Windows Secrets

 

 

   
       
   
Windows Secrets Newsletter • Issue 204 • 2009-07-02 • Circulation: over 400,000

   
   
BONUS DOWNLOAD

Green Home Computing for Dummies download
Free ways to save money and energy with your PC
This month's free bonus download for all our subscribers is Green Home Computing for Dummies by Katherine Murray and our very own contributing editor Woody Leonhard. The book is full of tips on how to reduce your PC's power cost, optimize your system's performance for better energy efficiency, and more! The printed volume isn't in stores yet, but all subscribers can receive our exclusive excerpt of two full chapters now through August 5. Simply visit your preferences page, save any changes, and a download link will appear. Thanks! —Brian Livingston, editorial director

All subscribers: Set your preferences and download your bonus
Info on the printed book: United States / Canada / Elsewhere


   
   
Table of contents
TOP STORY: It's confirmed: Windows may update unexpectedly
KNOWN ISSUES: Forced updates plague Windows users worldwide
PATCH WATCH: Fake e-mails to patch Outlook lead to malware
WACKY WEB WEEK: The cure for the office cheerleader is here!
LANGALIST PLUS: Test-drive Windows 7 in a virtual machine
BEST SOFTWARE: Efficiently organize your portable applications
WOODY'S WINDOWS: Avoid early Windows 7 upgrade surprises

   
       
   
ADS

Never reinstall your XP again   Never reinstall your XP again
Tired of your unstable and crashing PC? Looking for a permanent solution for your dysfunctional XP? Don't compromise — get our new, state-of-the-art technology. Reimage requires no set-up and causes no loss of data or applications. This is the ultimate professional repair tool, which works like "magic," according to eWeek. Get a free Reimage PC booster with every scan. Try it now!
Reimage

Optimize your PC by updating your BIOS   Optimize your PC by updating your BIOS
Do you want to improve the performance of your PC? Phoenix Technologies' new BIOSAgentPlus is a program that will scan your PC and match the correct BIOS and specific driver updates you need on any desktop or laptop. Scan today for a free report!
BIOSAgentPlus

Windows users and geeks — REJOICE   Windows users and geeks — REJOICE
Economy got you down? Need a quick mental pick-me-up? Replenish your mind with tech excellence. Surf over to Infopackets right now and get your fix of Windows tech news, reviews, tips, plus freeware goodies daily. Bonus: join our mailing list today and you'll receive any of our highly coveted Top 10 Tech Reports. Don't forget: Reading Every Journal Of Infopackets Creates Excellence (REJOICE)!
Infopackets Windows Newsletter

See your ad here

   
   
TOP STORY

It's confirmed: Windows may update unexpectedly

Scott Spanbauer By Scott Spanbauer

Dozens of Windows Secrets readers confirm that Windows sometimes installs updates without displaying a list of patches that a user can accept or decline.

If Automatic Updates were set to install patches without user intervention, no notice would be expected, but a bug appears to be installing patches upon shutdown in certain cases, even though Windows is configured to require user approval.

In my June 25 Top Story, I reported that several Windows Secrets readers and editors had experienced a disturbing problem involving Automatic Updates (AU). Users who had configured AU to prompt them before downloading or installing updates found that Windows installed updates at the next shutdown without notification, review, or approval.

The day after the story appeared, the Microsoft Update blog tacitly acknowledged the problem in a blog post. The comment said the company was "investigating the reports and trying to clarify with the community exactly what people are experiencing."

The blog post went on to describe the behavior that should be expected when users select option 2 or 3 of AU's four alternatives:
  • Option 1. Automatically download and install updates;
  • Option 2. Download updates but prompt for review before installing them;
  • Option 3. Check for updates but prompt before downloading or installing them;
  • Option 4. Turn off Automatic Updates.
When either option 2 or 3 is chosen, users should see an icon in the notification area alerting them that updates are available. This should be true whether the updates are already downloaded and ready for installation (option 2) or merely available for download from a Microsoft server (option 3).

As I reported last week, Knowledge Base article 910340, last revised on Dec. 5, 2007, confirms that notification to users may fail if a patch was partially downloaded but interrupted before the download was completed.

Incomplete downloads can occur when Microsoft publishes several updates at once and the company "throttles" its bandwidth to prevent server overload. This happened on June 9, Microsoft's regular Patch Tuesday, when 10 major security bulletins were released.

The throttling of updates from Microsoft's servers can cause some updates to be downloaded but others to be postponed. In such instances, the notification icon may not appear as expected because Windows waits until all pending updates are downloaded before showing a notification icon.

Unfortunately, when a user shuts down an affected PC before all updates have downloaded, other updates may be installed with no opportunity to review and select them.

In this situation, the only way a user can review the updates before installing them is to cancel the shutdown, open Microsoft Update or Windows Update manually, and select View available updates in Vista or Custom in XP. (Note that in XP, this feature requires Windows Genuine Advantage, so if you want to keep WGA off your system, you must use a third-party update service, as described below.)

Microsoft calls this behavior a "feature," but as WS contributing editor Susan Bradley puts it, "This is a bug, sir."

Since the problem involves patch downloads, you'd think that people who select option 3 — notify but do not download or install — would be immune to the surprise installs. However, several readers who chose option 3 report that Windows updates were downloaded and installed automatically anyway. They consider themselves to be victims of forced updates, perhaps more so than users who downloaded everything (option 2) but received no notice prior to installation.

Forced updates can result in headaches

Last week's story struck a nerve with Windows Secrets readers. Scores of you wrote in to say that you had experienced the same issue, and not just on an extra-large Patch Tuesday such as June 9. According to dozens of Windows XP and Vista users, the problem has been happening for months. (See this week's Known Issues column for more reader comments on the bug.)

The overwhelming majority of readers I heard from report the exact behavior that Microsoft describes in KB 910340: when downloads are being throttled by the Redmond company, "The Automatic Updates icon does not display the status of downloads that are in progress."

That bland statement fails to adequately describe a flaw that has a profound impact on many Windows users. As many readers note from personal experience, updates can sometimes disable software or hardware on production systems. Hours of work can be required to restore these machines to full functionality. Even if every patch is wanted, the unexpected installation of updates without notice can surprise you precisely when you really need your PC to shut down or reboot in a hurry.

A handful of readers reported more disturbing Automatic Updates bugginess. The expected behavior is that Windows' shutdown icon and shutdown dialog box should show that updates will be installed when the system is powered down or rebooted. Seeing no such notice, many readers who had selected Automatic Updates' option 2 had no reason to think updates would be installed. After clicking the shutdown icon on the Start menu, however, these users found that updates were being installed unexpectedly.

Several readers who'd selected option 3 (notify but do not download) found updates being installed when they shut down their systems, with no notice that any patches were even available for download.

Some readers who had deselected one or more updates — indicating that these updates should not be applied — reported that Windows installed the updates at the next shutdown anyway.

Finally, many readers who selected a menu option to "shut down without installing updates" found that updates were installed despite their wishes.

(Some readers reported that they'd originally selected AU option 2 or 3, but their systems had somehow been changed to option 1 so AU would download and install updates automatically. This can be caused by such programs as Microsoft Live OneCare and Norton Internet Security, as described by WS contributing editor Scott Dunn on Oct. 25, 2007, and editorial director Brian Livingston on May 25, 2006.)

Microsoft isn't saying exactly what's going on

Last week's column stated that the large number of patches released on June 9 could have triggered the forced-update behavior. It's still not certain precisely why update notifications are failing to appear in Windows systems around the world. But this much is clear: the phenomenon has definitely occurred both before and after June 9.

One workaround to prevent surprise downloads was recommended last week: every time you plan to shut down or reboot a PC, first run Microsoft Update (a superset of Windows Update) and select each patch you wish to install or not install. This should download and apply whatever you selected, leaving no files to be installed without notice.

For some Windows users, however, their machines must be protected against any changes before each new patch is researched for side-effects. These extra-cautious users are disabling Automatic Updates entirely and then running Microsoft Update or a third-party update service manually, as often as needed.

Disabling AU causes an irritating red warning to be displayed repeatedly. If shutting off AU appeals to you, the right way to implement it (and avoid the constant nagging) is as follows:
  • Step 1: Disable Automatic Updates. In XP, open the Automatic Updates Control Panel applet and select Turn off Automatic Updates. In Vista, open the Windows Update Control Panel applet, choose Change settings in the left pane, and select Never check for updates (not recommended).

  • Step 2: Turn off the red warning. Open the Security Center Control Panel applet, click Change the way Security Center alerts me, and choose Don't notify me and don't display the icon (not recommended).

  • Step 3: Check for updates manually. Run Microsoft Update or an independent update service at least once a month (preferably just after reading the analysis that Windows Secrets publishes two days after every Patch Tuesday). Third-party update tools such as the Secunia Personal Software Inspector and the Shavlik Google Patch Gadget can identify critical updates that both Windows and your major applications require.
It should be noted that corporate IT administrators can avoid forced updates by using Microsoft's WSUS (Windows Server Update Services) or a competing server-level patch-management program. Such services allow admins to centrally control the deployment of patches, bypassing Automatic Updates entirely.

See the Windows Secrets Security Baseline and Susan Bradley's May 28 Top Story for more on third-party Windows update services.

Although the precise workings of the bug are still unclear, it's obvious that AU is downloading and installing some updates without the required notification. Even when a user manually runs a download tool before a shutdown occurs, it's been reported to me that, in rare instances, even this failed to prevent an unwanted update from being installed.

Readers who have further information on this bug should submit it via the Windows Secrets contact page.

Scott Spanbauer writes frequently for PC World, Business 2.0, CIO, Forbes ASAP, and Fortune Small Business. He has contributed to several books and was technical reviewer of Jim Aspinwall's PC Hacks.

Table of contents

   
   
ADS

Save up to 76% on quality inkjet ink   Save up to 76% on quality inkjet ink
We offer the sharpest prices on the Web for quality ink and laser toner. Bonus: save an extra 10% by using coupon code JAK375H. Free shipping to contiguous U.S. locations for all orders over $50. Offer expires 7/31/2009 and excludes OEM items.
4InkJets

Your old drivers are slowing down your PC   Your old drivers are slowing down your PC
Driver Detective provides the most up-to-date drivers specific to your computer, including all major-brand OEMs (Dell, HP, Compaq, Toshiba, etc.) and generic brands. We access a database of over 9.2 million device-associated drivers — the largest driver update database on the Internet. Driver Detective saves you endless hours of work and aggravation normally associated with updating drivers.
Driver Detective

See your ad here

   
   
KNOWN ISSUES

Forced updates plague Windows users worldwide

Dennis O'Reilly By Dennis O'Reilly

The response to Scott Spanbauer's June 25 Top Story on forced updates makes it clear that a bug in Microsoft's Automatic Updates service is causing serious problems for Windows users.

Many readers have reported seeing updates being installed at shutdown or reboot time without any notification, much less an opportunity to select which updates will or will not be applied.

Several dozen WS subscribers have confirmed the Automatic Updates (AU) behavior that Scott described. In today's Top Story, many of his sources report that their shutdown options gave no indication that updates were about to be installed. Also, some WS readers who had configured Automatic Updates to "download only" or "notify only" indicate that AU mysteriously changed to "install updates automatically" against their wishes.

While we await Microsoft's explanation for this aberrant AU behavior, many tech news sources have picked up Scott's original story and corroborated the forced updates. The day the story appeared in Windows Secrets, news aggregator Techmeme featured it, in addition to coverage in ITWorld, PCMag.com's Security Watch, and ZDNet's Hardware 2.0 blog, among others.

ZDNet writer Adrian Kingsley-Hughes was one observer who'd previously encountered the problem, although he didn't feel at the time that he had enough evidence to go public:
  • "So far, I've not been able to replicate this issue. However, I have been receiving reports of these stealth updates for a while now."
For the many readers we heard from who've had first-hand experience with this bug, the last thing they want to do is replicate the behavior.

Storm brewing over unexpected update behavior

The most-common example of the AU bug — patches being installed without warning at Windows shutdown — can cause serious problems, as Tom King found out earlier this month:
  • "On the evening of June 10, the Dallas/Fort Worth area was hammered by severe storms, with high winds and intense lightning that knocked out power to over 500,000 homes in the area. Unfortunately, our home was among those to lose power, where I have a Windows XP PC and a Mac mini computer in a home office....

    "The computers were now running on a limited-time battery backup unit, which normally allows adequate time for normal shutdown of the Mac and Windows PC computers. I proceeded to shut down the Mac and the XP PC, where I had been watching the weather radar and news reports. On the Mac, I selected a forced shutdown, and within seconds the Mac was ready to be unplugged. But the Windows PC turned out to be a much different experience!

    "I next moved on to the PC and selected the Turn Off Computer option on the menu bar. Much to my horror, the Turn Off Computer window showed the Install Updates icon over the red Turn off button. I thought, 'How could this be happening?' since I had previously set Automatic Updates to download updates for me but let me choose when to install them.

    "With the power to the house out and the computer running on a battery backup, it's not the time for Windows to spend the next several minutes casually installing updates without asking! After nervously waiting about a minute — and with no end in sight for the uninvited Windows update — I reached around to the PC's power switch, turned it off (update still in progress), and unplugged the machine....

    "Microsoft won no points with me the night the severe storms rolled in, and they chose to usurp my control of my computer at the worst possible time! I feel fortunate that the Registry didn't crash....

    "Perhaps it's well past time Redmond respects who owns the computers they commandeer and who is in the best position to know when updates can safely be applied!"
Even in calm weather, the consequences of unanticipated updates can wreak havoc with a single PC or an entire network, as Conrad Knabenschuh found out one recent morning:
  • "My customers run the D3 database by Tiger Logic. It runs as a system service, with access to it via ODBC or Telnet.

    "I have been forced to set all of their machines to 'Download updates but let me choose when to install them' because Windows does not do a clean shutdown if a reboot is required when updates are automatically installed. On a normal shutdown, the database will wrap up its processes and ports and shut down cleanly; then Windows shuts down....

    "Probably half a dozen times a year (I support about 60 servers coast-to-coast in both the U.S. and Canada), a customer will have a problem on Wednesday morning where the machine has installed updates and then automatically rebooted. When I check the settings, yup, that machine now reads 'Install updates automatically.'

    "I can guarantee that none of my customers has the technical skill or know-how to reset the setting, and neither I nor my staff ever would. It was not forgotten at machine install, for the simple reason that we always do it; more importantly, it may be a machine that is several years old. I have had a couple of instances where the same machine has reset itself two or three times over the course of a couple of years.

    "I have been totally unable to find a pattern. In general, I patch all machines regularly. It doesn't seem to matter whether it's XP or 2003 — the database runs under either, and if the network has fewer than 10 users, XP is more than adequate. The only guess I've had in a couple of cases is that the updates hadn't been done for several months, but that doesn't hold true for every instance, either."
Mysteries abound in relation to this AU bug, which clearly dates back much farther than Microsoft's extra-heavy June 9 patch extravaganza.

More evidence of behind-the-scenes AU changes

The people who have the most experience with unexpected AU behavior are those who fix PCs for a living. Ed West of Ed's ComputerWorks is one such person:
  • "I run a computer shop in Oregon, and I choose the option 'Notify me but don't automatically download or install them' for my personal and shop computers and most clients. I've seen Microsoft updates being installed at shutdown on several computers the last two weeks. I've double-checked those computers to make sure the appropriate option had been chosen for updates, and indeed it had been set to my standard mentioned above. Ticks me off royally."
At least Ed's PCs retained their AU settings. Such is not the case for Tom Amann:
  • "After reading your article about forced updates, I checked my settings, because I noticed an auto-install the other day at shutdown. I always keep the setting at 'download but don't install.' When I checked just now, it was set to 'download and install automatically.' I use XP. Can a malware program change the setting and mimic a true MS update? I changed the setting back to my preference."
Scott reports in today's Top Story that some well-known security programs silently reconfigure AU to "automatically install." It's also possible that a malware infection caused the change to Tom's AU settings. Some malware programs turn on AU as a defense against other intruders, whose routines often try to kill off any competing infections.

Melodie Larsen used information she'd read in previous WS newsletters to sleuth the source of her recent hardware woes:
  • "I also had a problem with a 'stealth update' from Microsoft. I had my update settings to notify me of updates but to let me decide what and when to download. On June 17, my computer suddenly wasn't able to see my Maxtor One Touch backup drive, either in Windows Explorer, Device Manager, Drive Management Console, or Maxtor Manager. A request for help from Seagate/Maxtor merely suggested that I try the drive on another computer.

    "I suspected some kind of update interference, checked in Add/Remove Programs, and found that a number of updates had occurred during the night without my knowledge. First, I tried uninstalling, rebooting, and then reinstalling the Maxtor installation programs, to no avail.

    "I studied each of the updates listed in Add/Remove Programs on the Internet, then removed update 970238, which is supposed to fix a vulnerability in Remote Procedure Call. After removing that particular Windows patch, I followed the steps that I had received previously from Maxtor to fix a similar problem with the drive not being recognized by Windows.... Now my drive is again visible within Windows, Device Manager, Disk Management Utility, and Maxtor Manager....

    "If I hadn't been reading Windows Secrets and following Susan Bradley's columns — in which she suggested rolling back an update to see whether it was the cause of problems — I would probably still be playing message tag with Seagate/Maxtor support."
We've known for some time that forced updates can seriously disable Windows' functionality. For example, WS contributing editor Susan Bradley reported in her July 10, 2008, column (paid content) that Microsoft patch MS08-037 completely disabled the Internet connection of machines using the ZoneAlarm firewall.

Here's hoping Microsoft permanently corrects AU's forced-install bug soon.

Readers Tom, Conrad, Ed, Tom, and Melodie will each receive a gift certificate for a book, CD, or DVD of their choice for sending tips we printed. Send us your tips via the Windows Secrets contact page.

The Known Issues column brings you readers' comments on our recent articles. Dennis O'Reilly is technical editor of WindowsSecrets.com.

Table of contents

   
   
PATCH WATCH

Fake e-mails to patch Outlook lead to malware

Susan Bradley By Susan Bradley

All Windows users need to be aware that Microsoft never links to downloads in its e-mail messages, but always requires a visit to a security bulletin landing page to download a patch.

If you receive an e-mail containing a link promising to upgrade Microsoft Outlook or Outlook Express, you should simply delete the message to avoid being nailed by a Trojan horse.

Many Windows Secrets readers have recently received these fake e-mails. The scams have focused on a supposed upgrade for Outlook and Outlook Express — e-mail clients widely used in businesses.

The reason I'm writing today's short Patch Watch column — which is outside my usual twice-a-month schedule — is that a high number of these e-mails have reached people's inboxes, somehow evading the usual junk-mail filters.

These fake Outlook patch alerts have affected PC users worldwide. I even found a post from a Microsoft forum in China asking about the e-mail's validity. As the Sophos blog explains, if you follow the instructions in the bogus message, it results in your running nasty hacker code.

Actual security bulletin notices from Microsoft are quite dull. They never include direct links to the downloadable patch. Instead, they require you to go to a bulletin landing page. Most importantly, they're always signed with a PGP signature. (See Figure 1.)

Microsoft security bulletin e-mail
Figure 1. Microsoft's security-bulletin e-mails are always identified as PGP SIGNED.

When in doubt, always download patches directly from the Microsoft Update site. Even considering the recent problems with update notifications that don't always appear in Windows as expected — see this week's Top Story for details — you should always download updates for Windows and other Microsoft software only from Microsoft servers.

The Patch Watch column reveals problems with patches for Windows and major Windows applications. Susan Bradley recently received an MVP (Most Valuable Professional) award from Microsoft for her knowledge in the areas of Small Business Server and network security. She's also a partner in a California CPA firm.

Table of contents

   
   
WACKY WEB WEEK

The cure for the office cheerleader is here!

Despondex By Katy Abby

You know the type: the person who just never seems to have a bad day, who smiles cheerfully in the face of adversity, who always looks on the bright side of life.... Ugh! How annoying!

The rest of society has been suffering these cherubic grins and good-humored dispositions for far too long. Finally, pharmaceutical companies have figured out a way to crush the spirits of these jubilant jerks once and for all. Take a look, and have a nice day! Er, I mean (gulp) ... whatever. Play the video

Table of contents

   
   
ADS

Get your message seen by 400,000 readers   Get your message seen by 400,000 readers
Does your company offer a product or service? Now you can place an ad in the Windows Secrets Newsletter and be seen by more than 400,000 active buyers of PC hardware and software. Bid as much or as little as you like to get the ideal ad placement. Take advantage of our all-new design interface, allowing larger images and longer text, and get updated stats in real time!
Windows Secrets Newsletter

See your ad here

   
   
PERMALINKS

Use these permalinks to share info with friends

We love it when you include the links shown below in e-mails to your friends. This is better than forwarding your copy of our e-mail newsletter. (When our newsletter is forwarded, some recipients click "report as spam," and corporate filters start blocking our e-mails.)

The following link includes all articles this week: http://WindowsSecrets.com/comp/090702

Free content posted on July 2, 2009:

 
You get all of the following in our paid content:

Get our paid content by making any contribution

12 months of paid content

There's no fixed fee! Contribute whatever it's worth to you
Readers who make a financial contribution of any amount by July 8, 2009, will immediately receive the latest issue of our full, paid newsletter and 12 months of new paid content. Pay as much or as little as you like — we want as many people as possible to have this information.
 
Luis Miguel in Mexico

A portion of your support helps children in developing countries
Each month, we send a full year of sponsorship to a different child. Your contributions in July are helping us to sponsor Luis Miguel, an 8-year-old boy from a Jalisco, Mexico. Children International channels development aid from donors to Luis Miguel and his community. We also sponsor kids through Plan USA and other respected agencies. More info

Use the link below to learn more about the benefits of becoming a paid subscriber!

More info on how to upgrade

Thanks in advance for your support!

   
   

Table of contents

   
   
YOUR SUBSCRIPTION

The Windows Secrets Newsletter is published weekly on the 1st through 4th Thursdays of each month, plus occasional news updates. We skip an issue on the 5th Thursday of any month, the week of Thanksgiving, and the last two weeks of August and December. Windows Secrets resulted from the merger of several publications: Brian's Buzz on Windows and Woody's Windows Watch in 2004, the LangaList in 2006, and the Support Alert Newsletter in 2008.

Publisher: WindowsSecrets.com LLC, Attn: #120 Editor, 1700 7th Ave., Suite 116, Seattle, WA 98101-1323 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine).

Editorial Director: Brian Livingston. Senior Editor: Ian Richards. Editor-at-Large: Fred Langa. Technical Editor: Dennis O'Reilly. Program Director: Tony Johnston. Program Manager: Ryan Biesemeyer. Web Developer: Damian Wadley. Research Director: Katy Abby. Copyeditor: Roberta Scholz. Contributing Editors: Susan Bradley, Scott Dunn, Mark Joseph Edwards, Michael Lasky, Woody Leonhard, Ryan Russell, Becky Waring.

Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, Support Alert, LangaList, LangaList Plus, WinFind, Security Baseline, Patch Watch, Perimeter Scan, Wacky Web Week, the Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of WindowsSecrets.com LLC. All other marks are the trademarks or service marks of their respective owners.

HOW TO SUBSCRIBE: Anyone may subscribe to this newsletter by visiting our free signup page.

WE GUARANTEE YOUR PRIVACY:

1. We will never sell, rent, or give away your address to any outside party, ever.
2. We will never send you any unrequested e-mail, besides newsletter updates.
3. All unsubscribe requests are honored immediately, period.  Privacy policy

HOW TO UNSUBSCRIBE: To unsubscribe from the Windows Secrets Newsletter,
Copyright © 2009 by WindowsSecrets.com LLC. All rights reserved.

Table of contents