Defensive Computing

PC World reported yesterday about the latest malicious attack on innocent websites (see Web Attack Worm Infecting Hapless Sites by Erik Larken). While this particular story is news, the concept is old - there is no safe neighborhood on the Internet.

The websites that have been infected with this particular brand of malicious software are, very likely, innocent bystanders. Their crime is simply being hosted in an environment with buggy or mis-configured software.

If you have your own website, EriK Larkin has an excellent suggestion, run a Google search on the entire site to look for this malware infection. Specifically, do a search like

    site:mywebsite.com winzipices.cn

Needless to say, replace "mywebsite.com" with the name of your website. It is important that there not be a space after the colon. Hopefully, as shown below, the search finds nothing.

To see infected websites, search for "winzipices.cn". However, do not visit any of these infected websites.

Alex Eckelberry, of Sunbelt Software (the company behind CounterSpy), has been writing recently about hacked websites at iPowerWeb. See Problems at iPowerWeb? and The iPowerWeb Chronicles: Problems persist. Yet, in early April, StopBadware said that iPowerWeb is much improved in terms of protecting the sites they host.

Not to pick on any particular hosting company, the important issue is that websites with no ill intentions, can still end up installing malicious software on your computer. And yes, Macs and Linux are safer from malware infestation, but not from the porn ... Read more

The big claim to fame for the Foxit PDF Reader has always been speed - it opens PDF files much faster than Adobe's own Acrobat Reader. Then too, it's free and much smaller than the Adobe Reader. Plus, people just like it. At download.com, the CNET review gave it 5 stars out of 5.

But there is another big advantage, the Foxit Reader is portable.

Portable applications are those that can be run without being installed. I'm a huge fan of portable applications and use them whenever possible, running them both off the C disk and USB flash drives. By distancing themselves from the host copy of Windows, portable applications offer two advantages. First, they insulate you from problems with Windows or the registry. On the other end, they are less likely to cause problems for the host copy of Windows.

For whatever reason, the fact that there is a portable copy of the Foxit Reader seems to be a secret. It is not mentioned on either the Foxit download page, the Foxit overview page or at download.com.

To get the portable version, simply download the 2.9MB "ZIP Package" from Foxit Software. This downloads a Zip file consisting of a single file, FoxitReader.exe. When unzipped, the reader is 6.5MB.

The portable version of Foxit saved me on one computer where the old version 7 of the Adobe Acrobat Reader could not be un-installed, and the new version 8 could not be installed. ... Read more

Last week I wrote that skepticism may be the most important thing you bring with you when dealing with the Internet. A few days later in the Wall Street Journal, Walter Mossberg said basically the same thing - "...the most insidious Internet security problems today rely on human gullibility, not tricky software."

His article, How to Avoid Cons That Can Lead to Identity Theft, included this advice "Don't click on links to offers for free software or goods that you receive in an email, especially from a sender or company you've never heard of."

The problem with this advice is twofold. First, the From address of an email message is very easily forged. You may get a scam message that seems like it came from a company you know, but really didn't. Also, identifying a company you know has its own issues.

Suppose, for example, you got an email message about a really cheap price for a subscription to the Wall Street Journal. The phony From address could well be subscriptions@wsj.com. Suppose too, that the scam sent you to the www.wsj.biz web site.

Many people know that the online version of the Wall Street Journal is wsj.com. But, wsj.biz has nothing at all to do with the newspaper or with Dow Jones. It belongs to Marc Gaines and the web page that currently displays is a temporary one that GoDaddy provides for their customers. The point being, Mr. Gaines, can do ... Read more

If there is anything a computer should be able to do, it's compute. Apparently however, Excel 2002 and Excel 2007 have trouble with this, most basic, task.

Office-watch.com details a bug involving the addition of numbers with two decimal places. Simply put, Excel generates the wrong total. It comes close to the right answer, but at this point, it really should get the exact, completely correct answer - and it doesn't. See Excel SUM anomaly from April 29, 2008.

You may also want to verify that your copy of Excel has the necessary fix for another calculation bug described at office-watch.com in Excel's problem with 65,535 & 65,536 from September 2007.

Update: May 3, 2008. For those of you who don't read the comments Woody Leonhard left the following comment to this story. Basically what he wrote is a copy of a posting he did on his askwoody.com site called The Excel bug that isn't. Quoting Woody:

"...the problem has nothing to do with Excel. It's a congenital problem in the way computers represent decimal numbers with bits and bytes. Here's how I explained it last October, in Windows Secrets Newsletter: Excel works internally with binary numbers. It's therefore subject to all the myriad problems programmers encounter when they translate base-10 numbers into base-2 and back ... The number 0.1 can't be represented precisely in binary ... If you need precise decimal accuracy, you have to use a ... Read more

An article from earlier today at Download.com about defragging the Windows paging file (Quick Fix: Put your paging file to work) needs some tweaking.

The article suggests that setting the page file Initial Size and Maximum Size to the same number will "avoid serious defragmentation". While this does avoid the paging file growing in size, the file can still be fragmented when it's initially allocated. So, if you're going to do this, you should defrag the hard disk first.

But, not allowing the page file to grow, is a questionable decision. If you make the page file too small, Windows may just stop - think of it like car without gas. If you make the page file too large, you are wasting part of the hard disk.

So, how big should your paging file be? The article says "The paging file should be set to at least 1.5 times the amount of RAM onboard." This is an old wives tale. It is a rule of thumb, not gospel.

The fact is, there is no way to know how large to make the page file. It is a function of the amount of ram available to Windows and the software being used. No single rule can ever be right for everyone. Thus, the page file is designed to grow, should the need arise.

Don't be misled by Task Manager in Windows XP. The Performance tab claims to show the page file usage, but it does not. ... Read more

Last year, I wrote that, as a computer nerd, I hold this truth to be self-evident: All new software contains bugs and design flaws. As a programmer, I can understand the inevitability of bugs. Design flaws are another matter.

The May 1st issue of Sunbelt Software's Vista News newsletter highlighted some mistakes in the design of Windows Vista.

An item called "Don't accidentally delete that Recycle Bin!" describes how a number of Vista users deleted their Recycle Bin by accident, most likely while trying to empty it. If you right click on the Recycle Bin icon on a Windows XP desktop, there is no "Delete" option. Perhaps there is a good reason to delete the Vista Recycle Bin, but even so, the option to delete it should not be somewhere that people can do so accidentally. And, deleting the Recycle Bin, since it's such an oddball thing to do, should require an extra confirmation.

If you're a Vista user without a Recycle Bin, the newsletter offers this advice: "A few weeks ago, we included a link to a KB article telling you several ways to restore a missing Recycle Bin, depending on how it came to be missing." So, you have to know how you deleted it, in order to restore it? There must have been a sale on design mistakes.

User Account Control (UAC) is perhaps the poster boy for flawed design. While it may serve a useful purpose, it annoys an awful lot of ... Read more

Paul Thurrott, who clearly thinks Windows Vista is better than XP, has taken the release of Service Pack 3 as an opportunity to review Windows XP, taking a step back from the bits and bytes to ask if XP is good enough. The article, written last month, is called A Look at Windows XP Service Pack 3 Part 1: Good Enough? I recommend reading it.

One point he makes is that because of the delays in releasing Vista, Windows XP got more mature, "in ways that were never possible with previous versions of Windows." Lots of jobs require maturity, I like it in my operating system too. From my Defensive Computing perspective, I view Windows XP as mostly debugged. It's had hundreds of bug fixes issued for it, which suits me fine.

On a psychological level, Paul writes:

"We're creatures of habit, you and I. And even the most forward-looking of us, those who enjoy living on the edge, technology-wise, have a very natural need to be in the comfort zone sometimes. And XP is just that, comfortable, like that ratty old sweatshirt that we should have thrown out years ago but just can't bear to replace ... the longer Vista was delayed, the more comfortable XP became to users."

Again I agree. Some people don't have the time or the interest to learn a new user interface. Vista should have had an option to make it look just like XP.

Paul also writes that the delays ... Read more

The Internet is littered with stories about the soon to be released third service pack for Windows XP. Here's an uncommon wrinkle. Don't install it when it's officially released on the 29th. Not yet, it's too soon.

I say this at the risk of not being a team player. Fellow CNET blogger, Robert Vamosi, recently wrote "Starting April 29, all Windows XP SP2 users should upgrade to SP3..." If this is my last posting, you'll know why.

A fundamental tenant of Defensive Computing is not to install newly released software. With Windows XP SP3, the reason to wait is software incompatibilities. Even though SP3 has underdone much testing, it's a big world and there are bound to be problems with some software. By waiting, you let everyone else find and fix the problems before you face them.

If you are using software that's impacted adversely by SP3, you don't want to be among the first people to call the software vendor for help. It's far better to call a couple months later when the problem and the solution are well known and grooved in.

Deciding when to install new software involves balancing the risk vs. the reward. While the risk with SP3 should be small, so too is the reward. In fact, the reward is pert near zero for anyone who is up to date on Windows bug fixes. Granted, this is one person's opinion, and reasonable people may disagree, ... Read more

It seems that Michael Dell is breathing new life into his company.

A year ago, Dell was brave enough to backtrack on its Vista-only policy for consumer machines (Dell brings back XP on home systems). It also showed some independence from Microsoft by offering Linux to consumers. And again, Dell is innovating.

Fact 1: As of June 30, large computer manufacturers such as Dell and Hewlett-Packard can no longer offer Windows XP preinstalled on new computers, though Microsoft has said it would consider re-evaluating the deadline if there's enough customer demand.

Fact 2: Anyone who buys a copy of either the Business or Ultimate versions of Vista is entitled to also get Windows XP Professional.* Each computer manufacturer decides whether, or how, to implement this.

Until now, consumers who exercised their right to get XP Professional when they purchased Vista got a computer with Vista preinstalled and an XP image CD in the box (an image CD is very different from a retail Windows CD).

Dell's innovation? It will do the XP image installation for you. It may not sound like much, but the net result is that the computer leaves the factory with Windows XP Professional on it, rather than Vista.

Deadline? We don't need no stinkin' deadline.

Microsoft can't be happy about this, though a cynic would note that even though Dell computers leave the factory with XP on them, Microsoft can tally it as a sale for Vista.

It's an interesting power

By July 1st, Dell, Lenovo, HP and all the other big computer manufacturers will no longer be allowed to sell new computers with Windows XP pre-installed. So says Microsoft. Microsoft also dictated to retailers that, come July, there will be no more shrink-wrapped boxes of Windows XP on their store shelves.

But, many of us prefer XP over the Microsoft-mandated Vista. To borrow from Star Trek, some of us don't want to be assimilated (sorry, couldn't resist). What are we to do this summer?

One option is to buy a computer with a business version of Vista rather than a home/consumer version. Microsoft allows computer manufacturers to include a copy of XP on a CD with computers running the business editions of Vista. Some, such as Fujitsu, Lenovo and HP do this, but check with your preferred vendor. Even those that offer it, may not offer it on every computer.

The included XP CD is an "image" of XP, rather than the Windows disc that comes in shrink-wrapped boxes. This means that installing XP over Vista should be a simple process, something anyone can handle. For example, the necessary drivers are already there.

However, you pay a big premium for this. Not only is there the price premium for a business version of Vista, you may also may have to pay for the XP image CD. Each hardware manufacturer sets their own pricing. When I last checked, Fujitsu was the only company to include Windows XP for ... Read more