Nasty Surprise - Thanks Micro$oft!

To hell with Micro$oft, we are getting royally “scr***d” over. “We” here being every home user with Windows 8! We have to decide if we want to stay on version 8.0 or upgrade to 8.1 and then to 8.1 Update.

Watch the capital U in Windows 8.1 Update, it is a major distinction, sort of like of but not quit like a service pack. What is Micro$oft thinking - if somebody is thinking there at all?

There is no big harm in staying with Windows 8.0, Micro$oft is going to supply at least two more years of updates. But after these two years? Not a word ... yet.

Totally out of the blue Micro$oft has decided that Windows 8 users need Windows 8.1 and on top of that 8.1 Update if we want to receive future updates. No warning, no information that gives us time to prepare, nothing. You can read the truly puzzling, no almost confusing details here.

Remember, these Updates are mandatory for the average non-geek home computer user.

Micro$oft defenders put it like this: “If you want security patch C, you need to have installed security patch B first. In this case, security patch B just happens to be the 8.1 Update.” What a joke, what an arbitrary and confusing labeling system!

While there is some merit in above point of view, it overlooks three important facts:

1. Many people are having problems installing Windows 8.1 and Windows 8.1 Update — and Micro$oft hasn’t fixed the problems.
   
   Not the least problem being the huge size of 8.1 (ca. 8.2GB!) and of 8.1 Update (ca. 890MB); it is a pain to download that on “slow”, in our area regular DSL connections.
   
   
2. Windows 8.1 Update is a lot more than a security patch. It includes some significant changes to the Windows User Interface.n The latter luckily is no problem for my customers because of the way I set up Windows 8 computers.
   
   
3. Micro$oft is going to continue making patches for Windows 8.1. It just won’t give these updates to the average Windows user. That hurts.

And as if to add insult to injury Micro$oft puts a deadline of May 13^th on having Windows 8.1 Update installed!

It all boils down to trust, trust that Micro$oft is recklessly playing with.

And here is an important side note: The whole process takes a lot of time. Basic DSL connections and slower computers will be greatly affected. Brace yourself and prepare for many hours of work. Thank you Micro$oft!

For anybody with original Windows 8 and wanting to update to 8.1 I hope to be able to amend this article with instructions on how to get from Windows 8 to 8.1 and then to 8.1 Update. Hopefully I can do this on the upcoming weekend. Please stay tuned and check back if you are interested.

Update 4/25/2014:

For users with Windows 8:

• If you want to avoid the pain of updating to 8.1 you can stay on Windows 8.
   
• If you want the newest and greatest then you should update to 8.1 and then to 8.1 Update. Please consider the implications, especially the extreme time it takes to download over 9GB of updates on average Internet connections!
   
•  On slower computers the installations can easily take two to four hours!

For users with Windows 8.1:

• Micro$oft has made that decision for you: You have to download and install 8.1 Upate if you want to receive future security updates via Windows Update. 

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.  

Heartbleed - Internet Wide Risk

You may already have heard about the Heartbleed bug. This article is meant to be a simple rundown:

Web sites encrypt (or should encrypt) important traffic over the Internet such as usernames and passwords for example.

All web sites use some sort of special encryption software for this. Many web sites use a freely available (free as in no money) encryption software named OpenSSL.

Many OpenSSL versions are perfectly safe, only a few versions are affected, that is they contain a bug that allows encrypted information to be decrypted, that is finally to be read in clear text.

There is little we can do on our computers to avoid Heartbleed except avoiding affected web sites. Here are two places where you can check web site addresses for this bug. A web site address is the URL, what you type in the address bar of your web browser.

1. Heartbleed Test by Filipio.io seems to be privately run; just type over the example "Facebook" entry in the form. This site has lots and lots of detailed information about Heartbleed  and a lengthy Q&A page.
    
2. Heartbleed Test by Lastpass.com is professionally run by Lastpass.com, a password management service.
   For full disclosure: I use Lastpass, I am one of their customers.

And last but not least here is a list of affected web sites. A warning: This link leads to a forum entry with lots of subsequent discussions that you can safely ignore.

What to do if you use an affected web site?

Assuming that you have done above checking and you have in the past used an affected web site there is only one thing we can do:

Do not log into accounts from afflicted sites until you're sure the company has patched the problem. If the company hasn't been forthcoming -- confirming a fix or keeping you up to date with progress -- reach out to its customer service teams for information, said John Miller, security research manager for TrustWave, a security and compliance firm.

PLEASE give that website or company feedback; tell them that you will shun them if they don't fix their servers soon. If we don't speak up we give them the liberty to stay lazy and to ignore our concerns about this.

Don't be shy about reaching out to small businesses that have your data. Make sure their web site is secure. While high-profile companies like Yahoo and Google certainly know about the problem, a small businesses might not be aware of it, said TrustWave's Miller. Be proactive about the safety of your information.

Keep a close eye on financial statements for the next few days. If attackers can access stored credit card information it can't hurt to be on the lookout for unfamiliar charges on your bank statements.

Once you have gotten confirmation that the web site is fixed change passwords of sensitive accounts like banks and email immediately.

What to do if you have used the same password on more than one web site? Immediately stop this dangerous practice.

On important web sites, where money is involved for example, establish unique passwords for every such web site. And as usual, write the passwords down where you can find the note when you need it - you will need the note, believe me.

And last but not least at all: Your sleek Android smartphone could be affected as well! You find more about that here.

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.  

2014-04-07 WTKM Talking Points (Apr 07 2014)

Windows 8.1 Update 1 will go to Automatic Updates April 8th. Be warned, that will be up to 6 updates. BE patient!

Apple has fixed 27 vulnerabilities in it's Safari web browser for OS X

Linksys Routers can be hacked.You own any Linksys or Cisco router? Update router firware NOW.Many common models are at danger. Test if your Linksys/Cisco router is still supported. If not you have to replace it. "Not supported" means that the firmware can not be updated any more.

Cisco fixes SIX different vulnerabilities in it's Cisco and Linksys routers! Check your router for firmware updates now if you have a Linksys or a Cisco router!

Banking Trojan Caphaw distributed through Youtube ads! If you get ANY ads when on YouTube you need to call me; you are using the wrong web browser and/or your browser is not set up for safe browsing. Firefox and AdblockPlus rule.

"Micosoft scam calls" abound. I asked one of these callers which one of our five computers he was talking about. Fun...

Public WiFi-Hotspot? UN-safe by design! Do nothing requiring a password!

Malware in hoax emails warning recipients that they may have cancer.

Microsoft Word 2003, 2007, 2010, 2013, and Office for Mac 2011 are vulnerable to a newly discovered bug in handling RTF files. No fix yet.

Banks charge Target and one of it's suppliers (of computer security advice!) in a class action lawsuits. Already $172 million damage to banks and more to come.

New ransomware CryptoDefense made programming error and left decryption key behind. Be very careful opening ANY attachments. When in doubt ask!

Search all now-public NSA surveillance docs at your leisure. See The NSA Archive.

Microsoft spells out new rules for adware classification. Won't tolerate privacy probes or auto-installs. Let's see what that does to PuPs

.

2014 03 03 WTKM Talking Points (Mar 3rd 2014)

Linksys Routers can be hacked.

Update router firmware NOW (if you have any Linksys router).
Models E4200, E3200, E3000, E2500, E2100L, E2000, E1550, E1500, E1200, E1000 and E900 are at danger. Some of these models are no longer supported; that means you have to replace them."Not supported" means that there are no more updates for the firmware to fix problem!

Belkin Home Automation routers (WeMo) are unsafe.New variant of Zeus banking trojan horse virus "hides" in common picture file format (.jpg).

Again Adobe issues emergency patch for it's ubiquitous Flash Player.

You have to be on version 12.0.070

Apple fixes 10(!) major bugs in all it's operating systems.

Supposedly secure network connections could easily be hijacked.
True for iPhones as well! UPDATE!

Major upheaval at Microsoft. What will the new(?) people bring? Windows 8 fallout at work.

Banking Trojan Caphaw distributed through YouTube ads!

If you get ANY ads when on YouTube you need to call me; you are using the wrong web browser and/or your browser is not set up for safe browsing.
Firefox and AdblockPlus rule.

"Micosoft scam phone calls" abound.

I asked one of these callers which one of our five computers he was talking about. Fun...

New to computers and want to learn the basics? Try this web site.

New to the Internet? Want to learn the basics? Start here..

Voicemail via Email? No Way!

Here is yet another example of a scam I hear often about. This is a screen shot of what I saw in my email program:

At first glance a friendly, nicely formatted and really "professional" looking email.

Three things caught my attention before I would have clicked on "Listen";

1. Red highlight: The sender address seems to come from "@pushworth.com". Big discrepancy to the supposes (company?) name "Whats App".
   In my mind the warning lights went on.
    
2. Purple highlight: The sender disguised very well the actual route the email had taken. That shows technical know how and (criminal?) intent.
   By now the warning bells where ringing loud.
    
3. Blue highlight: When I rested the mouse cursor on the pretty "Listen" button the link behind this button translated to "casinotipps.net".  Casino tips and forwarding voice mails via email? Oh Please, don't think I am that dumb. 
   Now I was already chuckling; just another scam email.

On top of all that I have never given neither the phone company nor the cell phone carrier any instructions to "forward voice mails by email"; what an abstruse idea.

But I know from experience that there are simple souls out there who did click on "Listen"; although the mail they had gotten likely looked different.

Actually I should be thanking the creator of this scam because he keeps me in the business of cleaning up virus infected computers.

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents. 

New Twist - Old Scam

Whether you ever would read The New York Times or whatever your political stance is,


      if you have a computer you NEED to read this NYT article.

The age old story of "User Beware" with a macabre twist.

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.  

.

eFax Scam - New Variant Of An Old Trick

Just this morning I got an email supposedly coming from eFax and I thought I better document it here.

Here are screen shots of what it looked like in Thunderbird, my email program.

The sender address seems to be efax.com (green frame). But resting the mouse cursor on the link supposedly representing the fax the translation of the name in the link, that is the place where a mouse click really would take me to, that translation clearly shows a web site in Brazil (red frame). Do you smell the rat?

Just for fun I rested the mouse cursor on the link for Help instructions and that really would take me to the efax.com help page (blue frames).

Although I personally know some people in Brazil. needless to say that I neither clicked on the first link nor did I download the compressed file (.zip) nor would I ever have opened this .zip file. My acquaintances in Brazil all have my email address.

As I always say, user beware.

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.

  

NO to Office 2013, Office 365 and Microsoft Accounts in general

I stumbled over this article about lack of basic security features in Microsoft's cloud offerings.

I feel confirmed when I say

• do not use a Microsoft account
  
• do not use MS Office 2013 or MS Office 365
  
• do not use Sky Drive (Microsoft's cloud storage option)

For everybody using Windows 8 that means they should cancel their Microsoft accounts and they should convert the account on the computer to a local account.

If you can't find out how to do that, you know who can help, right?

At least Office 2013 can be used without a Microsoft account; I don't know for sure about Office 365.

There are many cloud storage services that do not entail the usual "Microsoft risks" for lack of a better word.

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.

   

 

2014 02 03 WTKM Talking Points (Feb 3rd 2014)

IMHO sensational: A working, usable office suite online!

Yahoo! Mail users urged to change passwords to something secure and unique (on Yahoo)

after security breach and theft of account login details!

Yahoo! serves virus infected Ads! No risk for my customers, they all have Adblock Plus!

I have said it thousands of times: Do not use Yahoo_anything.

SpyEye's creator arrested in Georgia. Worst banking trojan ever decapitated.

FileZilla FTP client versions 3.7.3 and 3.5.3 proven to be virus infected.

An epidemic of a new kind of malware; see:
       PuPs - No Virus But just as Nasty  and
       How Malware Gets Installed

Many more scam phone calls claiming computer infections.

Microsoft (and MS affiliates) do not know about us!
Do not let them work on your computer!
Do not give them any credit card information!

Intel will drop McAfee name and software sometime this year. Finally...

Many more scam emails claiming undeliverable packages, renewals of all sorts, product keys
et al.

Windows 8.1 IMHO only cosmetics. Pressure to create a Microsoft account much increased!

Neiman Marcus: 1.1 million cards stolen!
2,400 were abused quickly for fraudulent purchases.
POS terminals were virus infected!

Win XP? Your risk of virus infection is MUCH higher that of Win7/ 8 – for now.
Micro$oft will support Security Essentials on XP until July 14 2015!
Just shy of 30% PCs worldwide still on XP

Apple released major security updates. Who says Apple MACs are safe?

Please listen to WTKM on 104.9FM, Monday, Feb. 3rd 2014 from 10:00AM to 11:00AM.

Driver's License for Computers?

If you drive down the highway, you’re at risk of getting in a car wreck.

If you log onto the Internet, you’re at risk of identity theft, viruses and malware — no matter who you are or where you’re coming from.
 
Like safe driving, maintaining a secure computer is all about being attentive, defensive, proactive and educated. 
This is why drivers of cars need to be trained and licensed to drive.

This is why many computer professionals think computer users should be educated and licensed to browse the Internet and handle email.

What about your "Internet License"?

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.

 

 

Microsoft Accounts and Windows 8 – A Rant

In a nutshell, any email address can become a Microsoft account just by “registering” it with Microsoft (MS). Almost any live, usable email address is acceptable. But since we talk about MS it actually is not quite that simple; there are, for lack of a better word, implications.

Any email address with or issued by any MS service is a Microsoft account. Some of these services are Hotmail, Microsoft Passport, Microsoft Live, MSN, Outlook email service, .NET Passport, Member Services Passport, Messenger ID, Windows Live ID, Xbox Live ID, Zune/Zune Pass ID, Windows Phone and SkyDrive ID. To name only the most well known ones.

I documented my opinion about MS accounts already in October 2012 in my blog post “What does Microsoft want to do with Windows 8?”.

Have you ever set up a new Windows 8 computer? Or, even worse, updated from Windows 8 to 8.1? MS goes through quite some trouble and IMHO actually tries hard to literally trick you into setting up Win8 with a MS account. I wrote here in some detail about the tricks MS uses.

I smell a rat and my opinion voiced in “What does Microsoft want to do with Windows 8?” has only been confirmed by MS' shenanigans and seemingly desperate attempts to make us use a MS account.

With establishing a MS account you get automatically some GB of “free storage space” on SkyDrive, MS' cloud storage service. Again, that sounds pretty good, doesn't it? Like in “free is always good”. For the home user “cloud storage” is nothing but a glorifying name for a File Hosting service.

It may only be me but I am troubled by getting sucked into using SkyDrive. In May 2013 I documented my personal take on cloud storage; IMHO much more revealing is what the rest of the world thinks about this.

Disclaimer: Yes, I know that there are advantages to cloud storage and I use it to some extent.

The brighter side is that it is fairly easy to avoid all the implications of MS accounts and cloud storage, even when using Windows 8. Win8 can be set up to work nicely with a conventional local computer account without any direct connection to MS. And it works very nicely in desktop mode, just like we have gotten familiar with during the last 20 years. 

The main reason that MS gives for all this is that you can log into your MS account from many different computers or tablets or smart phones and you will have everywhere “your” desktop, the sane apps and programs, your individual settings and even via SkyDrive the same data files. Sounds almost too good to be true, right?

Smart phones are telephones with lots of added computer like capabilities and very small touch enabled screens.

Tablets are easily portable media consumption devices with added computer like capabilities and relatively small touch enabled screens.

Computers can be more or less of all of the above plus I can get work done on them. I can not write this blog on either a smart phone or a tablet! So far at least computers usually do not have touch enabled monitors (screens).

And frankly, do you know how heavy your hand gets when you stretch your arm forward only for two minutes? Thank you Microsoft, but I DO NOT WANT to be forced to stretch my arm and work with my fingers on a computer monitor; and so do literally all of my customers.

As usual I welcome comments and suggestions right here in the blog. Thank you in advance.

Click here for a categorized Table Of Contents.

Learning About Computers

During my last radio show (Jan 6, 2014 on WTKM 104.9 FM) a caller expressed his dismay about the demise of a good TV show with very helpful information and practical tips.

When I checked on the morning of Jan 7th I found a very interesting email from a listener with lots of information on the subject of computer info on TV. With that email author's kind permission (Thank you Jeremy R.) here is the full text plus an additional note he sent later. I have done only very minor editing but have added links to the web sites and shows mentioned and to persons as available.

I heard your radio show today.

I am enjoying the conversations you and Dave have been having when you are waiting for callers.

I decided to email you with some info about the TechTV show one of the callers talked about.

I missed TechTV when it went away, but now there are much better shows available online. I wanted to point your attention to some that are relevant. All of these are free and available on demand through their websites, or through set-top boxes like Roku, etc...

'The Screen Savers' (1998-2005)    (This is the one the caller talked about)

• A program on the old TechTV channel that no longer exists.
  
• The hosts Patrick Norton and Leo Laporte

• Revision3.comhttp://revision3.com/
  
• Patrick Norton from 'The Screen Savers' is now on Revision3.com
• Revision3 makes a variety of shows for varying degrees of computer skill.
• Some examples of their 20+ shows are:
• Tekzilla - News and brief How-To's much like TechTV stuff.  (host Patrick Norton)
• HD Nation - Focusing mainly on Home Entertainment computers and gadgets.  (host Patrick Norton) 
  
• GeekBeat.tv - brief technology news updates.
• The Ben Heck Show - in depth, hands on project building.
• Revision3 also makes a few shows purely for entertainment.

• TWiT.tv
  
• Leo Laporte from 'The Screen Savers' created his own network called TWiT.   ("This Week in Tech")
• Leo Laporte hosts most of the shows.
  
• Read about the transition from TechTV to TWiT here: twit.tv/the-twit-story.
• TWiT has 20+ audio and video broadcasts actively being produced.
• Various show topics include: Android Tablets, iPads, How-To, Home Theater, Free Software, Ham Radio, Security

• Category5.tv  (not related to the viewer's question)
  
• Based in Canada
• A relaxed show about current tech, including some hands on activities, and answering viewer questions.
• Airs LIVE every Tuesday night at 6:00pm Central Time.
• Viewers can ask questions by Phone, eMail, or Instant Message Chat
• Viewer questions range from quite technical to very basic.
• The host helps people with Windows and linux questions.
• Category5.tv is currently my personal favorite.
• Some episodes include:
• #327 - Fake Support Call Scammers
  Video recording of a 'Microsoft phone scam' in progress. 
  See what the scammers have people do on their computers.
  
  
• #321 - Making Windows 8 Look and Feel more like Windows 7
  
  
• #317 - Virus Advisory: CryptoLocker
  Interview with Adam Kujawa from Malwarebytes.org about Cryptolocker virus.
  
  
• #274 - Brother's Business Smart Printers
  Interview with Brother printer manufacturer.
  
  

Microsoft Phone Scam
I want to point your attention to the Category5.tv episode #327 - Fake Support Call Scams where they have video footage of what the phone scammers have people do on their computers.  The show notes page for that episode has a link to the last 30 minutes the guy spent on the phone with the scammers.  Now if someone says to me, "They called me up and asked me to do 'x-y-z'" I have a better idea of what they went through.

The scammers were clever, but not clever enough to notice that the machine they were hacking was a freshly installed Virtual Machine specifically set up for this purpose.

This was the first email and here is the additional note he sent with his permission to publish his information here:

One note about the shows being available on the Roku and similar devices...

Revision3 and TWiT have their own channel/app for various devices, while I believe Category5.tv has to be added as an ordinary RSS feed.

When TechTV went off the air, I missed not having that stuff to watch.  Now, there is more "Tech TV" than I have time to watch.  I am still getting caught up on episodes of Category5 that I have missed.

The video of the scam phone call includes little popup notes on the screen that briefly explain what the scammer is really doing, while he is saying something else.

Well, that was this. I publish this information without any warranty to be fit for any purpose.

But again I want to thank Jeremy R. very much for theeffort he put into assembling his email.

As usual I welcome comments and suggestions right here in the blog. Thank you in advance.

Click here for a categorized Table Of Contents.

2014 01 06 WTKM Talking Points (Jan 6thd 2014)

CryptoLocker lure victims with fake activation codes
     Adobe, Microsoft

 Hacker backdoors Linksys, Netgear, Cisco and other routers

Snapchat issues update in wake of 4.6 million user data breach
     Not one mention of "apology" or "sorry"

Slovenian jailed for creating code behind 12 MILLION strong 'Mariposa' botnet army

Skype's Twitter account, blog hacked to spread anti-Microsoft messages
     Message said not to use Micro$oft email. I spread that message for many years.

Privacy: I read an article How the NSA hacks PCs, phones, routers, hard disks 'at speed of light':
Spy tech catalog leaks
     Subtitle: It's not as bad as you thought - it's much worse

Passwords

Windows 8.1 and Microsoft account

Merry Christmas

My prayers for a blessed Christmas

and my best wishes for a happy, healthy 

and successful 2014.

Passwords - Again --- Updated 12/09/2013

I got this email from a customer:

. . . I heard on the news today that Google is one of many companies whose computers were recently hacked and that passwords were obtained.  I don’t use Google mail on my computer but rather Windows mail. However, in order to have access to Play Store apps, I had to open a Google account on my Samsung smartphone and that password is the same as my computer password. I just closed my Google account on my smartphone. Should I change my password on my computer and if so, how do I do that? I use that same password extensively for other applications. . .

Here is my reply:

You raise a heck of a lot of important questions in your text. Because the issues you are touching on IMHO are very important I will try to reply to every single part separately and interspersed in your text.

I heard on the news today that Google is one of many companies whose computers were recently hacked and that passwords were obtained.

A good example of uninformed sensationalist reporting. What literally ALL halfway decent companies stores are NOT passwords but encrypted passwords. That is technically and for hacking purposes a BIG difference.

I don’t use Google mail on my computer but rather Windows mail.

IMHO using ANY Microsoft email program puts your computer at a far greater risk that the stolen Passwords do. "only" two million passwords from together three companies were stolen; these affected companies together have many hundreds of millions of users. That makes the percentage of compromised passwords VERY small.

There were no reports on how these passwords got in the wrong hands. I have no information on this either but I suspect that some gang of miscreants had a well working virus program on many computers world wide and that virus program copied the passwords. Now THAT would be bad because the virus program would get the real and not yet encrypted passwords directly from the keyboard when they are typed.

Update 12/09.1023: I just read that it was actually 154 million accounts that got compromised. Now That's a different thing now.

 However, in order to have access to Play Store apps, I had to open a Google account on my Samsung smartphone and that password is the same as my computer password.

1. Exactly what do you mean with "computer password"? The one you type to log on to your Windows account or one that you use on any web site? The former is no problem, just change it locally on your computer. The latter poses possibly a risk.

2. Using the same password on more than one service is always a risk and should be avoided.

I just closed my Google account on my smartphone.

That does not eliminate risks from stolen passwords.

 Should I change my password on my computer and if so, how do I do that?

That depends on what exactly the password is used for that you mention. If it is for your local user account then google the name of your operating system and change the password; google something like "windows 7 change user password". You will get many pages with descriptions of how to do that.

I use that same password extensively for other applications. . .

That definitely is about the biggest mistake you can make. Please read the following articles on my blog for lots of background information:

    Passwords too simple and what to do about it.
    Hacked Passwords deals mainly with email issues.
    Passwords that are NOT a password
    Passwords the Latest


Especially the last article above has all the nitty gritty. Follow the link in "The article I read is here ".  There you find all the technical background you could possibly want.

Update 12/09.2013: Hackers often like to publish their discoveries, and the databases of hacked, stolen passwords were uploaded for all to see.  This allowed the people behind a rather useful website to create a searchable copy of the list, so that you can check whether your details appear on a list of some 154 million stolen online accounts and email addresses.

To find out whether your details do indeed appear on any of those stolen lists, just head to http://www.haveibeenpwned.com/ and type in your email address on the home page.  If that address is among any of the lists of stolen accounts, you'll be warned straight away.

Above two paragraphs are a literal copy from here.

I hope this long reply helps in addition to giving you a lot of information and confusion. Please keep asking.

As usual I welcome comments and suggestions right here in the blog. Thank you in advance.

Stay safe!

Virus Check BEFORE Download

I assume that you know about Virustotal (VT). If you still don't now than I am at a loss of words- which rarely if ever happens to me. But enough of my puny attempts on being funny.

With VT you can check any reasonably sized file (up to 64MB) that already is stored on your computer for viruses. What if you want to check a file for viruses before you actually download it?

If you use a web browser other than Internet Explorer you could install an extension.

• In Mozilla Firefox you can install the VTzilla extension.
• In Google Chrome  you can install the VTchromizer extension.
• In Opera you can install the VTopera extension. 

Thesae extensions make it possible to right click on a download link before you start the download. In the context meny that opens you will see an entry like shown here; the example was taken from VTzilla in Firefox:

 

VT will upload and test the file in it's usual manner and presto you have a good idea whether the file in question is "clean".

If you feel challenged by the idea to install an extension in Firefox don't despair, I can do that remotely. 

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.

2013 12 02 WTKM Talking Points (Dec 2nd 2013)

An epidemic of a new kind of malware; see:
       PuPs - No Virus But just as Nasty  and
       How Malware Gets Installed 

       These malwares increasingly embed Bitcoin mining into toolbars, toolbar helpers and
       search agents.

New zero-day hole in IE (all versions).

Many more scam phone calls claiming computer infections.

       Microsoft (and MS affiliates) do not know about us!
Do not let them work on your computer!
Do not give them any credit card information!
I have seen one case where these crooks used a known company name (iWon) to install PuPs (see above); they probably get money for every installation that they do.
The guys who did this one were not even good at it!

Fake Skype voicemail alert: Email comes packed with a variant of notorious ZeuS banking Trojan.
Messages typically come with subject line “You received a new message from Skype voicemail service”; it contains a copyright notice and a disingenuous warning that "Skype staff will NEVER ask you for your password via email".
The purpose of this email is to get you to download and open the attached 'voicemail' file; this then installs the Zeus trojan. 

Crypto Locker virus: Maintain regular backups of data, keep backups separate from computer.

CL encryption is essentially uncrackable (except by the NSA?).
CL infects all current versions of Windows, XP through 8.
If you are somewhat technically adept and/or have someone on your computer you can't fully trust and you want protection from CL then considerCryptoPrevent.
Protecting your computer from CL is easy with best practices (aka common sense).

Windows 8.1 rolled out Oct 17. NOT via Automatic Update, rather you have to go to the MS store!
 This forces you to use a Microsoft account!

Updating from 8 to 8.1
      BIG download (> 311MB). More details here (Oct. 2013)
      Too big for comfort on standard DSL connections.

New Windows 8 computer?

Don't use a Microsoft account! (privacy vs. convenience)
More info: What Exactly is a Microsoft Account
Either way MS tracks all searches, local & internet. (NO to Bing)
Turn off Smart Search
Use Classic Shell (free) or Start8 ($5) to start into desktop.
Install VLC media player (MS removed Media Player!)

Win XP? Your risk of virus infection is SIX times higher that with Win 8 - NOW.

Unpatched XP SP3 vulnerability with older versions of Adobe Reader than 11.0.04. XP users with the latest versions of Adobe Reader (11.0.4 and up) are immune. UPGRADE Adobe Reader.

Facebook is reportedly testing to track cursor movement (silently track a user's actions); tracks how individual visitors respond to ads for better targeting advertising!

Adobe's servers hacked. 38 million user names and passwords plus source code stolen.

Please listen to WTKM on 104.9FM, Monday, Dec. 2nd from 10:00AM to 11:00AM.

Warning - W A R N I N G - Warning

On October 23rd 2013 I wrote about a really, really bad new virus called CryptoLocker.

Back then, only three and a half weeks ago, CryptoLocker was an acute danger mainly in the UK, parts of continental Europe and in some Asian countries.

This has changed dramatically. Computer users in the USA get hit with this virus increasingly often. Since a few days I receive about five emails every day that offer me "free money" or pre approved credit cards "ready to be shipped" my way. Would I ever click on a link in such an email? Would I ever be tempted to open one of the attachments? You bet not!

A free(!) protection method is available but it will interfere to some degree with normal computer operation. When this happens the computer user needs a certain amount of technical know-how to correctly diagnose the reason for the interruption and the to create an exception; this has to happen every time when it happens. If you can do that you should look at CryptoPrevent.

For everybody else I shout as loud as I can:

Disconnect your external backup drive when the backup is done!

If you don't disconnect the backup drive your backup files will be encrypted as well! They are totally useless once encrypted.

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.

Updating to Windows 8.1?

Updating from Windows 8 to 8.1?

The update process is quite daunting and time consuming as I described in this article about the tricks Microsoft uses.

So far at least this update is not mandatory. It brings IMHO only minor cosmetic changes and contains nothing that my customers don't already have; point in question here is a Start button and a decent desktop.

Additionally I have read quite a few reports of sometimes major problems with this update. These problems do not only pop up on older computers that do not have features in their processor that only recently became common.

I have read as well of problems on brand new computers that were bought with Windows 8 installed by the manufacturer.

My conclusion: There is no technical need to upgrade. For the time being I recommend to hold off.

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.

2013 11 04 WTKM Talking Points (Nov 4th 2013)

An epidemic of a new kind of malware; see:
       PuPs - No Virus But just as Nasty  and
       How Malware Gets Installed

Many more scam phone calls claiming computer infections.

Microsoft (and MS affiliates) do not know about us!
Do not let them work on your computer!
Do not give them any credit card information!
Six customers in three weeks; two "fell" for the scam!

Windows 8.1 rolled out Oct 17. So far NOT via Automatic Update!

New Windows 8 computer? 
Don't use Microsoft account! (privacy vs. convenience)
More info: What Exactly is a Microsoft Account
Either way MS tracks all searches, local & internet. (NO to Bing)
Turn off Smart Search
Use Classic Shell (free) or Start8 ($5) to start into desktop.
Install VLC media player (MS removed Media Player!)

Updating from 8 to 8.1:
BIG download (> 311MB) More details here (Oct. 2013)
Too big for standard DSL connections

Win XP? Your risk of virus infection is SIX times higher that of Win 8 - NOW. 

Facebook is reportedly testing to track cursor movement (silently track a user's actions); tracks how individual visitors respond to ads for better targeting advertising!
 

India: Named ransomware capital of Asia Pacific; online crime costs the country (estimate)
$4bn in 2012, according to Symantec.
Average cost per victim $207; below worldwide average of $298.
See my blog about Crypto Locker.

Adobe's servers hacked. 38 million usernames and passwords plus source code stolen.

Please listen to WTKM on 104.9FM, Monday, Nov. 4th from 10:00AM to 11:00AM.

Windows 8: What the Rest of the World Thinks

Recently on a Microsoft run web site and Windows 8 blog I ran across a reply to an article written by a Dutch IT consultant.

It summarizes what I have glanced from many, many similar comments I have read. I have modified some language and grammar quirks and fixed some misspelled words to convey the meaning correctly and in correct English.

Yes  it's true; Microsoft wants us to massively migrate to Microsoft based cloud based services. But in my country that will not happen as Microsoft wants it, especially   because these "virtual cloud services" are to 85% physically located within the USA.  

That is for most foreign people simply unacceptable. It's not only for reasons like privacy, piracy, taxes, company secrets - there is also a difference in mind-sets.

What if our sensitive data sits there in a physical data center somewhere in the US of A, and 'shit' really starts happening, like for instance war, wide spread diseases, natural disaster, terrorism attack, you name it -  anything could happen anywhere.

Foreigners don't trust CIA/FBI/NSA that much, we learned from the past months.

My customers are saying..., even refusing, to migrate their financial and sensitive business data to somewhere in the 'Microsoft' or even  the 'Amazon cloud'; abroad, unknown where it really is, in a far away foreign country, and nobody knows, or even checks what is happening to their data. It may be leaked to the NSA, via a built-in back door when Micro$oft sold this opportunity to the NSA/US-Government.

 No, sorry, not with us!  We aren't like that!

We even don't come close to this kind of behavior.

Yes, people in other countries don't trust their sensitive data into American hands; they approach privacy questions with a totally different mind set.

Maybe Microsoft's management better begin to acknowledge that not everybody will follow to where they, Microsoft and others, want to lead us?

What may be good for Microsoft may not be that good for the other 310+ million Americans. And what may be "good for Microsoft's America" may not be that good for the other 95% of the world population. 

In my opinion this is NOT a technical problem, it is an ethical problem. There are just too many of us who check their ethics and morals at the entrance of the office building before they begin their daily jobs.

No, it's not government agencies or organizations or companies that "do the wrong thing"; all these entities are run by people that collectively make questionable decisions.

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.

How Malware Gets Installed

You hear from me that your computer got infected with malware, especially PuPs, and you ask:

"How did that stuff get on my computer? I did not download or install it".

Sorry, but in most cases you did give permission to install that garbage alongside some legitimate install or update. You did not do it consciously, you got duped or tricked into allowing the installation. See this article for just one all too common example.

These tricks can have many different shapes and forms. They all are designed to trick or fool us into allowing the garbage to get installed alongside a legitimate program or update. User beware!

One of the more and more common forms is a legitimate install or update that asks something along the lines of

• Default (or Express) install (recommended)
• Custom install (for experienced users)

No matter whether you consider yourself to be experienced or not, if you click Default (which always is pre-selected!) or just click on the Next button you likely get PuPs installed. By now even software from well known names does that! Just as an example: Oracle's Java and Adobe Reader are bundled with PuPs; most downloads from well known download portals are by now loaded with PuPs. Why is that happening?

Simple answer: Money! The authors of PuPs pay for their stuff being bundled with legitimate software. There is a lot of money to be made from advertising!

Distributing viruses is illegal, distributing "search helpers"  or tool bars is not!

My advice: When you have to choose between Default and Custom installs always(!) click Custom; it is the only way to check for PuPs because so far at least they are being offered with some sort of a choice to decline or skip them.

If you are in doubt take a screen shot of the window(s) that sparked your suspicion, postpone the install and ask me in an email about it; don't forget to attach the screen shot please.

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.

Beware the Tricks When Updating to Windows 8.1

Oct. 26, 2013 Important Update: Please pay attention to the text after #6 and #7 below.

Just to have it done I decided today to update a customer's system from Windows 8 to 8.1. A few things caught my attention:

Depending in the speed of your internet connection and on the speed with which Microsoft delivers the download brace yourself for anything between 15 minutes and one to three hours - just for the download.

The installation speed will depend mainly an how fast your computer is and how fast or slow your disk drive is; it will take anything from 20 minutes to an hour or even more.

Microsoft came up with new tricks to get you to set up a Microsoft Account. BEWARE! I simply left the fields for name, email address and so on empty and clicked Next. Totally not intuitive but I got the old local account back. See below after #6.

The last of the preparation screens brought the surprise with the following six questions, all with ON (that is Yes, do it) preselected, quoted literally but emphasis added by yours truly:

1. Use Bing to get search suggestions ad web results in Windows Search, and let Microsoft use my search history, location, and some account info to personalize my experiences
    
2. In Internet Explorer, use page prediction to pre-load pages, which sends my browsing history to Microsoft
    
3. Let apps use my name and account picture
    
4. Let apps use my advertising ID for experiences across apps
    
5. Let Windows and apps request my location from the Windows Location Platform
    
6. Get better protection from malware by sending info and files to Microsoft Active Protection Service when Windows Defender is turned on.

Do I need to talk about the obvious privacy issues with points 1 through 5? I hope not...Needless to say, I set all switches for questions 1 through 5 to OFF.

Point #6 makes sense, we all need better malware protection. But at this point in an upgrade I would appreciate to have at least some sort of "What is that?" available to learn what info is reported to Microsoft. But no luck here, there is nothing of this kind.

By now I have updated two machines from Windows 8 to 8.1.

The first machine I updated was an OEM installation; this means that Windows 8 was installed and licensed by the manufacturer and delivered with the computer. The system was set up to work with a local account.

The second machine I updated was my own laptop that I always have with me on customer visits; it runs a retail copy of Windows 8, that is a copy I bought myself from Microsoft in the early days of Windows 8. This machine was set up to work with a local account as well.
 

To my surprise the second machine showed during the initial setup of Windows 8.1 two more windows. At that stage of operation I did not yet have a screen shot program available so I need to try to describe these windows verbally.

The first of these additional windows asked without any explanation for my email address, name and other IMHO personal information. I did not supply any information but "took the plunge" and just clicked Next.

The second screen then gave in small, easy to overlook lettering the option to "Continue with your local account". That was what I did and the machine works beautifully.

The text after #6 IMHO shows two things:

• Microsoft becomes ever more ruthless and blatant in trying to lure us into using a so called Microsoft Account. IMHO this is arm twisting!
   
• There is a functional difference between updating an OEM version and and a retail version of Windows 8. This is in opposition of what Microsoft people say in their company blogs.

If you have a metered internet connection with a cap on the volume of data per month then numbers 1, 2, 4, 5 and 6 increase the risk of going over the data limit; and that gets expensaive really fast.

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.
  

Warning: Old Fiend With New Muscle

In the title I say "old fiend" and it is an old adversary in new clothes and with significantly more muscle. 

Instead of repeating the background story please first head over to my September 2012 article and come back here after you have read it.

So what's new?  Besides the new name, Crypto Locker, a couple of major improvements have been made to that nasty piece of maliciuos software:

• The encryption is now "NSA grade", meaning there is no way out! Your data files most likely will remain lost!
   
• The ransom has been raised in some variants of this malware  to close to $1000.
   
• Now even files on other than the system drive C: will be encrypted. That renders restore partitions useless.
• Is your backup disk permanently connected to the computer? Then the files on this drive get encrypted as well and all your backups are totally useless!
   
• Now even files on network connected other computers can get encrypted.
   
• Many victims that actually did pay the ransom got a decryption key that did not work! Their files remained inaccessible and were totally lost.
   
• To pay ransom in some instances credit card information was given to the obviously wrong people; credit cards got maxed out in minutes! That is much more trouble than the loss of years of pictures, emails and other files!
   
• Many attempts to save files turned out to be more expensive than a brand new computer would have been, Even with a new computer your files remain lost!

So far, and that may change soon, CryptoLocker 

• arrives on victims computers in an email from an arbitrary sender they often don't know.
   
• arrives on victims computers as an email attachment; this requires the victim to explicitly execute the attachment, that is double click on it and eventually even ignore the warning from Windows about running a downloaded program.
   
• arrives on victims computers after the victim clicked on a link in an email without first checking the link and it's real target.

You say you don't do either of these arguably fairly dumb and dangerous things? Good for you! Are you 100% certain that everybody who eventually uses your computer is as careful, as attentive and as cautious? Think about your sweet teenage granddaughter, your kid's friends, visitors and so on.


You ask why your anti virus program did not catch the bad program? Simply because this form of CryptoLocker is new. It requires time and quite some effort to design detection methods and find secure ways to neutralize these modern and very sophisticated threats.

As of this writing we all are unprotected and need to use due diligence. Always wear your common sense hat!

The only currently known "protection" against damage by CryptoLocker is to have a recent image backup of your system drive and/or to have a set of restore DVDs that were created when the system was still functioning correctly.

If you need to use either of the aforementioned a System Repair disk is required. Did you already create one?

If you need help to set up a sensible backup routine and/or to create the disks mentioned above please contact me. You find a useable email address in the left sidebar at the end of the text titled "Welcome".

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.
 

How To Buy A New Computer

Microsoft will drop the very last vestiges of support for Windows XP on April 8th, 2014. These computers have to be replaced by then!

I found an interesting article written by Microsoft's Director for Trustworthy Computing. You could read that rather tedious article or just settle for this quote:

As for the security mitigations that Windows XP Service Pack 3 has, they were state of the art when they were developed many years ago. But we can see from data published in the Microsoft Security Intelligence Report that the security mitigations built into Windows XP are no longer sufficient to blunt many of the modern day attacks we currently see. The data we have on malware infection rates for Windows operating systems indicates that the infection rate for Windows XP is significantly higher than those for modern day operating systems like Windows 7 and Windows 8.

To me that says loud and clear: Abandon Windows XP as fast as you possibly can!

Although Windows Vista was released seven years after XP I find many Vista machines from the early days of Vista that are mis-configured, mostly with way too little RAM (main memory) and technical limitations that would not allow to expand RAM beyond 2GB. I strongly recommend to upgrade these machines as well.

What new computer should I buy?

One of the first questions I often get asked is “Mac or PC?”. My reply is always the same: A MAC is almost always three to four times as expensive as a technically comparable PC. Plus you buy yourself into a very well maintained “gated community”. Any additional software for example will be more expensive and in the MAC world you find a much, much more limited selection of good free programs.

Those of my customers that switch to a MAC usually have compelling individual requirements and reasons. They accept the steep learning curve and the higher cost.

And opposite to common perception MACs do know viruses and are just as susceptible to browser based attacks and hijacks as PCs are.

There may be a difference in quality of the components; for my customers that is rarely an issue. I hardly ever recommend a rock bottom priced computer and decent average quality is available at very reasonable prices.

Where to buy the new computer?

I hesitate to write it down but many, many of my customers admit freely that they are not enough tech-savvy to go to a computer store; I recommend to simply avoid the risk of being sold much more than is really needed.

I offer to assist in selecting a suitable computer at a reasonable price. Buy it on-line at one of the larger, dependable and trustworthy dealers. Sometimes we find deals that seem to good t be true.

All-In-One, Desktop or Laptop? 

The one big difference that I always point my customers to is the text size on the screen. The nature of the beast dictates that things on a laptop screen are smaller than on a decent monitor. For people “up there” in age and/or with eye issues (like your's truly) this should be the major factor in that decision.

If on the other side you travel a lot or if you live for several month “down south” then a laptop may be the better solution because of the easier transportation.

All computers are built with mass production techniques. It is always a remote possibility to get a “lemon”, that one piece out of thousands that causes trouble.

All-In-One

This kind of computer has really “come of age” lately. A few weeks ago I bought a new computer for my wife, an All-In-One with a gorgeous 23 inch screen, 1TB disk drive, a fast 3Ghz dual core processor, built-in wireless and webcam. Needless to mention that she loves it.

The biggest advantage from the housewife's viewpoint is that there is only one cable going into the back of the machine!

Desktop with monitor, keyboard and mouse

If you already have a nice flat screen monitor and prefer a desktop computer, by all means just get another one. Very reasonably equipped standard computers cost between $300 and $500.

Beware of some sales rep talking you into a system with a touch screen. Do you know how heavy the hand gets when you stretch your arm out for only two minutes?

Touch screens are okay on tablets and phones; I don't see their usefulness in a classic computer environment; as usual, your views may differ.

Touch screen monitors are (so far at least) clearly more expensive than conventional flat screen monitors. It is a new technology that has had no time to mature yet.

As far as brands go: My reservations towards Dell and HP are well known; I just can not recommend to buy from companies that have deliberately lied to their customers (Dell) or still install at best questionable software.(HP, Sony and Samsung for example).

During the last two or three years I have recommended many Gateway desktop computers. Gateway (the brand!) is owned by Acer.

Laptop

Screen size is always measured in the diagonal! I recommend at least a 15.6” screen; laptops with 17” screens are clearly heavier than their 15.6” cousins.

The only brand I recommend is Lenovo. Their laptop computers are designed in the tradition of IBM laptops from long gone times. They are mostly just a tad better than the competition.

How much Memory?

Memory, main memory or RAM denotes the computer's internal work space. The more main memory the computer has the more programs can work at the same time.

For normal household usage 4GB of main memory (RAM) in a Windows 7 or 8 machine has proven to be enough, no matter was the sales rep at the store told you.

If you use any CAD/CAM software or Adobe Photoshop or if you edit videos then you want 6 or 8GB of RAM or even more. Most heavy duty users know that and buy accordingly.

What processor?

My typical home use customer will not experience lots of differences between an AMD and an Intel processor (CPU). If you actually really do create your own family movies you want an Intel i7 or i5 as fast as your budget allows. For everybody else the speed of the processor is more important than who made it.

Dual core processors are the standard now. Here a warning: When the store clerk sings the praises of an AMD quad core CPU he/she dupes you. AMD quad core means that you get two CPUs and two graphics processors in one chip. Marketing at it's best...

Laptops have thermal limitations; there just is not enough space in a laptop to create sufficient air flow to cool a fast CPU. Laptops in a reasonable price range tend to top off at 2.5 Ghz.

Desktop and all-in-one computers usually do not have the stringent air flow limitations of laptops Thar is why I recommend the faster CPU within reasonable limits and budget constraints.

In my experience a desktop with an Intel i3 3.4 Ghz CPU is faster than the same computer with a more expensive i5 with only 2.3 Ghz.

I see cheap desktop computers with 1.4 Ghz CPUs being offered. In every day usage you may only occasionally experience some sluggishness. But when Microsoft gives us a big update Tuesday the 1.4 Ghz computer may easily need 45 minutes to finish the updates versus five to eight minutes for the 3.4 Ghz machine. 

What about hard drive size?

The hard drive, the internal disk drive with moving platters supplies the storage space where the operating system, all programs and all data files are stored.

Modern computers offer typically from 320GB to 1 TB of storage space which definitely is enough for household usage. Only if you or your teenager download full length movies you can fill up these large drives.

Windows 8 or Windows 7?

You can try to find a Windows 7 computer but it will be $100 to $150 more expensive than the technically same machine with Windows 8.

If you buy Windows 8 you will likely want me to adjust a few settings to run the computer in desktop mode, just as you have been used to since 1995. I would love to help you “taming” Windows 8.

Do you have your software ready?

If you are replacing an older Windows XP system you may have an old version of Microsoft Office that originally came with computer. These licenses are tied to the machine they came on, they “die” with the computer.

Even if you still have the installation disks for MS Office XP or MS Office 2003 I strongly recommend NOT to install them on new systems. They are by now as hard to keep secure as Windows XP has become hard to keep safe..

One of the main reasons for new software versions is security against attacks by viruses and so on.

Remember: It is NOT possible to safely transfer programs directly from an old to a new computer, even if there is software claiming to do just that. Programs have to be installed on the new machine and that is only possible if you have your install disks and eventually required license or product keys at hand.

If you only want to create or edit Microsoft Word or Excel files I recommend Libre Office, a very good product developed out of the original Open Office.

If you use any other "old" software you have to check with it's manufacturer that it is suited to run on a computer with Windows 7 or Windows 8 Desktop Mode.

Where to Buy?

Naturally you can go to any store that sells computers. Just keep in mind that their prices need to pay for the brick and mortar buildings and the sales people there.

Most brick and mortar stores do not service a computer you buy from them, they usually send it to the manufacturer for repairs; then they charge you what the manufacturer billed them plus a margin for their efforts.

All too often the sales “representatives” are nothing more than high school or college students that “know about computers”.

TIPS!

• If you have wireless in your house, get a computer with wireless already installed in both laptop (standard) and your desktop where it is not yet standard, but worth getting!
• Buy an extended warranty only if you buy a a business computer; your business needs to be running and usually can't afford longer computer down time. Some of these extra warranties come with guaranteed same day or next day assistance.
• For obvious reasons I recommend NOT to buy from a rental center!
• Stay within your budget; temptations are plentiful!

Set it up

Certainly you can set up a new computer yourself.

With Windows 8 Microsoft has elevated “arm twisting” to a whole new level, IMHO at least! You definitely should NOT ever use a so called Microsoft account! Read this for more background information.

If you feel more comfortable to have the computer set up by a professional correctly and with added safety features then please read this article about my Set Up job, I would be glad to help.

As usual I welcome suggestions and comments right here in the blog.

Click here for a categorized Table Of Contents.