|
|
|
|
Windows Secrets Newsletter • Issue 121 • 2007-09-06 • Circulation: over 270,000 |
|
Contents TOP STORY: Unpatched software abounds on user systems KNOWN ISSUES: How to fix problems Software Inspector finds WACKY WEB WEEK: Danish engineers find low-tech speed limit fix PERIMETER SCAN: Sony renews rootkit debate with USB drives PATCH WATCH: MS server error marks PCs as "nongenuine" YOUR SUBSCRIPTION: How to change your address or unsubscribe |
|
For links to every topic in this issue, scroll down to the
Index |
|
ADS
|
|
TOP STORY Unpatched software abounds on user systems
Software Inspector finds many unpatched apps After we recommended that our readers use Secunia.com's Software Inspector, the link we provided was clicked more than 63,000 times. The service scans PCs for applications that lack available security patches. Secunia.com provides us with aggregate counts of the number of products installed and the percentage that are unpatched. No personal information is collected. Table 1, below, shows the top 20 unpatched applications installed on the systems of Windows Secrets readers. (Several readers ran the scan more than once, which is why some apps show up more than 63,000 times.) The figures reveal that many people haven't patched their media players and other run-time software: Java, Flash, QuickTime, Adobe Reader, and RealPlayer. This exposes you to infected media files. I'll explain below how you can keep these apps patched and your computer safer. Table 1. Unpatched products on Windows Secrets readers' systems.
How to keep your system up to date Reducing security risks on your system means keeping all of your applications up to date, not just the operating system. To do that, you need a two-pronged approach. First, if you're not using Windows' Automatic Updates feature, run Microsoft Update once a month after Patch Tuesday (the second Tuesday of each month, when Microsoft releases security updates). If possible, install Microsoft's patches after you read the Windows Secrets Newsletter on the Thursday after Patch Tuesday. We may report glitches you should avoid, while still ensuring that you can install the latest Microsoft Windows and Office security updates within two days of their release. Second, consider turning on the auto-update feature of your individual applications to make sure they're updated regularly. See my Aug. 16 story for details on how to do this. Understandably, many people (particularly in companies with thousands of users) don't want auto-updating turned on for every user. Companies often prefer to test individual updates before everyone in the organization adopts them. If you prefer this more cautious approach, use the Secunia Software Inspector once a month to tell you what applications have patches available. Then update the individual applications manually (after running your usual research-and-test regimen). Enterprises can run Secunia's Network Software Inspector, a commercial application that has recently emerged from beta testing. The program reportedly scans PCs for more than 4,000 applications and versions. For information on removing out-of-date software, see this week's installment of Known Issues. Get an automatic reminder to check for updates The biggest challenge in manually checking for reminders is remembering to do it on a regular basis. Fortunately, Windows' Scheduled Tasks accessory can help out. How to schedule an update reminder in Windows XP You can make Scheduled Tasks run a script that launches Internet Explorer 7 with Microsoft Update in one tab and Secunia Software Inspector in another. I use IE 7 in this example because Microsoft Update won't run in most other browsers, such as Mozilla Firefox. The technique shown below is adapted from a Windows Scripting Host script published by Tony Schreiner in his MSDN blog. Step 1. Open your favorite text editor, such as Notepad. Type or paste in the following five lines: var navOpenInBackgroundTab = 0x1000; var oIE = new ActiveXObject("InternetExplorer.Application"); oIE.Navigate2("http://update.microsoft.com"); oIE.Navigate2("http://secunia.com/software_inspector/", navOpenInBackgroundTab); oIE.Visible = true; Step 2: Save the file with a .js extension. For example, I named mine Update-me.js. Step 3: Choose Start, All Programs, Accessories, System Tools, Scheduled Tasks. Step 4: In the Scheduled Tasks window, double-click Add Scheduled Task. Step 5: In the Scheduled Task Wizard, click Next. Then click Browse. Step 6: Locate and select Wscript.exe in Windows' System32 folder. (Or just type c:\Windows\System32\Wscript.exe in the File name box; your path may differ.) Click Open. Step 7: In the next step of the wizard, select Monthly and click Next. Step 8: Specify a start time. Select the second radio button and specify the second Tuesday. Leave all months checked. Click Next. Step 9: Enter your account name and password for an administrator account. (Only administrators can install updates.) Click Next. Step 10: Check the box for opening advanced properties and click Finish. Step 11: When the Wscript Properties dialog box opens, click at the end of the line in the Run box. Type a space followed by the path to your script (.js) file. If the path includes spaces or long names, put it in quotation marks. For example, when you're done, the finished command should read something like this: c:\windows\system32\wscript.exe "C:\My Documents\update-me.js" Step 12: Click OK. Enter your account name and password again, if prompted. Click OK. As long as you are logged in as an administrator on the appropriate day, Scheduled Tasks will open a browser with these two sites, reminding you of this important chore. How to schedule an update reminder in Windows Vista The Microsoft Update site in Vista has been replaced by a Control Panel applet. To automate the reminder in Vista, you'll need to set up two automated processes: one for patching Windows, and another for launching a browser showing the Secunia Software Inspector. Follow these steps to run Windows Update once a month after Patch Tuesday: Step 1: Choose Start, type Task Scheduler, and press Enter. Click to confirm User Account Control. Step 2: In the far right pane, click Create Basic Task. Step 3: In the Create Basic Task Wizard, type the name of your task and (optionally) a description. Click Next. Step 4: Select Monthly and click Next. Step 5: Specify a start date. For Months, choose Select All Months in the pop-up menu. Click On and specify the Second Tuesday. Click Next. Step 6: Leave Start a program selected and click Next. Step 7: For Program/script, type c:\Windows\System32\Wuapp.exe (your path may differ). Step 8: Click Next and then click Finish. Follow these steps to run Software Inspector once a month after Patch Tuesday: Step 1: Follow steps 1 through 6 above but specify a different task name in Step 3. Step 2: For Program/script, specify the path to your preferred Web browser. In the Add arguments (optional) box, type http://secunia.com/software_inspector/. Step 3: Click Next and then click Finish. Windows will launch these tasks on the appropriate day, reminding you to proceed with your checks. Protecting your system involves many tools, including antimalware tools and regular system updates. By adding Secunia Software Inspector to your toolbox, you can help ensure that your major add-ins are patched in addition to Windows. Scott Dunn is associate editor of the Windows Secrets Newsletter. He is also a contributing editor of PC World Magazine, where he has written a monthly column since 1992, and co-author of 101 Windows Tips & Tricks (Peachpit) with Jesse Berst and Charles Bermant. |
|
ADS
|
|
KNOWN ISSUES How to fix problems Software Inspector finds By Scott Dunn In the Aug. 16 issue, I pointed out that the Secunia Software Inspector may find multiple versions of unpatched products on your system. Older programs and Web sites may need the older versions of run-time software. But the old run-time code represents a security risk. For the greatest safety, uninstall the older files and then install updated software. Removing outdated versions of risky applications A number of readers seemed flummoxed by this situation. Chris Vetter gives us his take:
When you're ready to remove the software, open the Control Panel and double-click Add or Remove Programs. In the case of Java, an entry for each version normally appears in the Add or Remove Programs list. Select the version you don't want, click Remove, and follow any other prompts you see on screen. Repeat for each outdated version. Note that not all versions have the same name. For example, the name of some entries for Java begin with "Java," some begin with "J2SE," and so on. So scan the list carefully to find the version you want to remove. If the software you want to remove does not appear in the Add or Remove Programs list, you can always delete the outdated file or files listed in the Secunia report. This may not completely uninstall the product (for example, any Registry entries will be unaffected), but at least you will have removed the files that hackers need to cause harm. For help on removing older versions of Flash Player, see the next section. Ferreting out old versions of Flash Player Many readers of the Aug. 16 story on Secunia Software Inspector had the same question as Gordon Pinkham:
If that doesn't work for you, Adobe's support team has published a TechNote explaining how to manually remove Flash Players version 6 and earlier from your computer. Just follow the steps at the link. Update Checker points to newest versions Reader Tom Kustner points out another tool that checks your software for updates:
As Tom points out, the results page for Update Checker includes a download button for each. But a newer version is not always desirable in these cases — for example, when a product changes from freeware in one version to shareware in another. If you use Update Checker, look into the tradeoffs before you upgrade. NetChk expiration forces a shift in tactics In the July 13, 2006, issue, editorial director Brian Livingston recommended Shavlik Technologies' NetChk Protect. He described it as a way for experienced Windows users to avoid installing Microsoft's WGA (Windows Genuine Advantage) utility. As reader Jon Bondy reminds us, NetChk Protect was free for users on up to 10 PCs for one year:
For now, we recommend novices use Microsoft Update, which is an improvement over the built-in Windows Update. Change its setting to Notify me but don't automatically download or install them. Then keep reading Windows Secrets to learn which updates it may be inadvisable to install. Advanced users who want a separate patch management system can check out the options listed on the Security Baseline page of the Windows Secrets Web site. Don't lose those Office shortcuts In the Aug. 16 issue, I explained how to create shortcuts to Microsoft Office applications with the PsExec utility. Office's default Start menu shortcuts do not have editable command lines. But reader Robin Penny points out an advantage of these installer-created shortcuts:
Readers Vetter, Pinkham, Hart, Kustner, Bondy, and Penny will each receive a gift certificate for a book, CD, or DVD of their choice for sending tips we printed. Send us your tips via the Windows Secrets contact page. |
|
ADS
|
|
EDITOR'S BOOKSHELF
|
|
WACKY WEB WEEK Danish engineers find low-tech speed limit fix
|
|
YOUR SUBSCRIPTION The Windows Secrets Newsletter is published weekly on the 1st through 4th Thursdays of each month, plus occasional news updates. We skip an issue on the 5th Thursday of any month, plus the week of Thanksgiving and the last two weeks of August and December. Publisher: WindowsSecrets.com LLC, Attn: #120 Editor, 1700 7th Ave., Suite 116, Seattle, WA 98101-1323 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine). Editorial Director: Brian Livingston. Editor-at-Large: Fred Langa. Associate Editor: Scott Dunn. Contributing Editors: Susan Bradley, Mark Edwards, Woody Leonhard, Chris Mosby, Ryan Russell. Research Director: Vickie Stevens. Program Director: Brent Scheffler. Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, LangaList, LangaList Plus, WinFind, Security Baseline, Patch Watch, Perimeter Scan, Wacky Web Week, the Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of WindowsSecrets.com LLC. All other marks are the trademarks or service marks of their respective owners. HOW TO SUBSCRIBE: Anyone may subscribe to this newsletter by visiting our free signup page. WE GUARANTEE YOUR PRIVACY: 1. We will never sell, rent, or give away your address to any outside party, ever. 2. We will never send you any unrequested e-mail, besides newsletter updates. 3. All unsubscribe requests are honored immediately, period. Privacy policy HOW TO UNSUBSCRIBE: To unsubscribe from the Windows Secrets Newsletter,
|
