Why is your PC so slow? In just minutes, find out why your PC is so slow. Run the free PC Pitstop Optimize 2.0 scan and receive a free custom report detailing common issues that might be keeping your PC from running at top speed. Over 100 million scans run. Scan for free now! PC Pitstop

Optimize your PC by updating your BIOS Are you looking to improve the performance of your PC? BIOSAgentPlus is a free utility that scans your PC and matches the correct Phoenix or AMI BIOS update and finds the exact driver updates for your desktop or laptop. Scan today for a free report. BIOSAgentPlus

See your ad here

By Mark Joseph Edwards

The free SiteAdvisor browser add-in claims to protect you by labeling Web sites green, yellow, or red to indicate that they are safe, questionable, or dangerous.

But a good or bad SiteAdvisor rating can persist for as long as a year after the site's content has changed, raising serious questions about the service's usefulness.

SiteAdvisor was initially launched as an independent, free service in April 2005 by Massachusetts Institute of Technology developers led by CEO Chris Dixon. The company built software to automatically crawl the Web and find sites containing virus-infected downloads and hyperlinks to suspicious addresses. Security giant McAfee Inc. acquired the company in April 2006, at which point the SiteAdvisor team said it had rated some 2.7 million pages, representing a majority of Web traffic.

Ratings from SiteAdvisor's browser plug-in and its associated Web site, SiteAdvisor.com, are based on a variety of measures. Besides scanning sites for malware, the service enters customized e-mail addresses into registration forms to see whether this generates spammy e-mails.

The outcomes of these and other tests are used by SiteAdvisor to give a green rating to sites that score well and red ratings to destinations considered dangerous. Browser plug-ins are available for Internet Explorer and Firefox. Besides showing a rating for sites that a user visits, the plug-in also displays its color-coded symbols next to the links that appear in search engines such as Google, Yahoo, and MSN.

Unfortunately, I've found that SiteAdvisor's ratings can persist for as long as one year after a site has been analyzed by its automated Web crawls. If a legitimate Web site falls victim to a false "red" rating, McAfee's official policy is that months can elapse before a site is evaluated again. Conversely, if bad guys create a clean site that initially wins a green rating, and then immediately start offering infected games or other downloads, it might take SiteAdvisor months to notice.

McAfee certifies for a fee, but it's no guarantee

At the time of its acquisition of SiteAdvisor, McAfee was widely expected to integrate the service into the corporation's line of commercial products. McAfee soon announced SiteAdvisor Plus, a $24.99 download that added e-mail checking and other features.

Ratings such as SiteAdvisor's can be helpful, but according to its own documents, McAfee allows up to 365 days between tests of individual sites, even if a Web site owner protests that a "red" rating is a false positive.

McAfee promotes a paid service to ensure that a site will be scanned for security threats on a daily basis. The site's owner must pay a fee for "McAfee SECURE certification," as described at the McAfeeSecure site.

For the smallest sites, SECURE certification costs $859 annually plus a $100 setup fee. If a site gets more than 2,000 page views per day — a tiny number for any serious e-commerce destination — the price rises. McAfee measures traffic by inserting a bit of HTML into the site's pages.

After a site ponies up the cash, a security audit is performed, according to a description by McAfee. This audit (formerly known as McAfee HackerSafe certification) has long been criticized as permitting critical Web vulnerabilities, as outlined in a recent analysis by security researcher Mike Bailey.

Even paying for and passing SECURE certification, however, doesn't guarantee that a site with a false rating in SiteAdvisor will get the red flag corrected immediately.

In a telephone interview, McAfee research analyst Shane Keats explained that SECURE certification will fail — even if a site passes all the SECURE security tests — if SiteAdvisor rates the site as "red." In that case, he said, the site owner must wait for a period of time that's specified in SiteAdvisor's Site Rating Escalation Process (a PDF document).

I detail the waiting periods below, but an example will illustrate the procedure. The document says sites that request a re-evaluation are "subject to a rigid aging, or expiration, policy." Something judged to be a Web exploit may be "aged out" in 30 to 365 days, e-mails that are considered spammy in 60 to 270 days, and so forth.

According to Keats, SiteAdvisor uses SpamAssassin, an automated scoring application, on messages that the service receives after its crawler signs up for a list. If SpamAssassin rated a site's once-a-day e-mails as spammy, but they weren't and the site owner protested, is it true that the site wouldn't be tested again for 60 to 270 days? "That's correct," Keats said.

"The retest can happen tomorrow, quote unquote, whether it's 24 hours or 4 days, for persistent site owners, particularly someone who says this is a inadvertent mistake," Keats added. "But the probationary period is no different for a McAfee SECURE customer or a non-McAfee SECURE customer."

McAfee doesn't say how often the average site is scanned. "We've made a public decision not to tell how often we test sites," Keats said.

The lack of a quick and easy retesting policy is hard to defend. Legitimate Web sites that erroneously receive "red" ratings might try to pay for SECURE certification to clear their names. But they could bear a scarlet letter for months before being rescanned and receiving a "green" SiteAdvisor rating. While waiting, their site couldn't display the McAfee SECURE logo, because the certification would fail no matter how clean the site actually is.

Meanwhile, sites that initially garner a "green" rating but later go bad have no incentive to pay to be scanned — they can be labeled "good" indefinitely.

Ratings unchanged for 6 weeks, 6 months, or more

I called McAfee's sales staff, posing as an ordinary Web site owner. My main question was: "If you rate my site green, and tomorrow it gets hacked and a lot of malicious stuff is put on it, how long will it be before you change the rating to red?" The answer I received was "about six weeks." That's a long time before a hacked site might be detected. But even that period is not the real story in many cases.

Web site designer Scott Thompson discovered this first-hand after his HometownZone.com site, known as Webster Weather, received its first SiteAdvisor rating in March 2008. At that time, the site justifiably earned a green icon. Six months later, however, Scott completely changed the site, to the extent that only its domain name remained the same.

SiteAdvisor today still shows links that existed only in the old design, according to Thompson. (See Figure 1.) Some of the links SiteAdvisor currently shows as being on the site had been removed even before the redesign.


Figure 1. SiteAdvisor shows that HometownZone.com has several links to sites rated green, but the site removed those links long ago and McAfee hasn't updated its rating for months.

As of this week, SiteAdvisor still thinks the old links are there. The McAfee service doesn't currently show the actual links on the site. These, of course, are what SiteAdvisor users assume are being evaluated to determine whether the site deserves a green rating.

Site re-evaluations can be agonizingly slow

According to McAfee's Site Rating Escalation Process, SiteAdvisor "ages" its scanning criteria at the following intervals for individual sites that request a re-evaluation:

• Annoyances: every 10 to 270 days
  
• Downloads: every 10 to 365 days
  
• E-commerce: every 30 to 365 days
  
• E-mail: every 60 to 270 days
  
• Exploits: every 30 to 365 days
  
• Links: every 10 to 270 days
  

Table of contents

Free CompTIA A+ exam preparation For a limited time, ExamForce is offering Windows Secrets readers a free download of our popular CompTIA A+ exam prep. Includes both the CompTIA A+ Essentials and CompTIA A+ IT Technician. Hundreds of questions, answers, and detailed explanations. ExamForce CramMaster for CompTIA

Save up to 76% on quality inkjet ink We offer the sharpest prices on the Web for quality ink and laser toner. Bonus: save an extra 10% by using coupon code JJ997H. Free shipping to contiguous U.S. locations for all orders over $50. Offer expires 2/28/2009 and excludes OEM items. 4InkJets

See your ad here

By Dennis O'Reilly Last week's Top Story on CNN.com prompting visitors to install an application named Octoshape application hit home with many readers who had been stung by the program. The backlash is directed at the sneaky nature of the Octoshape installation rather than against P2P technology, which can benefit users and providers alike when correctly implemented.

• "Thanks for the great article on Octoshape. I became aware that something was running but was not able to discover what app was the culprit 'til your article on CNN's adding of Octoshape for the live stream on Jan 20.
  
  "I watch CNN for a number of reasons and never felt the need to be concerned about what they might add to my system. You have opened my eyes to the methods that can be used to compromise an individual PC. Great article. This is the type of article I keep an eye out for when I get your newsletter."
  

• "I read [last week's Top Story] with some interest. Over this side of the pond, I've been using the British Broadcasting Corporation's iPlayer (making much of their extensive produced-for-TV content across all their channels) since mid-2007. As one would tend to expect, their approach was from the beginning peer-to-peer based using Kontiki, but this was relatively clearly explained before signing up and could be easily opted out of at setup or any time later.
  
  "The opportunity of swift availability of the latest episodes and the openness about the P2P nature meant that I often felt happy to be a good citizen and help other users, as they helped me — I could see all the connected machines in the TCP list supplying me on [Sysinternals'] Process Explorer. (Thanks, Windows Secrets!)
  
  "Interestingly, although many U.K. ISPs run capacity-restricted packages, the main backlash was not about P2P, but from the ISPs about capacity and from users about DRM [digital rights management]. So the latest versions of the BBC iPlayer turn their back on P2P and also offer multiple platforms for on-demand or for download. Over here, we think the BBC has responded creatively as a public service provider in the face of sniping from the Rupert Murdoch–owned media channels.
  
  "This [BBC] blog entry provides some background on the new changes, avoiding Octoshape-type issues experienced with Kontiki."
  

• "A few years ago, I came back from a month away to find my HD making odd noises. I figured that the pivot or the bearings had gotten stuck somehow. I also thought that cooling might shrink the clogged pivot and the thing might rotate long enough for me to save the data.
  
  "I took the HD out of the desktop computer, wrapped it with a few layers of polyethylene, and let it freeze for 24 hours in the deep freezer. I then removed only the interface side and immediately connected it to the computer. It worked for three years after the cold shock.
  
  "I left the polyethylene wrapping on the HD for a few hours until any condensation risk was eliminated. Since then, I've done it two more times when called to rescue friends' failing HDs. It worked OK once and didn't help the other time. I believe that this is much less risky than butane."

Table of contents

By Katy Abby TV news anchors have a pretty tough gig: delivering the news with a poker face. Whether it means masking their anxiety during a grisly economic report or suppressing a smirk while dishing on Christian Bale's latest freak-out, they've got to remain cool and collected. But what happens when the cameras stop rolling? Take a look at these Chicago co-anchors, who've got their decompression system down to an art form. You may never look at Wolf Blitzer or Katie Couric the same way again! Play the video

Table of contents

Are your computer's drivers up-to-date? Driver Detective provides the most up-to-date drivers specific to your computer! With more than 1 million drivers, Driver Detective saves you endless hours of work and aggravation normally associated with updating drivers. Drivers HeadQuarters

Get your message seen by 400,000 readers Does your company offer a product or service? Now you can place an ad in the Windows Secrets Newsletter and be seen by more than 400,000 active buyers of PC hardware and software. Bid as much or as little as you like to get the ideal ad placement. Windows Secrets Newsletter

See your ad here

TOP STORY By Mark Joseph Edwards SiteAdvisor ratings may be 1 year out-of-date McAfee certifies for a fee, but it's no guarantee Ratings unchanged for 6 weeks, 6 months, or more Site re-evaluations can be agonizingly slow KNOWN ISSUES By Dennis O'Reilly CNN.com's use of Octoshape puts readers on edge To unstick a disc, a deep freeze beats butane Update: Microsoft does a U-turn on Win7 UAC WACKY WEB WEEK By Katy Abby More fun than reporting on stock-market carnage

	LANGALIST PLUS By Fred Langa Recover lost disk space by dumping dump files Error files leave you down in the UserDumps ReadyBoost is neither ready nor boosting Are leftover Windows Installer files necessary? Retrieve a lost product key for Windows XP
	BEST SOFTWARE By Ian "Gizmo" Richards What you should do about Windows Vista Making sense of the big Vista muddle Taking a second close look at Vista Vista's interface has big edge over outdated XP XP retains the compatibility edge over Vista Where does Windows 7 fit into the picture? Answers to frequently asked Vista questions
	PATCH WATCH By Susan Bradley Critical update for Internet Explorer 7 and 8 Protect IE against drive-by Web infections Time to kill off a few more ActiveX bits Take a bite out of spammers' botnet armies More problems discovered with .NET updates Mail servers need protection from DoS threat SQL database gets a long-overdue patch Diagram your way to this fix for Visio

There's no fixed fee! Contribute whatever it's worth to you Readers who make a financial contribution of any amount by Feb. 18, 2009, will immediately receive the latest issue of our full, paid newsletter and 12 months of new paid content. Pay as much or as little as you like — we want as many people as possible to have this information.

A portion of your support helps children in developing countries Each month, we send a full year of sponsorship to a different child. Your contributions in February are helping us to sponsor Archana, an 8-year-old girl from a village in Nepal. Save the Children channels development aid from donors to Archana and her community. We also sponsor kids through Plan USA and other respected agencies. More info

More info on how to upgrade

Table of contents

• Visit our Unsubscribe page.
  

Table of contents