|
|
|
Windows Secrets Newsletter • Issue 204 • 2009-07-02 • Circulation: over 400,000 |
|
BONUS DOWNLOAD
|
|
Table of contents TOP STORY: It's confirmed: Windows may update unexpectedly KNOWN ISSUES: Forced updates plague Windows users worldwide PATCH WATCH: Fake e-mails to patch Outlook lead to malware WACKY WEB WEEK: The cure for the office cheerleader is here! LANGALIST PLUS: Test-drive Windows 7 in a virtual machine BEST SOFTWARE: Efficiently organize your portable applications WOODY'S WINDOWS: Avoid early Windows 7 upgrade surprises |
|
ADS
|
|
TOP STORY It's confirmed: Windows may update unexpectedly
By
Scott Spanbauer
Dozens of Windows Secrets readers confirm that Windows sometimes installs updates without displaying a list of patches that a user can accept or decline. If Automatic Updates were set to install patches without user intervention, no notice would be expected, but a bug appears to be installing patches upon shutdown in certain cases, even though Windows is configured to require user approval. In my June 25 Top Story, I reported that several Windows Secrets readers and editors had experienced a disturbing problem involving Automatic Updates (AU). Users who had configured AU to prompt them before downloading or installing updates found that Windows installed updates at the next shutdown without notification, review, or approval. The day after the story appeared, the Microsoft Update blog tacitly acknowledged the problem in a blog post. The comment said the company was "investigating the reports and trying to clarify with the community exactly what people are experiencing." The blog post went on to describe the behavior that should be expected when users select option 2 or 3 of AU's four alternatives:
As I reported last week, Knowledge Base article 910340, last revised on Dec. 5, 2007, confirms that notification to users may fail if a patch was partially downloaded but interrupted before the download was completed. Incomplete downloads can occur when Microsoft publishes several updates at once and the company "throttles" its bandwidth to prevent server overload. This happened on June 9, Microsoft's regular Patch Tuesday, when 10 major security bulletins were released. The throttling of updates from Microsoft's servers can cause some updates to be downloaded but others to be postponed. In such instances, the notification icon may not appear as expected because Windows waits until all pending updates are downloaded before showing a notification icon. Unfortunately, when a user shuts down an affected PC before all updates have downloaded, other updates may be installed with no opportunity to review and select them. In this situation, the only way a user can review the updates before installing them is to cancel the shutdown, open Microsoft Update or Windows Update manually, and select View available updates in Vista or Custom in XP. (Note that in XP, this feature requires Windows Genuine Advantage, so if you want to keep WGA off your system, you must use a third-party update service, as described below.) Microsoft calls this behavior a "feature," but as WS contributing editor Susan Bradley puts it, "This is a bug, sir." Since the problem involves patch downloads, you'd think that people who select option 3 — notify but do not download or install — would be immune to the surprise installs. However, several readers who chose option 3 report that Windows updates were downloaded and installed automatically anyway. They consider themselves to be victims of forced updates, perhaps more so than users who downloaded everything (option 2) but received no notice prior to installation. Forced updates can result in headaches Last week's story struck a nerve with Windows Secrets readers. Scores of you wrote in to say that you had experienced the same issue, and not just on an extra-large Patch Tuesday such as June 9. According to dozens of Windows XP and Vista users, the problem has been happening for months. (See this week's Known Issues column for more reader comments on the bug.) The overwhelming majority of readers I heard from report the exact behavior that Microsoft describes in KB 910340: when downloads are being throttled by the Redmond company, "The Automatic Updates icon does not display the status of downloads that are in progress." That bland statement fails to adequately describe a flaw that has a profound impact on many Windows users. As many readers note from personal experience, updates can sometimes disable software or hardware on production systems. Hours of work can be required to restore these machines to full functionality. Even if every patch is wanted, the unexpected installation of updates without notice can surprise you precisely when you really need your PC to shut down or reboot in a hurry. A handful of readers reported more disturbing Automatic Updates bugginess. The expected behavior is that Windows' shutdown icon and shutdown dialog box should show that updates will be installed when the system is powered down or rebooted. Seeing no such notice, many readers who had selected Automatic Updates' option 2 had no reason to think updates would be installed. After clicking the shutdown icon on the Start menu, however, these users found that updates were being installed unexpectedly. Several readers who'd selected option 3 (notify but do not download) found updates being installed when they shut down their systems, with no notice that any patches were even available for download. Some readers who had deselected one or more updates — indicating that these updates should not be applied — reported that Windows installed the updates at the next shutdown anyway. Finally, many readers who selected a menu option to "shut down without installing updates" found that updates were installed despite their wishes. (Some readers reported that they'd originally selected AU option 2 or 3, but their systems had somehow been changed to option 1 so AU would download and install updates automatically. This can be caused by such programs as Microsoft Live OneCare and Norton Internet Security, as described by WS contributing editor Scott Dunn on Oct. 25, 2007, and editorial director Brian Livingston on May 25, 2006.) Microsoft isn't saying exactly what's going on Last week's column stated that the large number of patches released on June 9 could have triggered the forced-update behavior. It's still not certain precisely why update notifications are failing to appear in Windows systems around the world. But this much is clear: the phenomenon has definitely occurred both before and after June 9. One workaround to prevent surprise downloads was recommended last week: every time you plan to shut down or reboot a PC, first run Microsoft Update (a superset of Windows Update) and select each patch you wish to install or not install. This should download and apply whatever you selected, leaving no files to be installed without notice. For some Windows users, however, their machines must be protected against any changes before each new patch is researched for side-effects. These extra-cautious users are disabling Automatic Updates entirely and then running Microsoft Update or a third-party update service manually, as often as needed. Disabling AU causes an irritating red warning to be displayed repeatedly. If shutting off AU appeals to you, the right way to implement it (and avoid the constant nagging) is as follows:
See the Windows Secrets Security Baseline and Susan Bradley's May 28 Top Story for more on third-party Windows update services. Although the precise workings of the bug are still unclear, it's obvious that AU is downloading and installing some updates without the required notification. Even when a user manually runs a download tool before a shutdown occurs, it's been reported to me that, in rare instances, even this failed to prevent an unwanted update from being installed. Readers who have further information on this bug should submit it via the Windows Secrets contact page. Scott Spanbauer writes frequently for PC World, Business 2.0, CIO, Forbes ASAP, and Fortune Small Business. He has contributed to several books and was technical reviewer of Jim Aspinwall's PC Hacks. |
|
ADS
|
|
KNOWN ISSUES Forced updates plague Windows users worldwide
By
Dennis O'Reilly
The response to Scott Spanbauer's June 25 Top Story on forced updates makes it clear that a bug in Microsoft's Automatic Updates service is causing serious problems for Windows users. Many readers have reported seeing updates being installed at shutdown or reboot time without any notification, much less an opportunity to select which updates will or will not be applied. Several dozen WS subscribers have confirmed the Automatic Updates (AU) behavior that Scott described. In today's Top Story, many of his sources report that their shutdown options gave no indication that updates were about to be installed. Also, some WS readers who had configured Automatic Updates to "download only" or "notify only" indicate that AU mysteriously changed to "install updates automatically" against their wishes. While we await Microsoft's explanation for this aberrant AU behavior, many tech news sources have picked up Scott's original story and corroborated the forced updates. The day the story appeared in Windows Secrets, news aggregator Techmeme featured it, in addition to coverage in ITWorld, PCMag.com's Security Watch, and ZDNet's Hardware 2.0 blog, among others. ZDNet writer Adrian Kingsley-Hughes was one observer who'd previously encountered the problem, although he didn't feel at the time that he had enough evidence to go public:
Storm brewing over unexpected update behavior The most-common example of the AU bug — patches being installed without warning at Windows shutdown — can cause serious problems, as Tom King found out earlier this month:
More evidence of behind-the-scenes AU changes The people who have the most experience with unexpected AU behavior are those who fix PCs for a living. Ed West of Ed's ComputerWorks is one such person:
Melodie Larsen used information she'd read in previous WS newsletters to sleuth the source of her recent hardware woes:
Here's hoping Microsoft permanently corrects AU's forced-install bug soon.
The Known Issues column brings you readers' comments on our recent articles. Dennis O'Reilly is technical editor of WindowsSecrets.com. |
|
PATCH WATCH Fake e-mails to patch Outlook lead to malware
By
Susan BradleyAll Windows users need to be aware that Microsoft never links to downloads in its e-mail messages, but always requires a visit to a security bulletin landing page to download a patch. If you receive an e-mail containing a link promising to upgrade Microsoft Outlook or Outlook Express, you should simply delete the message to avoid being nailed by a Trojan horse. Many Windows Secrets readers have recently received these fake e-mails. The scams have focused on a supposed upgrade for Outlook and Outlook Express — e-mail clients widely used in businesses. The reason I'm writing today's short Patch Watch column — which is outside my usual twice-a-month schedule — is that a high number of these e-mails have reached people's inboxes, somehow evading the usual junk-mail filters. These fake Outlook patch alerts have affected PC users worldwide. I even found a post from a Microsoft forum in China asking about the e-mail's validity. As the Sophos blog explains, if you follow the instructions in the bogus message, it results in your running nasty hacker code. Actual security bulletin notices from Microsoft are quite dull. They never include direct links to the downloadable patch. Instead, they require you to go to a bulletin landing page. Most importantly, they're always signed with a PGP signature. (See Figure 1.) ![]() Figure 1. Microsoft's security-bulletin e-mails are always identified as PGP SIGNED. When in doubt, always download patches directly from the Microsoft Update site. Even considering the recent problems with update notifications that don't always appear in Windows as expected — see this week's Top Story for details — you should always download updates for Windows and other Microsoft software only from Microsoft servers. The Patch Watch column reveals problems with patches for Windows and major Windows applications. Susan Bradley recently received an MVP (Most Valuable Professional) award from Microsoft for her knowledge in the areas of Small Business Server and network security. She's also a partner in a California CPA firm. |
|
WACKY WEB WEEK The cure for the office cheerleader is here!
|
|
ADS
|
|
PERMALINKS Use these permalinks to share info with friends We love it when you include the links shown below in e-mails to your friends. This is better than forwarding your copy of our e-mail newsletter. (When our newsletter is forwarded, some recipients click "report as spam," and corporate filters start blocking our e-mails.) The following link includes all articles this week: http://WindowsSecrets.com/comp/090702 Free content posted on July 2, 2009:
You get all of the following in our paid content:
Thanks in advance for your support! |
|
YOUR SUBSCRIPTION The Windows Secrets Newsletter is published weekly on the 1st through 4th Thursdays of each month, plus occasional news updates. We skip an issue on the 5th Thursday of any month, the week of Thanksgiving, and the last two weeks of August and December. Windows Secrets resulted from the merger of several publications: Brian's Buzz on Windows and Woody's Windows Watch in 2004, the LangaList in 2006, and the Support Alert Newsletter in 2008. Publisher: WindowsSecrets.com LLC, Attn: #120 Editor, 1700 7th Ave., Suite 116, Seattle, WA 98101-1323 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine). Editorial Director: Brian Livingston. Senior Editor: Ian Richards. Editor-at-Large: Fred Langa. Technical Editor: Dennis O'Reilly. Program Director: Tony Johnston. Program Manager: Ryan Biesemeyer. Web Developer: Damian Wadley. Research Director: Katy Abby. Copyeditor: Roberta Scholz. Contributing Editors: Susan Bradley, Scott Dunn, Mark Joseph Edwards, Michael Lasky, Woody Leonhard, Ryan Russell, Becky Waring. Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, Support Alert, LangaList, LangaList Plus, WinFind, Security Baseline, Patch Watch, Perimeter Scan, Wacky Web Week, the Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of WindowsSecrets.com LLC. All other marks are the trademarks or service marks of their respective owners. HOW TO SUBSCRIBE: Anyone may subscribe to this newsletter by visiting our free signup page. WE GUARANTEE YOUR PRIVACY: 1. We will never sell, rent, or give away your address to any outside party, ever. 2. We will never send you any unrequested e-mail, besides newsletter updates. 3. All unsubscribe requests are honored immediately, period. Privacy policy HOW TO UNSUBSCRIBE: To unsubscribe from the Windows Secrets Newsletter,
|