Get Vista upgrade, never pay full price

Windows Secrets Newsletter • Issue 94 • 2007-02-01 • Circulation: over 400,000

Table of contents

Top Story: Get Vista upgrade, never pay full price
LangaList Plus: When your antimalware tools disagree
LangaList Plus: Encryption, malware, and privacy, oh my!
Over the Horizon: Patches are missing for Word, PowerPoint
Patch Watch: MS charges $4K for W2K daylight patch

Top Story

Get Vista upgrade, never pay full price

By Brian Livingston

Many people are upset by the fact that the economical, “upgrade” version of Vista won’t accept a Windows XP or Windows 2000 CD-ROM as proof of ownership. Vista Upgrade is said to install only to a hard disk that already has XP or 2000 already on it.

But I’ve tested a method that allows you to clean-install the Vista upgrade version on any hard drive, with no prior XP or W2K installation — or even a CD — required.

Save by avoiding the ‘full’ version

Windows Vista, in my opinion, is a big improvement over Windows XP in many ways. But the new operating system is distinctly overpriced.

The list price of the “full” (not “upgrade”) version of the most expensive edition, Vista Ultimate, is $399.95 USD, with a street price around $380. That gold-plated retail figure is only possible because Microsoft long ago achieved monopoly pricing power in the PC operating system market.

Most computer users would prefer to keep using an older version of Windows, such as XP, rather than paying the inflated prices for the "full" version of Vista. To encourage switching to a new OS, Microsoft has historically offered a lower, “upgrade” price to people who can prove that they’ve previously purchased an older copy of Windows.

The difference between Vista’s full and upgrade prices can be substantial. Based on the asking prices shown at Shopping.com on Jan. 31 — the day after the consumer version of Vista became available — the four most popular Vista versions will set you back approximately as follows:

Edition	Full version	Upgrade version
Vista Home Basic	$192	$100 ($92 less)
Vista Home Premium	$228	$156 ($72 less)
Vista Business	$285	$192 ($93 less)
Vista Ultimate	$380	$225 ($155 less)

The upgrade versions of Vista have street prices that are 32% to 48% cheaper than the full versions. If you’re truly installing Vista over an old instance of XP or W2K, the upgrade version of Vista will find the older OS on your hard drive and install without question. The problem is that Vista, unlike every version of Windows in the past, doesn’t let you insert a physical disc from an older operating system as evidence of your previous purchase.

Vista has an undocumented feature, however, that actually allows you to “clean install” Vista to a hard disk that has no prior copy of XP or W2K.

Use Vista’s ‘upgrade’ version to clean-install

The secret is that the setup program in Vista’s upgrade version will accept an installed copy of XP, W2K, or an unactivated copy of Vista itself as evidence of a previous installation.

This enables you to “clean install” an upgrade version of Vista to any formatted or unformatted hard drive, which is usually the preferred method when installing any new operating system. You must, in essence, install Vista twice to take advantage of this trick. But Vista installs much faster than XP, so it’s quicker than installing XP followed by Vista to get the upgrade price.

Before you install Vista on a machine that you don’t know is 100% compatible, you should run Microsoft’s free Upgrade Advisor. This program — which operates only on 32-bit versions of XP and Vista (plus Vista Enterprise) — reports to you on any hardware or software it finds that may be incompatible with Vista. See Microsoft’s Upgrade Advisor page.

Also, to see which flavors of XP Home, XP Pro, and 2000 officially support in-place installs and clean installs of the different Vista editions, see Microsoft’s upgrade paths page.

Here’s a simplified overview of the steps that are required to clean-install the upgrade version of Vista:

Step 1. Boot the PC from the Vista DVD.

Step 2. Select “Install Now,” but do not enter the Product Key from the Vista packaging. Leave the input box blank. Also, turn off the option Automatically activate Windows when I’m online. In the next dialog box that appears, confirm that you really do want to install Vista without entering a Product Key.

Step 3. Correctly indicate the version of Vista that you’re installing: Home Basic, Home Premium, Business, or Ultimate.

Step 4. Select the “Custom (Advanced)” install, not the “Upgrade" install.

Step 5. Vista copies files at length and reboots itself one or more times. Wait for the install to complete. At this point, you might think that you could "activate" Vista, but you can’t. That’s because you haven’t installed the Vista upgrade yet. To do that, run the DVD’s setup.exe program again, but this time from the Vista desktop. The easiest way to start setup again is to eject and then reinsert the DVD.

Step 6. Click “Install Now.” Select Do not get the latest updates for installation. (You can check for these updates later.)

Step 7. This time, do enter the Product Key from the Vista packaging. Once again, turn off the option Automatically activate Windows when I’m online.

Step 8. On this second install, make sure to select “Upgrade,” not “Custom (Advanced).” You’re not doing a clean install now, you’re upgrading to Vista.

Step 9. Wait while Vista copies files and reboots itself. No user interaction is required. Do not boot from the DVD when asked if you’d like to do so. Instead, wait a few seconds and the setup process will continue on its way. Some DOS-like, character-mode menus will appear, but don’t interact with them. After a few seconds, the correct choice will run for you automatically.

Step 10. After you click a button labeled Start in the Thank You dialog box, Vista’s login screen will eventually appear. Enter the username and password that you selected during the first install. You’re done upgrading to Vista.

Step 11. Within 30 days, you must “activate” your copy of Vista or it’ll lose functionality. To activate Vista, click Show more details in the Welcome Center that automatically displays upon each boot-up, then click Activate Windows now. If you’ve dismissed the Welcome Center, access the correct dialog box by clicking Start, Control Panel, System & Maintenance, System. If you purchased a legitimate copy of Vista, it should quickly activate over the Internet. (You can instead activate by calling Microsoft on the phone, which avoids your PC exchanging information with Microsoft’s server.)

UPDATE 2009-11-12: In the Nov. 12, 2009 Top Story, Woody Leonhard describes how to clean-install Windows 7 from the upgrade disc and also answers other reader questions about Windows 7.

I’m not going into detail today on the merits of buying Vista at retail instead of buying a cheaper OEM copy. (The OEM offerings don’t entitle you to call Microsoft for support, while the retail packages do.) Also, I’m not touching here on the least-expensive way to buy Vista, which is to take advantage of Microsoft’s “educational” rate. I’ll describe both of these topics in next week’s newsletter.

Why does Vista’s secret setup exist?

It’s reasonable for us to ask ourselves whether buying an upgrade version of Vista, and then installing it to an empty hard disk that contains no previous version of Windows, is ethical.

I believe it is. Microsoft itself created the upgrade process. The company designed Vista to support upgrading it over a previously installed copy of XP, W2K Pro, or Vista itself. This isn’t a black-hat hacker exploit. It’s something that’s been deliberately programmed into the approved setup routine.

Microsoft spent years developing and testing Vista. This upgrade trick must have been known to many, many people within the development team. Either Microsoft planned this upgrade path all along, knowing that computer magazines and newsletters (like this one) would widely publicize a way to “save money buying Vista.” Or else some highly placed coders within the Vista development team decided that Vista’s "full" price was too high and that no one should ever have to pay it. In either case, Vista’s setup.exe is Microsoft’s official install routine, and I see no problem with using it exactly as it was designed.

We should also think about whether instances of Vista that were installed using the clean-install method will continue to operate. I believe that this method will continue to be present in Vista DVDs at least until Microsoft begins distributing the Service Pack 1 edition of Vista around fall 2007. Changing the routine in the millions of DVDs that are now in circulation would simply be too wrenching. And trying to remotely disable instances of Vista that were clean-installed — even if it were technically possible to distinguish them — would generate too many tech-support calls and too much ill will to make it worthwhile.

Installing the upgrade version of Vista, but not installing over an existing instance of XP or W2K, probably violates the Vista EULA (end-user license agreement). If you’re a business executive, I wouldn’t recommend that you flout any Windows license provisions just to save money.

If you’re strictly a home user, contributing editor Susan Bradley points out that Microsoft’s so-called Vista Family Discount (VFD) is an economical package that avoids any license issues. If you buy a retail copy of Vista Ultimate, MS lets you upgrade up to two additional PCs to Vista Home Premium for $50 each. For example, if you buy the upgrade version of Ultimate for $225, the grand total after you add two Home Premiums is $335. That’s about $133 less than buying three upgrade versions of Home Premium. Details are at Microsoft’s VFD page.

Microsoft did revise a Knowledge Base article, number 930985, on Jan. 31 that obliquely refers to the upgrade situation. It simply states that an upgrade version of Vista can’t perform a clean install when a PC is booted from the Vista DVD. A clean install will only work, the document says, when the Vista setup is run from within an older version of Windows (or if a full version of Vista is being used).

This article doesn’t at all deal with the fact that the Vista upgrade version will in fact clean-install using the steps described above. It’ll be interesting to see whether MS ever explains why these steps were programmed in.

Personally, I consider Vista’s ability to upgrade over itself to be Digital Rights Management that actually benefits consumers. It’s almost cosmic justice.

I invite my readers to test Vista’s undocumented clean-install method for themselves. There certainly must be aspects of this setup routine that I haven’t yet discovered. I’ll print the best findings from those sent in via our contact page. You’ll receive a gift certificate for a book, CD, or DVD of your choice if you’re the first to send in a tip that I print.

I’d like to thank my co-author of Windows Vista Secrets, Paul Thurrott, for his research help in bringing the clean-install method to light.

Brian Livingston is editorial director of the Windows Secrets Newsletter and the co-author of Windows Vista Secrets and 10 other books.

LangaList Plus

When your antimalware tools disagree

By Fred Langa

One tool says your PC is infected. Another says you’re clean. Which do you believe?

No need to flip a coin! With a little sleuthing, you can get to the bottom of just about any malware confusion.

How to deal with dueling malware removers

When malware-removal tools disagree on whether your PC is infected or not, how do you know which one to believe? That’s the problem facing reader Thomas Trickey. But rather than focusing just on Thomas’ dilemma, let’s broaden the answer into a more general problem-solving approach for this type of problem. This way, Thomas’ specific example can also serve as a kind of problem-solving template you can use to get to the bottom of other, similar problems:

"The software ‘NoAdware’ keeps picking up W32.Netsky.AB@mm, which I believeis a worm. It tells me it is located at C:Windowscsrss.exe. However I cannot find the little devil. Symantec has a tool (free) that is suppose to fix the problem, but whenever I run the tool, it cannot find it. Is there anything you can guide me to, to help me eliminate this problem?"

Trying a removal tool was a logical first step, Thomas. That’s what I would have tried as well. One of the best references I know for finding malware-removal tools is Secunia. This security company aggregates what each of several antivirus vendors have to say about it a given threat. Secunia’s pages also offer links to each AV vendor’s site (and free removal tools, if any). For example, Secunia’s page on W32.Netsky.AB@mm offers links to seven different AV vendors regarding that particular worm. Very handy!

If the removal tools don’t seem to work, as in Thomas’ case, the next step is to try to track down the problem file itself. In this case, Thomas reports that the file is csrss.exe. What is it?

You may already have a favorite site for looking up various Windows system components, such as the programs and processes that show up in Windows’ Task Manager applet. (Press Ctrl+Alt+Del and click Task Manager to bring up this useful tool.) I haven’t found any one site that truly does it all, so I usually gravitate to three sites that complement each other: Answers that Work, Uniblue’s Windows Process Library, and PCreview. Combining and boiling down the information from those sites, you can see that:

There is a system file in Windows NT4/2000/XP/2003 called csrss.exe (the Client Server Runtime SubSystem). Csrss.exe is not part of Windows ME/98 or earlier versions.
The real csrss.exe file is located in the WindowsSystem32 folder on your PC. (Bonus tip: These sites don’t say it, but there may also be a spare copy of many system files in your WindowsServicePackFilesi386 folder, too. The datestamps and file sizes of the csrss.exe files in System32 and ServicePackFilesi386 should be identical. If they are not, one of the copies may be compromised.)
Csrss.exe is automatically launched by smss, the Windows Session Manager Subsystem. Csrss.exe is not launched on its own, and thus should not appear in the Startup folder or list.

Therefore:

Any copy of csrss.exe found in a folder other than WindowsSystem32 or WindowsServicePackFilesi386 is most likely bogus.
Any copy of csrss.exe found on any Windows ME/98 installation is most likely bogus.
Any copy of csrss.exe found in the Startup folder or in Startup tab of msconfig is most likely bogus. (To access msconfig: Click Start, Run, then type msconfig in the Run box and click OK.)

So you see, just a little spelunking gives you a wealth of data to go on. Applying this to Thomas’ PC: NoAdware reports the suspect csrss.exe file is located in C:Windows on his PC, which is not the location of the legitimate csrss.exe file. Therefore, if the file is really there, it is indeed most likely malware.

Of course, by default, Windows hides the contents of system folders to prevent novices from getting into trouble. Advanced users can and should unhide the folders:

Step 1. In the Windows Explorer menu bar, click Tools, Folder Options, and select the View tab.

Step 2. Scroll down in the Advanced Settings list and select Display the contents of system folders and Show hidden files and folders.

Step 3. Deselect Hide protected operating system files and Hide extensions for known file types.

Step 4. In the Folder Views section of the dialog box, click Apply to all folders.

You’ll now see every file and folder on your PC in full, "natural," and unmodified form. (You can undo these changes by selecting Restore defaults and Reset all folders in the Folder Options dialog box.)

With all files and folders now visible, you can navigate to the Windows folder, see if csrss.exe is there; and delete it if it is. Of course, in Tom’s case, if it is there, then he will have proved that NoAdware was correct in sounding the alarm; and that the Norton removal tool wasn’t doing its job.

But if Tom’s csrss.exe isn’t in the Windows folder, then Tom’s copy of NoAdware was sounding a false alarm, and Norton’s removal tool was correct in reporting no infection.

Whew — that took a bit of explaining! But now you know how to verify and remove a reported infection in what appears to be a system file. What’s more, you also now know how to manually referee cases where one automated tool reports an infection while others do not.

And if you do find that a given tool routinely claims to have found infections that no other removal-tool or manual search can find, then it might be wise not to trust the tools that’s crying wolf. Who has time for needless false alarms?

Speed up Opera 9 by disabling filtering

In the article Is IE 7 too slow opening new sites? in the Jan. 18 issue, I discussed several fixes for the slowdown that can occur when IE 7′s Phishing Filter is engaged. Reader Fritz Reinders sent in this tip to cure a similar problem in Opera:

"IE7 is not the only one affected. Opera 9 has this feature also: You open a new page and another Web site is first consulted to see if it is safe. Really slows page loading.

"To turn it on or off in Opera, select Tools, Preferences, Advanced, Security. Clear Fraud Protection to toggle the anti-phishing check."

Thanks, Fritz!

Reader-written freeware accesses XP applets

Windows Secrets readers are a diverse and talented group. What’s more, you’re generous in sharing your skills and knowledge, as is shown every week by the great tips we get. (E-mail your tips to Editor at WindowsSecrets dot com.) Sometimes, readers even share software they’ve written, like this little button bar from Anthony Kinyon that gives you one-click access to XP tools and utilities:

"I wrote this little app, WinToolsXP, in Visual Basic 2005 (.NET Framework 2.0 required). It is freeware. The link above has a screenshot and a more detailed description."

As you’ll see from the above link, WinToolsXP is a freeware application that provides quick and easy access to a number of XP’s built-in system functions, all from one convenient spot. Nice job, Anthony!

An automated fix for a missing NTLDR

In the Dec. 7 issue, What to do when missing NTLDR and Hal.dll discussed tried-and-true manual methods for solving show-stopping problems with those files. But reader "Cyurko" knows of a donationware ($5) fix that largely automates the process using a boot disk:

"There’s a quick and easy solution at Tiny Empire’s ‘NTLDR is missing’ page. Put the floppy in, reboot, and you’re good to go. Be sure to make a floppy for the Windows and the WinNT folders [if any]."

Thanks, Cyurko. Using the above boot disk could be especially good for users who are unfamiliar with Windows or who blanch at the thought of firing up Windows’ non-GUI Recovery Console. (You probably know a few people like that!) The boot disk can even be a nice shortcut for more experienced users. If the disk method doesn’t work, you can always fall back on the manual methods I described on Dec. 7.

Fred Langa is editor of the Windows Secrets Newsletter. He was editor of Byte Magazine from 1987 to 1991 and editorial director of CMP Media from 1991 to 1996, overseeing Windows Magazine and others. He edited the LangaList e-mail newsletter from 1997 to 2006, when it merged with Windows Secrets.

LangaList Plus

Encryption, malware, and privacy, oh my!

By Mark Joseph Edwards

Protecting your privacy isn’t always easy — or cheap.

This week, I give you tips on how to recover files encrypted with EFS, how to get rid of malware, how to avoid nosy search engines, how to erase data so it can’t be recovered, and much more!

Recover files encrypted with Windows EFS

Microsoft provides a built-in way of encrypting files and folders, called the Encrypting File System (EFS) on Windows 2000 and newer operating systems. But you have to be careful when using it. Otherwise, you might find yourself unable to access your encrypted data.

Reader Randy Brook might have this problem soon, if he doesn’t take precautions:

"A power failure fried my old motherboard. My hard drive, which runs Windows XP Pro, has some large encrypted folders that weren’t hurt. However, because my machine is old, I’ll probably get a new one. I likely will not be able to boot up with the old drive.
I fear that even if I set up the new machine with the same logon name and password, the encryption code will be different and I won’t be able to recover my data. Am I correct? If so, this is a tremendous risk in using MS’ built-in encryption, as opposed to PGP or something similar. I don’t remember XP giving me any warning of this when I started uaing encryption folders.

EFS uses a digital encryption certificate to protect data. If you lose that certificate, you can lose access to your encrypted data.

To guard against losing the certificate, you can create a data recovery agent (DRA), as explained at Microsoft TechNet. The DRA can be used to recover files encrypted by you or another user, in the event of an emergency.

If you haven’t created a data recovery agent, you might find yourself out of luck if you reinstall the operating system. The reason, as Randy suspected, is that the encryption certificate will be changed during the installation process — even if you use the same username and password.

This article is part of our paid content. Subscribe.

Already a paid subscriber? Click here to login.

Over the Horizon

Patches are missing for Word, PowerPoint

By Chris Mosby

As Microsoft unveils the latest version of Office — Office 2007 — I take a look at a few flaws that haven’t yet been patched in previous versions.

One of these flaws was recently discovered, and the other is a leftover from last year. Both are continuing the trend of Microsoft Office vulnerabilities that have been showing up for months, with no end in sight.

Another MS Word flaw threatens users

Symantec recently discovered that a Trojan the company calls Trojan.Mdropper.W is using a previously unknown flaw in Microsoft Word 2000. This flaw allows a hacker to run infected code on a computer when a user opens a Word document specially made to exploit this vulnerability.

The execution of infected code has been confirmed in Word 2000. Some sources have also reported a denialofservice (DoS) exploit that uses Word XP and Word 2003 to consume all available CPU resources.

Microsoft has acknowledged the flaw in Word 2000 in security advisory 932114. But the company claims that this vulnerability can’t be exploited in any other version of Word. Microsoft doesn’t really consider flaws that cause DoS conditions to be security vulnerabilities, so you aren’t likely to get any info on this exploit’s effects on Word from Redmond. The advisory also says that Microsoft is working on a patch, but it doesn’t give any kind of timeframe when the patch will be completed.

What to do: Microsoft’s Security Advisory states: "Do not open or save Word files that you receive from un-trusted sources or that you receive unexpectedly from trusted sources. This vulnerability could be exploited when a user opens a specially crafted Word file."

This is a good practice when dealing with any e-mail attachments. See the US-CERT Cyber Security Tip ST04-010 for a detailed explanation of why this is necessary.

More information: CVE-2007-0515, Secunia, SecurityFocus, US-CERT, MSRC

PowerPoint still unpatched for DoS

PowerPoint 2003 has a flaw that causes the application to fail to check the input of .ppt files. If a hacker exploits this vulnerability by getting a user to open an exploited PPT file, the flaw can cause a DoS. This flaw has been confirmed in Office 2003, but other versions may also be vulnerable.

Microsoft first acknowledged this problem in a Microsoft Security Response Center (MSRC) blog entry on Oct. 12, 2006. This post first reported the flaw would allow infected code to run if a user opened a hacked file. Microsoft later retracted this in an MSRC blog post on Nov. 11, 2006, stating that the flaw could only cause a DoS and that the company didn’t consider this to be a security vulnerability.

This article is part of our paid content. Subscribe.

Already a paid subscriber? Click here to login.

Patch Watch

MS charges $4K for W2K daylight patch

By Susan Bradley

This week, Microsoft declared a sale on Daylight Saving Time patches for Windows 2000, for those of you who are still running that platform.

In other news, I’m going to spend a lot of this week’s column on patches that are rated "nonsecurity" but could have a great impact on you and your business none the less.

Windows 2000 DST patches on sale now!

The biggest news for the business world this week is that Microsoft has changed the price tag for its Daylight Saving Time (DST) patches for Windows 2000. While this version of Windows is still being supported for security patches, Microsoft has ended support for nonsecurity patches.

A DST fix is needed by all Windows 2000 machines to ensure that they’ll adapt to the correct time on whatever date your state or province shifts to Daylight Time. These dates have recently changed by law in the U.S., Australia, and other countries.

Maintaining the correct time on servers can be extremely important in certain environments. A download for this issue, however, was deemed by MS to be a nonsecurity patch.

The Redmond company does, in fact, have a patch for Windows 2000 machines. But some firms reported that they were being charged $40,000 per site for the patch.

This article is part of our paid content. Subscribe.

Already a paid subscriber? Click here to login.

YOUR SUBSCRIPTION

The Windows Secrets Newsletter is published weekly on the 1st through 4th Thursdays of each month, plus occasional news updates. We skip an issue on the 5th Thursday of any month, the week of Thanksgiving, and the last two weeks of August and December. Windows Secrets is a continuation of four merged publications: Brian's Buzz on Windows and Woody's Windows Watch in 2004, the LangaList in 2006, and the Support Alert Newsletter in 2008.

Publisher: WindowsSecrets.com, 1218 Third Ave., Suite 1515, Seattle, WA 98101 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine).

Editor in chief: Tracey Capen. Senior editors: Fred Langa, Woody Leonhard. Copyeditor: Roberta Scholz. Program director: Tony Johnston. Contributing editors: Yardena Arar, Susan Bradley, Scott Dunn, Michael Lasky, Scott Mace, Ryan Russell, Lincoln Spector, Robert Vamosi, Becky Waring. Product manager: Andy Boyd. Advertising director: Eric Gilley.

Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, Support Alert, LangaList, LangaList Plus, WinFind, Security Baseline, Patch Watch, Perimeter Scan, Wacky Web Week, the Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of WindowsSecrets.com. All other marks are the trademarks or service marks of their respective owners.

HOW TO SUBSCRIBE: Anyone may subscribe to this newsletter by visiting our free signup page.

WE GUARANTEE YOUR PRIVACY:

1. We will never sell, rent, or give away your address to any outside party, ever.
2. We will never send you any unrequested e-mail, besides newsletter updates.
3. All unsubscribe requests are honored immediately, period. Privacy policy

HOW TO UNSUBSCRIBE: To unsubscribe from the Windows Secrets Newsletter,

Visit our Unsubscribe page.

Table of contents

Top-scoring articles in the past 12 months

Internet Services

Web Development

Digital Marketing

Consumer Tech