|
|
|
|
Windows Secrets Newsletter • Issue 154 • 2008-05-22 • Circulation: over 275,000
|
|
Table of contents TOP STORY: XP SP3 triggers false positives in security apps KNOWN ISSUES: Readers offer more ways to keep XP fresh WACKY WEB WEEK: Mobile phones have come a long, long way BEST SOFTWARE: Top free tools for rooting out rootkit spies PC TUNE-UP: Testing the effectiveness of rootkit removers PATCH WATCH: HP recommends against installing Windows XP SP3 PERMALINKS: Send these links to your friends and co-workers YOUR SUBSCRIPTION: How to change your address or unsubscribe |
|
You're receiving only our free content. Use the following link to get all of our paid content immediately: How to get our paid content |
|
ADS
|
|
TOP STORY XP SP3 triggers false positives in security apps
SP3 causes some malware scanners to cry "wolf" Comments on a PC Tools forum confirm customer reports that the company's Spyware Doctor program generates a false positive on systems with Windows XP SP3. Similarly, at least one site claims that Symantec's Norton Internet Security software identifies a common system file as a keylogger. ReviewSaurus reports that XP SP3 causes Norton Internet Security to identify ctfmon.exe as a keylogger (a kind of malware that records your keystrokes to capture passwords and other important data). In reality, the ctfmon.exe file in your Windows\System32 folder is a Microsoft system file that enables alternative input methods such as speech, tablet, or on-screen keyboard. A spokesperson for Symantec was not immediately available for comment. In the case of Spyware Doctor, the popular antispyware tool from PC Tools detects Trojan-Spy.Pophot.WX in RunDLL32.exe even if the system is uninfected. RunDLL32.exe is a system file that Windows uses to run code in dynamic link library (DLL) files. The scan may also implicate other related system files, according to a report on the blog A Healthy Fear of Botulism. By default, Spyware Doctor prevents any files it identifies as infected from running. If an important system file such as RunDLL32.exe is flagged incorrectly, the result can be disastrous for your PC. For example, users may be blocked from opening Windows Control Panel or using System Restore, among other operations. One user who contacted us noted that blocking RunDLL32.exe created "an endless loop of scanning to remove the file, rebooting, finding the file again." "I've lost more than two days trying to fix something that was never broken," he adds. "As far as mistakes go, this is pretty major." Other Spyware Doctor customers just gave up: "I had the same problem today," reported Dave (screen name doz3r). "I got tired of fighting with it and just reinstalled the OS." For its part, PC Tools claims that a patch is in the works. "We are implementing a fix immediately," wrote Super Moderator Anthony Chen on the PC Tools forum. As of Wednesday evening, PC Tools has yet to make a fix available through the company's Smart Update feature. Until there's a fix, there's a workaround In the case of the Norton Internet Security, ReviewSaurus advises users to ignore the false warning about ctfmon.exe. Until a fix is available from PC Tools, Chen advises customers to add RunDLL32.exe to the global action list manually. The workaround consists of the following steps: Step 1. In the Spyware Doctor window, click the Settings button on the left. Step 2. Click Global Action List to the right of that. Step 3. At the bottom of the window, click Add. Step 4. In the New Rule dialog box, choose "File on disk" from the "Select data type" drop-down list. Step 5. To the right of the text box below, click the ... button to browse for a file. Locate and select RunDLL32.exe in the Windows\System32 folder. Step 6. Make sure "Always allow" is selected in the drop-down list at the bottom and click the Add button. Other XP SP3 compatibility problems may yet loom This is not the first problem created by Microsoft's latest (and last) service pack for Windows XP. Earlier this month, some HP PCs with an AMD processor experienced endless reboots after SP3 was installed. These and other issues are documented by Windows Secrets columnist Susan Bradley's Patch Watch column in the paid section of this week's newsletter, as well as in her May 15 column. Bradley also provides advice on preparing for SP3 in the paid section of the May 1 issue. If you are concerned about the effect the collection of patches that comprise XP SP3 will have on your PCs, wait a while before downloading and installing the service pack. Check the support sites of the vendors of your most important products for news of compatibility issues with SP3. As the problems experienced by users of these anti-malware programs show, a collection of patches as large as SP3 may require some patches of its own.
Scott Dunn is associate editor of the Windows Secrets Newsletter. He has been a contributing editor of PC World since 1992 and currently writes for the Here's How section of that magazine. |
|
ADS
|
|
KNOWN ISSUES Readers offer more ways to keep XP fresh
Reports of XP's demise are greatly exaggerated Last week's Top Story by Scott Dunn on keeping XP fresh until Vista's successor is released was one of the most popular articles the newsletter has ever published. Clearly, a great number of Windows users see no need to trade in XP for Vista. Responding to Scott's request, several readers offered their own techniques for teaching the old OS new tricks. David M. Deitz points out that you can empty XP's temp folder for all users by replacing the login name. "On Rule 7, 'Clear the clutter from XP's many cubbyholes,' " he writes, "the batch file could be more generic by using the userprofile variable." This would look as follows: del /s /q "%userprofile%\Local Settings\Temp\*.*" Windows substitutes the userprofile variable with the actual location of information for all users of a machine. The quotation marks in the command are required because the command line includes a space. The freeware cleanup alternative Several readers echoed Ezra Riner's recommendation for a free cleanup utility.
Scott recommended several online-storage services that offer as much as 2MB of space for your files for free. Hitman Howler wrote in to tell us about two services that trump those offerings.
Know of any other ways to get more use out of XP (or Vista, for that matter)? We'd love to hear about them via the Windows Secrets contact page.
The Known Issues column brings you readers' comments on our recent articles. Dennis O'Reilly is technical editor of WindowsSecrets.com. |
|
ADS
|
|
EDITOR'S BOOKSHELF
|
|
WACKY WEB WEEK Mobile phones have come a long, long way
|
|
PERMALINKS The following topics appear in the free version
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
YOUR SUBSCRIPTION The Windows Secrets Newsletter is published weekly on the 1st through 4th Thursdays of each month, plus occasional news updates. We skip an issue on the 5th Thursday of any month, the week of Thanksgiving, and the last two weeks of August and December. Publisher: WindowsSecrets.com LLC, Attn: #120 Editor, 1700 7th Ave., Suite 116, Seattle, WA 98101-1323 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine). Editorial Director: Brian Livingston. Associate Editor: Scott Dunn. Technical Editor: Dennis O'Reilly. Contributing Editors: Susan Bradley, Mark Joseph Edwards, Woody Leonhard, Ryan Russell, Scott Spanbauer. Research Director: Vickie Stevens. Program Director: Brent Scheffler. Program Manager: Tony Johnston. Editorial Assistant: Raef Harrison. Copyeditor: Roberta Scholz. Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, LangaList, LangaList Plus, WinFind, Security Baseline, Patch Watch, Perimeter Scan, Wacky Web Week, the Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of WindowsSecrets.com LLC. All other marks are the trademarks or service marks of their respective owners. HOW TO SUBSCRIBE: Anyone may subscribe to this newsletter by visiting our free signup page. WE GUARANTEE YOUR PRIVACY: 1. We will never sell, rent, or give away your address to any outside party, ever. 2. We will never send you any unrequested e-mail, besides newsletter updates. 3. All unsubscribe requests are honored immediately, period. Privacy policy HOW TO UNSUBSCRIBE: To unsubscribe from the Windows Secrets Newsletter,
|
