Spyware Sucks

WA Daylight Savings changes and how it will affect computers.

Microsoft have released a tool for the Western Australian Daylight Savings changes that affected home users should install:
http://www.microsoft.com/downloads/details.aspx?familyid=c6a2c8fe-abda-4051-a24f-3ec933089747&DisplayLang=en

But, what about the corporate environment?  As many of you know, I am based in Western Australia and have had to deal with these changes - yay for the politicians who did not look any further than the kitchen clock and their bedside table alarm when deciding to introduce daylight savings in Western Australia with only a few weeks notice.

For me, the easiest way to add a daylight savings ability to all computers on my network is to push out a registry script via my login script.  My networks run SBS2003, so all I had to do was create a registry file, and save it to the NETLOGON folder.

The registry file is as follows - if you wish to use this, only copy and paste the text which is in bold font - IMPORTANT NOTE: THE FILE HAS BEEN TESTED ON WINDOWS XP ONLY!  Registry Editor V5.00 files cannot be used on older versions of Windows.

___________________

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Australia Standard Time]
"Display"="(GMT+08:00) Perth 2006"
"Dlt"="W. Australia Daylight Time"
"Std"="W. Australia Standard Time"
"MapID"="16,17"
"Index"=dword:000000e1
"TZI"=hex:20,fe,ff,ff,00,00,00,00,c4,ff,ff,ff,00,00,03,00,00,00,05,00,03,00,00,\
00,00,00,00,00,00,00,0c,00,00,00,01,00,02,00,00,00,00,00,00,00

___________________

I then add the following to my login script:

REM Add a daylight savings zone for Perth to all systems
regedit -s DaylightSavingsPerth.reg

The registry change automatically enables the tick box to adjust system clocks for daylight savings if the user has local admin rights.

Note: I've used the same procedure on my home network - when users are NOT local admin, the registry file was imported, and the daylight savings option created, but it was not be enabled - this is because the local user does not have sufficient rights to change the time and date settings (an error message will be seen if the user tries to adjust date and time). 

Also, the registry file did not work for me on Windows Vista when I tried to apply it via the SBS log-in script - it worked  when run manually BUT I did have to manually adjust the current time because I applied the registry file *after* daylight savings had started.

I used the MSI on my SBS2003 server - the daylight option was created, but again was not enabled.

There is a problem with the daylight savings changes - all pre-existing appointments in Outlook that are during the first daylight savings period will move forward one hour - these appointments must be manually changed to their correct time.

IMPORTANT NOTE:  If you have recurring appointments that span non-daylight savings and daylight savings periods, you must adjust each appointment during the daylight savings period INDIVIDUALLY - do not open the series.

The calendar appointment changes don't occur until after a reboot and even then may not be changed when you first open Outlook - they'll morph a couple of minutes later.

The moving appointment syndrome only affects appointments from 3 December 2006 to 24 March 2007 inclusive.  It seems the registry file activates a daylight savings feature *for this year only* which means we will have to go through all of this again when a later registry edit is released.

All appointments outside of daylight savings periods seem to be ok.

Only two problems have occurred so far on my computer.

1. When I rebooted after applying the registry patch all managed applications were removed, and I was prompted to set up my Windows Automatic Update preferences.

 Reboot - managed applications were reinstalled - AU prompt gone
 Reboot - managed applications removed again - AU setup prompt back
 Reboot - managed applications installed - AU prompt gone
 Reboot - managed applications stayed installed
 Reboot - managed application still stayed installed.

2. My custom multiple home pages disappeared in IE7 (probably related to 1. above - somehow or other systems on my network spontaneously lose GPO settings on reboot)

Such spontaneous removal of managed software is a regularly recurring problem, most often happening after security patches or other software changes and seems to be related to Kerberos issues.  It’s a pain in the tush, to put it mildly, but people are getting used to it now - I just tell them to reboot and all their software will come back.

It is possible to stop the problem of managed applications spontaneously uninstalling when they fall out of scope - you need to edit the deployment options for the GPO to disable automatic removal.  Of course, this means that if you remove a PC from an Office OU that the software will not be automatically uninstalled, but we can live with that.

Further information for network administrators about daylight savings:

Exchange - OWA and CDO objects, both of which we use - nothing released yet - info here:
http://www.microsoft.com/australia/technet/timezone/Exchange.aspx

Sharepoint - nothing released yet - info here:
http://www.microsoft.com/australia/technet/timezone/Sharepoint.aspx

Whitepaper:
http://www.microsoft.com/australia/technet/timezone/whitepaper.aspx

I have one last observation regarding the following quote taken from the microsoft.com artice:

"Outlook users need to apply the update for their Windows operating system. Following the update, existing calendar items which occur during the daylight saving period will appear to be shifted one hour earlier. Further information is available at http://www.microsoft.com/australia/technet/timezone/Outlook.aspx." - my appointments shifted an HOUR LATER - perhaps this will have changed when I log in on Monday when the time zone changes have taken effect.

New KB article - links do not open in IE6 on XP SP2 or Server 2003 SP1

A link does not open in Internet Explorer 6 on a computer that is running Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1
http://support.microsoft.com/default.aspx?scid=kb;en-us;926134

This issue is a result of automatic download blocking, a feature whereby downloads that are hosted on a Web site are not opened automatically.

If a Web site you visit is coded to automatically download files to your computer, which is a *bad thing*, you can follow the advice in the workarounds to get around the problem, but I do not recommend this.

If you disable the "automatic prompting for file downloads" security feature, if you visit a malicious site, or a site that has been hacked and hostile code inserted, then you at risk of accidentaly accepting a download and running dangerous software.

To quote Microsoft "We recommend that you do not disable the Automatic prompting for file downloads setting, and developers must not rely on users disabling this setting."

WA Daylight Savings Changes for Microsoft Windows for the Year 2006/2007

The Western Australian Government, in its infinite wisdom, and despite WA residents rejecting Daylight Savings via multiple Referendums, have decided to introduce Daylight Savings on a trial basis.

Of course, the fact that this is going to affect who knows how many millions of computers didn't occur to our learned politicians.  Also, the fact that they gave the world, what, a couple of weeks, to adapt to the change, didn't occur to them as a potential problem either (to see what I mean, right click your system clock, select adjust date/time and then set your time zone to Perth ... oops, no Daylight Savings option:

Click here to see Perth time zone setting
Click here to see Sydney time zone setting - note the daylight savings option

Anyway, Microsoft has released an update to address the WA Government changes - unfortunately it is not yet available via WSUS and I have not been able to find out at time of writing when, or even if, it will be made available via WSUS.  Hopefully it will be made available before December 3 which is when the change takes effect.  In the interim, various downloads are available for direct download:

http://www.microsoft.com/downloads/details.aspx?familyid=c6a2c8fe-abda-4051-a24f-3ec933089747&DisplayLang=en

If you want to avoid an MSI, and use a registry file to deploy the update via login script, see here:
http://msmvps.com/blogs/spywaresucks/archive/2006/11/30/353805.aspx

I can tell - this is going to be one of those "everything is going to go wrong" days..

Starting with the error below on WebMessenger, followed by seeing an email alert about my overnight Citrix, Exchange and SQL backup that says "The job failed with the following error: The backup of the item is bad".  <sigh>

Fix for Spanish IE7 problem (WSUS)

Bobbie Harder has posted to microsoft.public.windows.server.update_services advising that MS have confirmed the problem and have a fix, and advice for those affected.  You will need to access Bobbie's post using NNTP to access the batch file.

If you want to create one of your own, the text is:

net stop wuauserv

taskkill /F /IM IESETUP.EXE /IM IE7-WindowsXP-x86-esn.exe

net start wuauserv

wuauclt.exe /detectnow

"...
Hi Folks -
We have verified a problem in the metadata for the latest  IE7.0 update
rollup package which impacts the installation behavior for all locales, and
results in an Spanish error dialog after installation as reported..

To immediately address the spread of this issue, the IE7.0 update package
has been expired effective 5:00PM PST, Wednesday, 11/22/06.  Synchronizing
WSUS servers after 5:00PM PST will ensure the expiration status is applied
to the latest IE7.0 update rollup package, released 11/21/06.

Clients which are currently displaying a Spanish error dialog, or are
rechecking for this update package, can be stopped from doing so via the
following steps:
If the update was approved for a scheduled installation:
1.       Stop the AU service.
2.       Kill the following processes -
a.       Iesetup.exe
b.      Ie7-WindowsXP-x86-esn.exe
3.       Start the AU service after you have synchronized the WSUS server to
expire the IE7 update.
4.       Run the command wuauclt.exe /detectnow.  We have to do this to
reset the IE 7 status on the client.  In my test, it offered the IE7 update
again, so it did not check back with the WSUS server where it had been
changed to detect only status.
.
If it is a manual kick off with the AU icon from systray, then clicking okay
to the error message, clears the IE setup executables, so we can just do the
following -
1.       Stop the AU service
2.       Start the AU service after you have synchronized the WSUS server to
expire the IE7 update.
3.       Run the command wuauclt.exe /detectnow.  We have to do this to
reset the IE 7 status on the client.  In my test, it offered the IE7 update
again, so it did not check back with the WSUS server where it had been
changed to detect only status.

If other updates were installed at the same time, a reboot will be required
to finish off the updates that did install for both scenarios above.

Attached is a sample batch file Before running a similar batch file you will
have had to either synchronize to ensure the update is expired , or have had
changed the update approval  to Not Approved or Dectect Only.  The batch
file sample can be run on the client system either from a logon script or
running it manually on the client.
A new update rollup package for this IE 7.0 release will be available for
synchronization early next week.  We regret the inconvenience and confusion
this issue may have caused WSUS customers.  Thank you for your reports and
enabling us to get this issue headed off so quickly.

- Bobbie Harder

PM, WSUS"

Do you want to run IE7 and IE6 side by side for testing purposes?

Basically, you can't run IE6 and IE7 on the same partition (although there are people out there publicising various hacks and workarounds that I promise you don't really work).  MS has heard your pain and is working on a VPC image that will be freely available for download to make it easier to test your sites and applications.

More info here:
http://blogs.msdn.com/petel/archive/2006/11/22/ie6-vpc-update.aspx

And here:
http://blogs.msdn.com/petel/archive/2006/11/20/ie6-and-ie7-side-by-side.aspx

4th Circuit rules against Anti-Spam Plaintiff

Discussed on spamnotes.com:
http://spamnotes.com/2006/11/19/4th-circuit-beats-back-antispam-plaintiff.aspx

Also discussed here - easier for the layperson to understand:
http://blog.ericgoldman.org/archives/2006/11/fourth_circuit_1.htm

and here:
http://womblencappellate.blogspot.com/2006/11/fourth-circuit-spam-anyone.html

I haven't had a chance to sit down and ponder the end result of the ruling for spam's victim-in-the-street but a quick scan of the articles cited above doesn't reveal anything that jumps out at me as a questionable assessment of effect.

WSUS downloading IE7 Spanish?

There are several reports of the Spanish version of IE7 being downloaded instead of the English version. 

We have also seen one report of the Spanish version of IE7 being offered for install on client machines despite IE7 apparently being blocked (unconfirmed).

More information as it comes to hand will be on the WSUS blog:
http://blogs.technet.com/wsus/default.aspx

Update: Bobbie Harder has posted to microsoft.public.windows.server.update_services advising that MS have confirmed the problem and have a fix, and advice for those affected.  You will need to access the article using NNTP to access the batch file.

http://groups.google.com/group/microsoft.public.windows.server.update_services/browse_frm/thread/416dbe5eea65a2f1/a31aa73870520969#a31aa73870520969

Hi Folks -
We have verified a problem in the metadata for the latest  IE7.0 update
rollup package which impacts the installation behavior for all locales, and
results in an Spanish error dialog after installation as reported..

To immediately address the spread of this issue, the IE7.0 update package
has been expired effective 5:00PM PST, Wednesday, 11/22/06.  Synchronizing
WSUS servers after 5:00PM PST will ensure the expiration status is applied
to the latest IE7.0 update rollup package, released 11/21/06.

Clients which are currently displaying a Spanish error dialog, or are
rechecking for this update package, can be stopped from doing so via the
following steps:
If the update was approved for a scheduled installation:
1.       Stop the AU service.
2.       Kill the following processes -
a.       Iesetup.exe
b.      Ie7-WindowsXP-x86-esn.exe
3.       Start the AU service after you have synchronized the WSUS server to
expire the IE7 update.
4.       Run the command wuauclt.exe /detectnow.  We have to do this to
reset the IE 7 status on the client.  In my test, it offered the IE7 update
again, so it did not check back with the WSUS server where it had been
changed to detect only status.
.
If it is a manual kick off with the AU icon from systray, then clicking okay
to the error message, clears the IE setup executables, so we can just do the
following -
1.       Stop the AU service
2.       Start the AU service after you have synchronized the WSUS server to
expire the IE7 update.
3.       Run the command wuauclt.exe /detectnow.  We have to do this to
reset the IE 7 status on the client.  In my test, it offered the IE7 update
again, so it did not check back with the WSUS server where it had been
changed to detect only status.

If other updates were installed at the same time, a reboot will be required
to finish off the updates that did install for both scenarios above.

Attached is a sample batch file Before running a similar batch file you will
have had to either synchronize to ensure the update is expired , or have had
changed the update approval  to Not Approved or Dectect Only.  The batch
file sample can be run on the client system either from a logon script or
running it manually on the client.
A new update rollup package for this IE 7.0 release will be available for
synchronization early next week.  We regret the inconvenience and confusion
this issue may have caused WSUS customers.  Thank you for your reports and
enabling us to get this issue headed off so quickly.

- Bobbie Harder

PM, WSUS

Password vulnerability in Firefox 2

The vulnerability is caused due to the Password Manager not properly checking the URL before automatically filling in saved user credentials into forms. This may be exploited to steal user credentials via malicious forms in the same domain.

No patch - workaround is to turn off "Remember passwords for sites"

Once again, myspace is apparently being used to take advantage of the exploit.  When the hell are those behind myspace going to get their act together?

http://secunia.com/advisories/23046/
http://news.zdnet.com/2100-1009_22-6137844.html

Proof of concept:
http://www.info-svc.com/news/11-21-2006/rcsr1/

Zdnet says IE7 is vulnerable, but I cannot reproduce this.  The Google URL in firefox shows the password:
http://www.google.com/search?q=Chapin+Information+Services&loginuser=sam&loginpass=spade&x=&y=

IE7 does not:
http://www.google.com/search?q=Chapin+Information+Services&loginuser=&loginpass=&x=168&y=47

McAfee forced to back down in argument with 3Sharp over phishing report results

McAfee, which originally disputed SiteAdvisor's inclusion in the 3Sharp phishing filter tests back in September have quietly changed the FAQ on their Web site, and have had to back down on their claims that they should not have been included in the phishing tests according to Computerworld:
http://www.computerworld.com.au/index.php/id;838657419
http://computerworld.co.nz/news.nsf/news/90CBF5D2D2CA176ACC25722E000FACA2

When the 3Sharp test results were first released, Shane Keats of McAfee was vocal in his protests, blogging about it here:
http://blog.siteadvisor.com/2006/09/we_dont_do_antiphishing_1.shtml

Shane also disputed the Mcafee site's inclusion in the 3Sharp study via a comment on my blog, and via a comment against the blog entry by the IE Team.

He commented here:
http://msmvps.com/blogs/spywaresucks/archive/2006/09/28/144948.aspx

and here:
http://blogs.msdn.com/ie/archive/2006/09/28/774513.aspx

He also apparently sent a "testy" email to 3Sharp:
http://www.robichaux.net/blog/2006/09/mcafee_siteadvisor_sure_looks_like_an_an.php

According to Computerworld, Keats is trying to blame the misunderstanding on the Site Advisor FAQ page, which apparently dates from the days before McAfee acquired SiteAdvisor, said FAQ having apparently been left unchanged in error.

Shane Keats may have been vocal in public when disputing the 3Sharp survey, but he has gone very quiet about the backdown.  He certainly hasn't had the courtesy to contact me after publicly disputing the results of the 3Sharp study on my blog, nor has he submitted a fresh comment retracting his statements, but he has found the time to announce the fact that McAfee are now going to reinstate SiteAdvisor phishing detection, but only if you're willing to pay for it.  I ask you, why would anybody pay for something that you get for free from Firefox 2 and Internet Explorer 7 anyway?  And why doesn't Shane go back to the blogs where he disputed the 3Sharp tests and say "actually, guys, you were right.. we did mention phishing and we're sorry - we've changed it now" instead of quietly changing things.

There was, and is, mention of SiteAdvisor Free protecting people from "fraudulent practices" (what, phishing isn't fraud"?) and their FAQ still says "SiteAdvisor is a tool from McAfee that protects Internet users from all kinds of Web-based security threats and annoyances including spyware, adware, unwanted software, spam, pop-ups, online fraud and identity theft":
http://www.siteadvisor.com/press/faqs.html#q1

Their home page still mentions "online scams".

As far as I'm concerned, online scams, online fraud and identity theft all apply to phishing, and it seems I am not alone in my assessment.

The Windows Vista Security Guide has been released

Yes, you still need one if you have care of a domain with Active Directory directory service:
http://www.microsoft.com/technet/windowsvista/security/guide.mspx

"In addition to the solutions that the Windows Vista Security Guide prescribes, the guide includes tools, step-by-step procedures, recommendations, and processes that significantly streamline the deployment process. Not only does the guide provide you with effective security setting guidance, it also provides a reproducible method that you can use to apply the guidance to both test and production environments."

Download the Guide here:
http://go.microsoft.com/fwlink/?LinkId=74028

Is your IE7 desktop icon missing in Vista?

This is what you are missing. Create a reg file with the following text - merge with the registry:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
"{871C5380-42A0-1069-A2EA-08002B30309D}"=dword:00000000

You will need to refresh the desktop to see the shortcut (right click on desktop, select refresh).

IE7 is finished.... Vista is finished... Office 2007 is finished... now what?

Aww heck, I suppose I can't put it off any longer...

I don't need RSS - I've got IE7 for that... I don't need email - I've got Outlook 2007 for that... the advertising pane takes up too much space and the program itself too much memory!

Welsh Dragon sausages renamed ... because they don't contain real dragon meat...

"A SPICY sausage known as the Welsh Dragon will have to be renamed after trading standards’ officers warned the manufacturers that they could face prosecution because it does not contain dragon."
http://www.timesonline.co.uk/article/0,,2-2458696,00.html

Hands up all those who thought Welsh Dragon sausages contain real dragon meat... nobody?  Ok, hands up all those who know somebody who would have believed Welsh Dragon sausages contain real dragon meat... didn't think so...

WebTrends has released an update to their software to improve compatibility with IE7

"Internet Explorer 7 is currently supported in WebTrends OnDemand 8.0b, with the exception of the SmartView module. Product versions prior to 8.0a (software) and 8.0b (OnDemand) do not have support for this important browser update.

The files found below provide a solution for customers with WebTrends Analytics version 8.0a software and Internet Explorer 7. This solution contains updated files for the User Interface server and SmartView."
http://blogs.tamtam.nl/dave/2006/11/17/WebTrends+Releases+Patch+For+IE7+Support.aspx

Red Bull Air Race - great race... crappy CSS

Yep, somebody forgot to test the site against IE7...
http://www.redbullairrace.com/race.php?id=16

Thankfully we created our own information page here in Western Australia - damn, the Flash is irritating though.
http://www.westernaustralia.com/redbullairrace/

The word is there is not a hotel room free in Perth because of the race, and yes, I'm going - I'll have my camera with me, but can't promise any decent shots - there are going to be hundreds of thousands of people there and the chances of an unimpeded photographic opportunity are pretty slim.

Hello Webmasters - I hope you're paying attention here - there is a moral to this story - check your code!!! 

User Agent String Utility Version 2 has been released...

UAST V2 can be downloaded here:
http://www.microsoft.com/downloads/details.aspx?FamilyID=9517db9c-3c0d-47fe-bd04-fad82a9aac9f&DisplayLang=en

It's not really a version 2, but rather a version 2A; there is a previous version 2, but the one available for download seems to have some functionality removed.

Original version 2:

New version 2:

It is a pity the ability to report problem URLs to Microsoft has been removed; I quite liked that feature and it was very empowering for the user to be able to do this, with the knowledge that site owners would be more likely to listen to the IE team.  We, the hoi poloi, simply get the brush-off, being told "reinstall IE7" or "uninstall IE7" or no response at all.  MS are harder to ignore.

An improvement to UAS is the explanatory page that appears when you start the utility, stored here:
C:\Program Files\Microsoft User Agent String Utility\IE7asIE6.htm

One problem
When I start UAS using the desktop shortcut I see this error - the error does not occur when I start UAS using the program menu shortcut:

New Internet Explorer Knowledgebase articles

MS06-067: Cumulative security update for Internet  (not yet live at time of writing)
http://support.microsoft.com/default.aspx/kb/922760

An ActiveX control in an iframe object redraws when you click an HTML element that is located outside the iframe object in Internet Explorer 6 or in Windows Internet Explorer 7 (not yet live at time of writing)
http://support.microsoft.com/default.aspx/kb/926133

McAfee is finally working on an antivirus product for Vista x64

It seems McAfee have decided to stop whining about the x64 kernel lockdown and start coding...

"Viega played down the degree of difference between the two companies caused by Microsoft’s decision to lock-out vendors from crucial Vista coding.

“Honestly this was a blip on the radar screen, a really tiny blip in a very long history of a very close relationship between the companies,� he said."

A "really tiny blip"??  Uhh, yeah. That full page ad was a really tiny blip.
http://www.itnews.com.au/newsstory.aspx?CIaNID=42247

Patch Tuesday - here are the goodies

Microsoft Security Bulletin MS06-067
Cumulative Security Update for Internet Explorer (922760) (Does not apply to IE7)
Severity: Critical
http://www.microsoft.com/technet/security/Bulletin/MS06-067.mspx

Microsoft Security Bulletin MS06-068
Vulnerability in Microsoft Agent Could Allow Remote Code Execution (920213) This is not IE7 specific - it will be offered to all affected users regardless of IE version.   Windows Vista users are not vulnerable.
Severity: Critical
http://www.microsoft.com/technet/security/Bulletin/MS06-068.mspx

Special notes regarding MS06-0689
Microsoft Security Bulletin MS06-066
Vulnerabilities in Client Service for NetWare Could Allow Remote Code Execution (923980)
Severity: Important
http://www.microsoft.com/technet/security/Bulletin/MS06-066.mspx

Microsoft Security Bulletin MS06-069
Vulnerabilities in Macromedia Flash Player from Adobe Could Allow Remote Code Execution (923789)
Severity: Critical
http://www.microsoft.com/technet/security/Bulletin/MS06-069.mspx

Microsoft Security Bulletin MS06-070
Vulnerability in Workstation Service Could Allow Remote Code Execution (924270)
Severity: Critical
http://www.microsoft.com/technet/security/Bulletin/MS06-070.mspx

Microsoft Security Bulletin MS06-071
Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (928088)
Severity: Critical
http://www.microsoft.com/technet/security/Bulletin/MS06-071.mspx