version of Vista that had been downgraded to XP using an included downgrade disc, then upgraded back to Vista. The operating system this PC is using is a retail Vista package. Retail builds of Vista are the versions of Windows that are the most likely to call for activation upon changes in hardware and hardware drivers.

Over the weekend, I updated an OEM version of Vista and I had a better experience. The SP1 installer in the OEM version recognized that the hardware on the system had changed after the PC had left the factory and maintained the activated state of the OS.

So the activation hassle I had on the first SP1 install was fairly predictable, because the service pack had indeed updated a hardware driver during the installation. If you’re installing SP1 on Vista while using a typical OEM system, you probably won’t be asked to activate Vista again.

Prepare for Windows XP SP3: it’s coming soon

The drumbeat of rumors is more insistent. It seems the release of Windows XP SP3 is imminent. My testing of this service pack has been uneventful. SP3 appears to be very stable.

Before you install any service pack, however, make sure you’ve backed up your key documents and data. I never start installing a service pack without first making sure that any data I care about has a backup stored separately from the machine.

Backup devices, such as external hard drives, are very cheap compared to the time and grief you’d have to shell out to repair a system that a service pack corrupted.

Missing drivers are stalling Vista SP1 deliveries

I have additional insights about the Vista SP1 experience that may be of use to you. I recently tested updating Vista to SP1 on a pair of laptops. Each update added to my insights about the process.

One test laptop is an HP Pavilion running Vista Home Premium. The Pavilion had a pair of drivers (one for audio, the other for video) that, if present, will block SP1 installation, according to KB article 948343. I checked to see whether the drivers on the Pavilion were the most current versions. They were. To test if there would still be installation issues on this laptop, I installed the service pack manually.

The results? I had no problems whatsoever. The execution took much more time, however, than when I installed SP1 using Microsoft Update. The manual install required about 90 minutes to download the standalone installer, in addition to the 20 minutes that were required to setup the service pack itself.

The second laptop I tested is a Dell running Vista Ultimate. The laptop uses a Sigma audio driver that Microsoft documents as one that will block the installation of SP1.

Rather than heading over to Dell’s Web site to search for a new driver, I’m allowing the laptop to operate without SP1. I want to find out how much time will pass before Microsoft’s auto-update process offers to install Service Pack 1. Neither Dell’s online updater nor Microsoft Update has offered the Dell laptop a new Sigma driver as of this writing.

I’ll keep you posted on when this laptop gets asked to update to SP1. If Windows Update is not pushing the service pack out to you, and you’re impatient, you may have a driver issue such as the one my Dell has. On the other hand, a driver may have nothing to do with it.

Microsoft vice president Mike Nash has stated that the company will pace the automatic distribution of Vista SP1 in the same way that SP2 for Windows XP was handled. This means the service pack will not be pushed out to everyone at once.

What if you really can’t wait to get SP1, though? If you’ve examined the list of problem drivers that I published in my Feb. 18 column — and if you’re confident that your machine has no drivers that Vista SP1 will find problematic — you could try the manual install scenario, as I did with my HP Pavilion. To do so, get the SP1 update file from the Microsoft Download Center.

The Patch Watch column reveals problems with patches for Windows and major Windows applications. Susan Bradley recently received an MVP (Most Valuable Professional) award from Microsoft for her knowledge in the areas of Small Business Server and network security. She’s also a partner in a California CPA firm.