The most basic protections

If you haven’t done so since details about the WannaCry ransomware attack started dominating the news cycle, go right now and verify that all your computers have their current software update. That’s not just the computer you’re sitting at, but the rest of your family’s computers, your office mates’, and especially the 10-year-old computer in the spare room that you use to download pictures off the old video camera.

Start with any updates for your operating system. Microsoft sends updates the second Tuesday of every month and occasionally a special update in between. These automatic updates frequently require an irritating computer reboot that comes just as you’re completing a critical project. Search for “Windows update” from the Windows search bar in or near the Start button to verify you're up-to-date. Do not use web search as those may include ads that may give you malicious results. Always install all important updates and any Microsoft Office, Defender, or Security Essentials updates that apply to you (you don’t need to install language packs or other unusual accessories).

Now check that your other software is up-to-date, starting with your web browsers and document viewers. Many programs include a “check for updates” link under the Help menu. Unfortunately, few notify you or install updates automatically. Some may even want to charge for an update or new version.

If you find that you have Java from Oracle installed, be sure it is up-to-date. If you find Flash or Shockwave from Adobe, uninstall it now. Flash has officially been declared obsolete and will be abandoned by Adobe. Any computer that still has it will be vulnerable far into the future.

Other details

If you leave your computer running all the time the Windows and antimalware updates will usually be installed automatically including automatically rebooting. But still verify the installation monthly.

Although they may not be susceptible to this attack, don’t forget about the computers in your purse or pocket. Apple is pretty reliable at getting the latest software to i-devices as soon as it’s available. Android users aren’t as lucky since updates have to be mediated through Android, the device manufacturer, and then the carrier before they get to you. Apps may get updated frequently or never and can have less-than-desirable actions even when functioning as intended.

Many devices that users don’t think about as “computers” also need frequent updates. If you have a computer professional, they should be aware of the risks posed by equipment such as routers and WiFi. At home you may find that equipment such as DVRs, streaming media, security systems, and personal assistants also pose a risk to your personal information or the internet.

A useful utility

How many keyboards and screens do you have on your desk?

Here's a utility (skip down) to help tame a tangle, but first, the history.

Many hobbyists, power users, and business people find it necessary to work on more than one computer at a time. Lots of people have multiple monitors, but this applies if you have a complete additional computer and monitor at your workstation.

I have long used a KVM (keyboard-video-mouse switch) to use two computers with a single set of desktop components. In the mid-1990s the keyboard would not reliably switch so I kept a second keyboard connected. Unfortunately, I often forgot to move to the alternate keyboard and would type a command to "computer A" that actually had a deleterious effect on "computer B".

I now have 3 monitors on my desk. My primary computer has dual screens and the third is connected to a secondary computer so I can continue to work while monitoring a process - or watching Netflix.

Start reading again ...

I used to use a KVM to control the secondary computer - ignoring the video component. Then I discovered a free utility from Microsoft Garage. This is a group that thinks up neat stuff and makes it work - at least sorta. But the powers decide it's not commercial or of broad interest and they abandon the project. But they make the program available - without any promises of support, updates, or even that it will function as described.

I'm using Microsoft's Mouse without Borders* to control my secondary computer. It allows the mouse and keyboard to move seamlessly across up to 4 computers, each with their own monitor. Move your mouse and instantly you're controlling a different computer. Slide back and you're on the original. Even the clipboard comes across more smoothly than it does for many remote control programs.

One of its quirks is that it doesn't reliably reconnect after a reboot. You still might need a KVM or extra keyboard for that twice a month that you have to reboot your computers.

LINKS 
Full links are offered so you can examine the URL to ensure there is no hidden misdirection.
Mouse without Borders: https://www.microsoft.com/en-us/download/details.aspx?id=35460 

. This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(cc) 2016- Bill Barnes - Disclaimer - Home Page - Blogs Home

If you really want to keep your Windows XP

These tips are in no particular order. Note that some tips may require also following other tips that might come after or before them.

• Always log on as a Limited User unless you absolutely must update some software.
  Lack of administrator rights blocked over 90% of the Windows OS* malware in 2013.
• Keep all your software and applications up to date. Make a list of programs that need regular updates and check for updates at least monthly.
• Don’t use Internet Explorer; install the latest versions of Opera, Chrome, or Firefox.
• Install and use the NoScript and Ghostery plugins for Firefox.
• Uninstall JAVA. At least, disable it in all browsers.
• Uninstall or restrict use of Adobe products. A recommended alternate PDF reader is Sumatra (I have not used it). Use the built-in readers in Chrome or Firefox instead of a plugin. 
• If downloading an Office document, preview it in a viewer instead of the full program. Disable any macros.
• Uninstall Microsoft Security Essentials and use a 3rd party antivirus such as the free options from Avast, AVG and others.
• Upgrade to Microsoft Office 2007 or newer. Better still, move to a non-Microsoft suite.
• Upgrade to Internet Explorer 8 (the highest level that works with XP).
• Don’t access the internet (including email) from your XP computer. Don’t install unknown software downloaded from the internet by other computers.
• If you must browse the web, restrict the ability of malware to get to you:
  
  • Ensure you are behind a router – the first-line firewall – and that Windows firewall is active.
  • Configure your email reader to display only text – no pictures or links.
  • Use Firefox with NoScript. Learn the controls in NoScript and don’t casually allow everything.
  • Browse only to sites you are familiar with.
• If you must use email on XP, restrict the ability of malware to get to you:
  
  • Use webmail. In particular, gMail online is practically immune to transmitting malware to your system.
  • Use a mail client other than Outlook or Outlook Express.
  • Configure your mail client to display messages as “text only.”
  • Do not open email attachments or follow links until you have independently verified with the sender they are benign. Read our article on evaluating an email.
• Shut your computer off when not using it.
  You may discover you have very little need for XP. Plus, older computers are less efficient and you’ll save on your energy bill. 

* Logging on as a Limited User will block most malware that attacks flaws in and installs to the Windows operating system. This does not include malware that attacks flaws in individual programs such as JAVA, email, Microsoft Office, or .pdf documents.

Additional References
Some of these references are documents and must be downloaded and viewed in their program. Yes, they're safe for XP.
PC Club of Charlotte’s original presentation
http://pc3.org/smfpc3/index.php/topic,266.0.html and
http://zaitech.com/articles/misc/download_documents/TheEndOfXP.docm

Security researcher Steve Gibson’s comments:
https://www.grc.com/sn/sn-447-notes.pdf (first page) and
http://twit.tv/show/security-now/447.
                 
. This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2014 Bill Barnes - Disclaimer - Home Page - Blogs Home

Are you sure you want to buy Windows 8 as soon as it comes out?

I've been using a dedicated retail computer as a file server since I discovered network file sharing some 20 years ago. For over half that time I've done the same for my clients (businesses with less than 10 - usually 1-3 - users).

The primary server need for a small business is file sharing. Everyone sees all the same files (depending on access restrictions) in the same drive letter and folder. There's no concern for versioning when documents are emailed around the office. Most critically for the sysadmin, backup is centralized.

No, you don't get local Exchange, some server-installed apps, or automatic workstation imaging. You do get reliable and versatile data storage and hugely simplified administration. And migrating your data to a new server is a matter of copying one folder, configuring users, and repointing shares.

If you think I’m just an old curmudgeon advocating this for everyone, here’s someone else who agrees. Here’s a good article on establishing a small network file server.
http://windowssecrets.com/top-story/a-cheap-effective-home-server-using-windows-8/

Convinced? Now the pull-back. If you think the Win8 features fit you to a “T”, you may want to wait until next summer. This post raises with good warning the point that we should never rush critical services to a new environment.
http://windowssecrets.com/forums/showthread.php/149213-A-cheap-effective-home-server-%E2%80%94-using-Windows-8?p=870808&viewfull=1#post870808

Tech Talk - Shared Folders

An enterprise user wants to transfer multiple files to a colleague at another site within the company. Previously I created a folder on our shared drive and told him anything he put there, she could get with a link I gave her. Fast forward a couple months and he asks what that link is, again.

You can map a drive letter on your computer and have it point to a folder on your computer or another computer on your network. That is convenient if you want to easily access a folder deep in your file system or on another computer. But the drive letter is an artificial designation. Your S: drive could be someone else's T: drive. How do you tell them exactly where to find a file?

Here's a step-by-step explanation of where a mapped drive is:

• A mapped drive is a shortcut to a folder on some computer on a network (it could even be your computer).
• Because everyone may map their letters to different locations you need to tell them the absolute location (this is called the UNC – for Universal Naming Convention – location).
• The UNC includes the server name and the share name of the shared folder. The share name may be different from its true name when viewed from the computer it resides on.
• If you look at My Computer, it tells you what folder is mapped to the drive letter; for example: shared on server (S:) (exact format may vary by version of Windows.)
• The first thing before the server name is two backslashes (\\). Each folder is separated by a single backslash. Starting with “\\” tells many programs (such as Outlook) to make this a clickable link.
• Therefore, S:\IT\Temp becomes \\server\shared\IT\Temp. This is called the complete path to the file.
• Note that if there are any spaces or unusual characters anywhere in the path, the entire path must be enclosed in quotes. This is why I am so anal about my naming conventions because even the people who know this often forget it.
  It’s even harder making links to a file accessed through a browser. Don’t even try. If you’re linking to an http: resource rather than a network file, sometimes the browser address bar will replace special characters with their code such as %20 or %2d.
• This only works if you are both on the same or linked networks. You can’t send a link to someone outside the company or your home and have them find a file on your computer or server.

 . This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

Malware scanner

Worms and trojans and viruses – Oh my! But beware the insidious rootkit, my child, because it is . If you get a rootkit, it burrows deep into your system and disappears. Only a program specially designed to look for it will find it.

Microsoft has recently introduced the Microsoft Standalone System Sweeper (MSSS) that will, among other things, find and kill those pesky rootkits. Get the program at http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline.

MSSS is used a little differently than other one-time scans you’re familiar with such as MalwareBytes. It creates it’s own bootable CD or USB drive and you run it outside of Windows. It does this so it can find rootkits which, by definition, are hidden when Windows is running. If you actually bought your antivirus program on CD, it probably can do this; except MSSS is a little different (at least since I last had an AV CD). It doesn’t offer, but requires, that you update your definitions before running a scan.

Go to the download page and choose whether you want 32-bit or 64-bit. This button runs a downloader that gives you the option to create a bootable CD, bootable USB thumb drive, or download an ISO (Fig. 1). I’ll tell you what to do with an ISO next month; but until then, save yourself a lot of trouble and choose one of the other options.

Fig. 1. The MSSS downloader menu (this image may have changed).

I decided to try MSSS out on my file server. When it runs a full scan – the default your first time – it alerts you the scan could take hours. Sure enough, after 4:52:42, it reported the number of “resources scanned” was 3,520,572!

Admittedly, my single C: drive runs about 350 GB (there’s a lot of client files I really should throw away). The program looked inside compressed files, naturally. It also looked inside downloaded .ISO CD images. To my surprise, it looked inside some Outlook .PST files to find a virus in the attachment of a piece of spam.


This work by Bill Barnes is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.
Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.

Malware Alert !

Ransomware. It’s not a new form of malware (ie: viruses, trojans, worms, phishing, spyware, even spam), but neither has it faded into the background over time. Many of my clients needed my assistance after encountering it sometime during 2010. It first came to my attention 3-4 years ago in the form of “AntiVirus 2008.”

The vector is that, after visiting an infected website, a notice pops up on your screen that there is “a problem with your computer.” The “problem” it refers to may be a virus infection, update due, or disc defrag needed. The popup could vary from a poor imitation of a Windows information box to a dead ringer for the Windows Update shield and dialog or a Microsoft Security Essentials notice. Typically it uses spyware tricks to reload even after you’ve left the website or rebooted the computer. Usual Windows close window buttons in or on the window are often ineffective and you can only get it off your screen by right-clicking its icon on the taskbar. The window advises “click here” to resolve the problem – but beware! – clicking anywhere in the window could run the program. Then you’re in trouble!

You asked the website to install a program. It doesn’t need a rootkit or worm to run the malware. You asked it to install. Check out a full discussion of the process at http://windowssecrets.com/top-story/lizamoon-infection-a-blow-by-blow-account/.

Once the ransomware is installed, it locks up your computer only allowing you to go to their website to undo the damage. Of course, the “repair program” costs $20-$150. If you don’t shell out, it may have already encrypted your hard drive or it may corrupt your data before you can stop it.

Luckily, most of my clients contacted me and did not actually install the program. While they couldn’t get rid of the popup, I could log on as an unaffected administrator and squash it with a System Restore and multiple malware scans from different sources such as antivirus vendors, Malwarebytes, and Microsoft Malicious Software Removal Tool. Between alert refusal to install the program, antivirus scans, storing data on a server – not an active client computer – and backups; only one home user lost significant data. Everyone lost significant time and incurred the expense of my services.

. This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

I hate getting a new computer

Mea culpa.

My computer died. About a third of my important data was on that computer, without a recent backup.

Yes, that does happen; even to professionals who should know better.

I spent five days trying to ressurect it before I gave up and decided to start over from scratch. I promoted my test bed to be my primary computer and set this one aside to be rebuilt and used in situations where I’ll never trust it again.

Now I have to go about making “a” computer “my” computer again. Two weeks later, I’m finding significant programs I forgot to reinstall and nothing works exactly like I’m comfortable with. Oh, I did have a backup that was about 6 weeks old. Most of what I will weep over losing was a month-and-a-half worth of emails.

What's missing when you get a new computer?

PROGRAMS

The computer comes with Windows which includes Internet Explorer and Windows Mail for your primary online needs. It probably also included a 30- or 90-day subscription to a security suite. Maybe you bought it with an office program and even a personal finance program. What else could I want for my computer?

The first thing I do is uninstall the bloated security suite and install a cleaner updated antivirus only utility. Then I connect to the internet and run Windows Update.

Now I need a few utilities to work with the computer the way I want. These include Firefox, a compression program such as the free 7zip, a media player such as iTunes, a .pdf reader, and some administrative utilities appropriate to my business. Then come drivers for accessories such as my webcam, scanner, smartphone, and printer. Now I remake my network connections to file storage and printers.

Whew! I haven't even started on the application programs. In addition to an office suite and money manager, I use a graphics suite and a number of tools for web authoring. I'm sure I'll find more programs I need as I use the computer. Fortunately I'm mostly organized and can usually put my hands on the original CDs or downloads and activation keys of my programs.

Now, I've got a functioning computer, but it's not my computer. I keep most of my data on a network drive, so usually I won't have to restore that 100 GB. But some programs such as Outlook Express insist on keeping their data on the local drive, typically in some obscure location you wouldn't think about backing up. Even though I have my Outlook 2007 old mail and contacts data on a network drive, all of its connection settings are integral to the local computer so I have to look up user names, passwords and account settings for a half-dozen email accounts. And don't ask me how much I've personalized Word and Excel. Generally, the more complex the program, the more likely that it saves it's settings and preferences irretrievably in Windows.

Microsoft does offer a couple utilities that purport to help you save and transfer your settings between computers. The Files and Settings Transfer wizard (FAST) collects some important and some trivial Windows settings from your logon password to your desktop color. It also will copy your cookies and favorites from Internet Explorer and the contents of your My Documents folder. The last can take a long time and a lot of disc space if you keep music and pictures, as well as documents, in that folder. I recommend that you point it to a USB hard drive with lots of space. It will not get any data such as I mentioned above that is not in My Documents.

For Microsoft Office, you can also use the Microsoft Office Save My Settings Wizard which is usually in the Microsoft Office Tools folder. It will, with one operation, collect a lot of the more obscure personalizations in Word, Excel, Outlook, and other Office programs.

Both of these wizards apply only to the current user. That means your spouse and kids will have to run it individually. You'll also have to manually move data in Shared Documents. And, of course, they only pick up the customizations in Microsoft programs.

Now that I'm up and running, I can start worrying about hardware productivity features. My new computer did not come with an upgraded video, so I will have to move that from my old computer (if it's compatible) to use dual monitors. Also the keyboard has a slightly different layout that causes me problems. Unfortunately, my old keyboard uses a different connection and I will have to deal with that.

My situation was made more difficult because the old computer completely failed. If you are merely upgrading, you can always go back to the old machine to look at settings or get that template for your letterhead. I was saved, however, by the fact that most of my data is not actually on my computer. Even with a six-week-old backup, there was very little critical data that I lost.

. This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2008 Bill Barnes - Disclaimer - Home Page - Blogs Home

Did I get that update?

Patch Tuesday.

Every month Microsoft distributes critical security updates for Windows computers. If you have Windows Update configured to automatically install these updates, it will do so. Unless something goes wrong. Your computer may have been offline. Something may have interrupted the process. You may already have a virus that prevents updates.

Here's how to check that a specific update is installed:

• Go to Control Panel > Add or Remove Programs.
• Check the box Show Updates.
• Scroll down to find the update you want to verify.

What do all those crazy KB numbers mean?

Everything Microsoft does is affiliated with a Knowledge Base article. When the techie community writes about a bug in Windows, they say "this is related to the flaw in KB123456." If an article says "you're toast without update KB123456," you need to check your updates. You can find out more by browsing to support.microsoft.com and searching on the KB number. Maybe you'll find it only applies to some esoteric program you never use anyway, so you don't have to worry.



(c) 2008 Bill Barnes
Disclaimer - Home Page - Blogs Home

Open your browser faster

Do you open your browser to go somewhere specific and end up waiting for it to load a home page you’re not going to look at anyway? I always set my browser to open a blank page so there’s no delay before I can enter my destination address. If you really often go to the same home page, you can use the browser tabs feature in Internet Explorer 7 and Firefox. Set the first tab as a blank page and your home page as the second tab. That way it can be loading while you’re entering an address in the, already open, blank tab.

In Internet Explorer 7:
• Open tabs with all your favorite sites. Make sure the first tab is a blank page.
• Click Tools > Internet Options.
• Under Home Page, choose “Use current.”




In Firefox:
• Open tabs with all your favorite sites.
• Click Tools > Options.
• Under Home Page, choose “Use current pages.”
• Optional: Reopen the Options window. Under When Firefox starts, choose “Show a blank page.” Firefox will now open with a single blank tab. You can open your home page(s) at any time by clicking the Home icon on the toolbar.



(c) 2008 Bill Barnes
Disclaimer - Home Page - Blogs Home

Configuring your router

You plug your router into the broadband modem, plug your computer into the router, and you’re on the internet. Ah ha! Everything must be set up correctly, right? Wrong!

The security your router provides you is only starting when you take it out of the box. As soon as you install it or after you have to do a reset (not just a reboot) of the router, you should check to ensure that your settings are still valid. Everything we recommend for your router will help with your security.

Every router’s configuration screens are different so these tips are necessarily generic. If the router has a setup wizard, it may not cover all of these features so we recommend after you run the wizard that you go back and check all of the settings.

• Open your browser and connect to your router. Find the IP address of your router with these instructions . The router is (typically) the default gateway. Or, you may be able to connect to the router using other instructions in its documentation. The documentation will give you the user name and default password you need to get in.

• Follow the wizard, if available, or instructions to ensure you are connected to the internet.

• After the wizard is completed, click on every button or tab to be sure you have completed the following tasks.

• Change the logon password. You probably cannot change the user name, but choose a non-trivial password of 6-10 characters.

• Disable remote access. Some routers allow you to configure them from the internet. This is a no-no.

• Set the wireless security. You will have a choice of WEP or WPA. “No security” is not acceptable and WEP is no better. WPA may have several options. Any of them is acceptable although you may have to experiment to find a schema that is compatible with your wireless devices. Some non-computers may not support WPA in which case you will need to make some hard choices. Without security, the information on your network is vulnerable to anyone within 300-1000 feet.

• Choose the wireless password. Use a password of 13-63 characters. There may be some limitations on your router such as it only accepts exactly 13 or 26 characters. Don’t worry that this is an ugly password. You’ll keep it on a flashdrive and only need to enter it in your portable computer once.

• If you do not need any wireless computers, turn the wireless off.

• Disable UP&P. This feature was created so some online games or other peer-to-peer programs could automatically give others on the internet access to your computer. Unfortunately, it can also allow malware to give bad guys access to your computer. You may wander through all your configuration screens and still not see it; but if you do, turn it off. If you find that a program or non-computer device on your network like TV adapters or video game consoles are missing features, you will need to make some hard choices. Insist that the manufacturer give you instructions to give their devices adequate access without UP&P. It is an idea as out-of-date as a car without airbags.

• That’s most of the security features you need to configure on your router. There are other settings you can change, but they belong in another article.

• Document what you’ve done. At the very least, write down the instructions to access the router, reset it to factory defaults, the default user name and password, the current user name and password, and the wireless password. Tape this information to the top of the router. This is not like sticking your password on the monitor of your office computer. If someone has physical access to the router, they can reset it themselves.

Disclaimer - Home Page - Blogs Home

To sleep, perchance to lose my thoughts ...

What do you do when you walk away from your computer?

What happens when you choose “Turn Off Computer” from the Start button is pretty well explained in this article from 2004: http://zaitech.com/articles/wintips/goodbye-hello.htm. A recent reader asked for elaboration, specifically about background tasks.

But first … In Windows Vista, everything is the same – only different. There is no Start button, but when you click the Windows logo; there are “power” and “lock” icons. Except, by default, the “power” icon puts you in a fast hibernate where the screen goes blank immediately, but Windows is still doing something for a while.


To really shut down, you have to click the arrow at the right of the menus for another sub-menu of options. It is a good idea to fully shut down Windows occasionally to force it to finish all its tasks.

Now, for the body of our story …

Dear Bill Barnes,

I just came across an excellent article of your from 2004 (!) but there is still one unanswered issue for me.

When using a laptop (XP) and want to allow nighttime updates, on what power mode should the computer be set at?

For any unattended action to occur, the computer cannot be in sleep or hibernate. This includes automatic updates (Windows or antivirus; most other programs such as browsers, Adobe products – ie Flash and Reader – or applications check for updates when you use them and delay you then), scans, networked file or printer access, remote access, or idle-time programs such as SetiAtHome. As a rule of thumb, if you have to do more than wiggle the mouse to wake up the computer, background activities are not available either.

Most computers are able to wake themselves up – even from a full power-off – at a pre-scheduled time. This setting is deep in the BIOS settings and not part of Windows. I have never had occasion to even experiment with how it works.

What I generally do with my laptop is set it to never sleep or hibernate when plugged in. Then when I’m at home and was using it before bedtime, it will get updates and everything else. Otherwise I generally use low power settings. When I’m on battery, I set it for aggressive power management. I always set monitor off at the minimum I can stand and use a blank with password required (“Show Welcome screen”) screensaver setting (these times can be different and mon off can actually be less than screensaver).

Powering down the hard drive will not inhibit background activities; although they may inhibit it going into idle. Whether to power off the hard drive is an open discussion. On the one hand, it is most likely to fail at and because of startups, not while running. However, on laptops there are other considerations:
• Heat is the greatest killer of all electronics after electrical surges. A running hard drive puts out most of the heat in an idle computer and most laptops have inadequate cooling capability anyway.
• Vibration while running is another threat to hard drives (they are very rugged when not running). If you even carry your computer from desk-to-desk, you risk damage.
• The hard drive is the greatest drain on the battery in an idle laptop.
Of course, I violate all of these considerations, especially the second one, and have only lost 3 laptop drives (out of over 10 years of running use in a couple dozen laptops); 2 of them to heat in the same computer. If you have a failing hard drive, I strongly recommend using SpinRite for maintenance and, hopefully, recovery.

Disclaimer - Home Page - Blogs Home