Pages

Showing posts with label Microsoft. Show all posts
Showing posts with label Microsoft. Show all posts

Wednesday, 7 September 2011

Internet Explorer cookie contents - the new format analysed





Microsoft changed the way that Internet Explorer cookie files work and randomised cookie filenames, for security reasons; the cookie text files now have random names which don't indicate the name of the website that saved the cookie, and you have to open up each cookie file individually to check what that is.

However, you can still view the contents of all your IE cookies, unmangled, by exporting your cookies to a single cookies.txt file. Then if you open up that cookies.txt file, you can see the cookie info, in a much more comprehensible, intelligible user-friendly format, eg:

Webtrends seems to be used by Microsoft for recording web visitor analytics & statistics info.

I compared the contents of a couple of the new cookies against the cookies.txt versions to try to figure out how they work. I found that if you copy and paste the text from the cookie file into something else (eg a new text document), the info is broken up into separate lines (ie there's hidden new lines to separate the different components of the info).

For example, the contents of a Twitter cookie file named J0R4GWEF.txt, which like the other contents of cookies appeared to run continuously on in the txt file, was split up like this:

guest_id
v1%3A131542058071389408
twitter.com/
214748475215010693123032155316242192030174605*

The cookies.txt equivalent of that was:

twitter.com TRUE / FALSE 1378897943 guest_id v1%3A131542058071389408

So that helps to figure out the new format of the cookie file. The elements seem to be in this order:

  1. variable name (eg "guest_id")
  2. variable value (eg "v1%3A131542058071389408") - the equivalent of the old "guest_id=v1%3A131542058071389408"
  3. domain name (ie the website which set the cookie, eg "twitter.com/")
  4. something I haven't figured out yet (in the example above, it's "214748475215010693123032155316242192030174605") - but it must convert to the expiration date for the variable (ie 1378897943 in the example above), which traditionally is the number of seconds since 1 Jan 1970, and shows up as the "proper" figure in the cookies.txt version. Maybe this long figure also contains other info about the cookie file
  5. * symbol - which marks the end of this variable, and the start of the next variable set by the website, whose name etc follow in the same order.

I worked out the purpose of the * from looking at a single Google cookie file, for example these contents, of a single txt file:

PREF
ID=15025770280c4f56:U=8cbfd7d77ff8ecf4:FF=0:TM=1315398473:LM=1315408615:S=zAzaJeJ5lq1Y-EEk
google.com/
1536
521981312
30321428
744646208
30174577
*
NID
50=IVMzsW2RssDmmdt21XYqM-m6GMBe731GqCispetEG495dEdHdl_tlLqIv8h8tINpCg1kI2lgsAgLheW-TVQzbGoBoiHfBjSJuhOPJSEfWVNTw-H-_Nt16tyNCyIL2zCf
google.com/
9728
2103298560
30211390
722926208
30174577
*

- showed up in the cookies.txt file as this:

google.com TRUE / FALSE 1378844158 PREF ID=15025770280c4f56:U=8cbfd7d77ff8ecf4:FF=0:TM=1315398473:LM=1315408615:S=zAzaJeJ5lq1Y-EEk

google.com TRUE / FALSE 1331583355 NID 50=IVMzsW2RssDmmdt21XYqM-m6GMBe731GqCispetEG495dEdHdl_tlLqIv8h8tINpCg1kI2lgsAgLheW-TVQzbGoBoiHfBjSJuhOPJSEfWVNTw-H-_Nt16tyNCyIL2zCf

Final example, from a Facebook cookie:

eLlnTol8k9yayreWIGxF-h6m
facebook.com/
2147492864
3767864320
30321455
3978419216
30174604
*
translates to:

facebook.com TRUE / FALSE 1378856079 datr eLlnTol8k9yayreWIGxF-h6m
datr

I've not yet worked out how the name of the cookie text file relates to anything in its contents (which no doubt is part of the purpose of the security fix!), so you still can't tell which file was set by which site without opening up each file. The order of info in the cookies.txt document doesn't match the order of the dates that the cookies were created or modified, and they're not in alphabetical order of domain name either. But at least it's possible to check out all the contents of all cookie files at once.

Internet Explorer cookie names change





Worried that your cookie filenames have changed to incomprehensible random strings of letters and numbers? No need. Microsoft has, for security reasons, changed the way IE cookies are named. This is to improve security and reduce "cookiejacking", addressing one way in which attackers might be able to access your cookies (which could include your login information etc).

Side effects: some apps depending on the old cookies names system broke, eg CCleaner and WinPatrol. Also, it's now harder for users to figure out which cookies were set by which websites, as you can't tell the website name from the cookie name anymore. You have to open up the cookie file to check.

However, other browsers like Firefox aren't affected by the change - it's Internet Explorer only.

Old cookie names structure

Internet Explorer cookies used to have filenames with the structure: yourcomputerloginname@partialdomainname.txt eg johnsmith@microsoft.txt (or johnsmith@msdn.microsoft[2].txt etc).

IE cookies are typically located in your AppData\Roaming\Microsoft\Windows\Cookies folder (to find the AppData folder, click Start, in the search box type "appdata" without the quotes and hit Enter. If that doesn't work try "%AppData%" again without the quotes which may go straight to the "Roaming" subfolder).

The security hole, and update

However, in August Microsoft released a Cumulative Security Update for Internet Explorer (2559049) which (according to Microsoft Security Bulletin MS11-057) addresses a "Drag and Drop Information Disclosure Vulnerability CVE-2011-2383" which existed because IE (all versions) didn't properly restrict access to store cookie files.

In more detail for the techies, before the update Internet Explorer did not "properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue".

This vulnerability meant that "An attacker who exploited the vulnerability when a user views a Web page and performs a drag-and-drop operation could gain access to cookie files stored in the local machine."

What the security fix changes

To fix the vulnerability, this update modified how Internet Explorer accesses locally stored cookies, and how it manages cookie files. These changes included changing how Internet Explorer sets file names for cookies, to help make cookie file names less predictable.

Reportedly this change has been seen in several Windows operating systems, ie XP, Vista and Windows 7, and several versions of Internet Explorer including IE8 and IE9 (which would make sense as Microsoft's info says the vulnerability affects Internet Explorer 9 and previous versions).

A Microsoft blog explained the change - see the "Cookie Filenames are Randomized" heading. It's now harder for attackers to guess the location of a particular cookie as IE cookie files are now named "using a randomly-generated alphanumeric string. Cookies are not instantly renamed on [the security] upgrade, but are instead renamed as soon as any update to the cookie’s data occurs."

Consequences of the cookie name change

Now, cookie names look like this:

As mentioned earlier, certain software depending on the old system doesn't work anymore, and will have to be tweaked.

From the viewpoint of those protective of their privacy, while you can't see the website's name from looking at the cookie filename, you can still see it if you open up the cookie in Notepad or other text editor.

For example, here's the contents of cookies saved by Microsoft when I visited and then re-visited their webpage about the cookie change. You can see "microsoft" in there:

And here's the contents of a cookie saved by Google when I searched for info on the cookie change using the search box in Internet Explorer. Again, you can see "google.com" in there, although the filename is now "25Z1H29G.txt", and no longer mylogin@google.txt:

Link

For more details of how it seems to work behind the scenes, I've done a separate blog post on how to view the contents of your Internet Explorer cookies in a more user-friendly way.

Saturday, 12 June 2010

New Windows XP security issue - fix for non-geeks





For those with Windows XP or Windows Server 2003 there's a recently discovered security issue involving Windows Help and Support Center which could allow bad hackers to take over your computer. For this one, though, you're OK if you're on Vista or Windows 7.

Microsoft said "This vulnerability could allow remote code execution if a user views a specially crafted Web page using a Web browser or clicks a specially crafted link in an e-mail message." (See also this Microsoft blog post.)

How to fix the vulnerability

This zero day vulnerability doesn't seem to have been exploited yet, but for non-technical readers, the easiest way to protect your computer is to use this automated hotfix from Microsoft (direct link). That page also contains a link to undo or disable the fix as and when a permanent security update is produced and rolled out by Microsoft.

It's more of a workaround than a fix, and be warned that doing that may block innocuous activity, e.g. some of your Control Panel links may stop working. (You could undo the fix temporarily then re-enable it when you're done, perhaps!)

Incidentally the way this issue was reported by a Google security researcher (full details were published before a fix was found) has raised some hackles at Microsoft in relation to "responsible disclosure" of security vulnerabilities.


Wednesday, 31 March 2010

Internet Explorer: critical security updates





Microsoft have just released a set of important security updates for Internet Explorer for Windows to fix some critical vulnerabilities, so if you don't set your Windows updates to happen automatically, you ought to go update your computer manually ASAP.

See Microsoft Security Bulletin MS10-108 for more info.

Monday, 1 March 2010

Microsoft browser choice: which browser, or how to get rid of the update item?





Windows users may have noticed these last few days that in Windows Update if you click to view the "important updates" that are available, the list includes "Microsoft Browser Choice Screen Update for EEA users of Windows.."

If you didn't click the "More information" link to find out what it's all about, well it's to do with Microsoft's agreement with the European Commission, after many years of toing and froing, to offer Windows consumers a choice of browsers (even if Microsoft's Internet Explorer is their default web browser) - see this Microsoft blog post for the history.

Apparently 77% of Britons don't know about it, though hopefully now the BBC have covered the story that percentage will have reduced!

Interestingly, the browser choice screen update is UNticked by default, so a user has to actively choose to tick the checkbox before it's downloaded.

According to Microsoft:

"This application creates a shortcut on your desktop. This shortcut lets you visit a Web page in which you can select which Web browser you want to install. Additionally, the first time that you log on to the computer after you install the application, Windows Internet Explorer starts automatically and displays the Browser Choice Web page.

Notes

If your computer is running Windows 7, the Browser Choice application removes Internet Explorer from a pinned location on the Start menu and in the taskbar.
If you do not set Internet Explorer as your default Web browser, the Browser Choice application does not make any changes to your computer."

Which browser?

If you want to choose a new browser, which one will you go for?

As regular readers of ACE know, in fact I use all the main Windows-compatible browsers; there's absolutely no reason why you can't have them all, apart from disk space or memory, and these days most computers are fine for that.

Firefox. I think Firefox with NoScript is probably the most secure, and the most flexible and powerful given that you can get loads of third party extensions (TabMixPlus is the other essential extension, in my view, plus Greasemonkey for my Blogger customisations). I use that e.g. if I'm not sure about a site I'm visiting. I have a master password and use it for convenience with lots of sites requiring login (with cookies saved for sites I regularly log in to, but the other cookies deleted on closing the browser). Not banking sites, though.

Internet Explorer. I use IE for online banking sites, because most banking sites will work with it. Similarly for some other sites, when I'm ordering online. Also, if I want more privacy while browsing, while I'm logged in to Google on Chrome I'll browse in IE (or indeed Firefox or Opera) so that Google can't track which sites I visit in the other browsers - as long as I'm not logged in to Google on those browsers too, of course.

Opera. My absolute favourite for speed, lightning quick, so it's good for research - I can have loads of tabs open easily, saving them in a single session for a single topic. But not all sites will support it, especially login sites, and I don't think the built-in cookie control is fine-grained enough. And Google Desktop Search, which I use mainly to keep track of sites I've been viewing, doesn't index sites visited via Opera (or for that matter Chrome, oddly enough!)

Google Chrome. Quite fast, but not as fast as Opera. It's good that extensions are now possible in Chrome and some Greasemonkey scripts work in Chrome, but there are 2 big disadvantages. The tab switching puts lots of people off - if you try to Ctrl-Tab to switch tabs, it goes to the one on the left, not the most recently used (MRU) tab, which to me is critical from a workflow viewpoint. Also, if you have lots of tabs open, as I like to, and you switch to a different tab, it takes quite a while for the tab's contents to display (no such problem with Opera). I'm convinced that Google have been heavily advertising Chrome in the EEA these last couple of months, e.g. London Underground Tube posters, in order to make the Chrome logo familiar to consumers so they'll be more likely to select it in the choice screen.

How to turn off the update item

If like me you've already got the browsers you want and don't want that browser choice Windows Update item to keep cropping up nagging you daily, here's a tip: the easiest solution is to get rid of it by right clicking on the item, then choosing "Hide update" and clicking "OK":

Monday, 21 December 2009

Vista: Windows Update error 80070570 problem - how to fix





If you have Windows Vista on your computer and you get a problem when Windows Update tries to run to update your computer, with this error message:

Cumulative Security Update for Internet Explorer 8 in Windows Vista (KB972260) failed to install with the error code 80070570

or other updates with Windows Vista error 80070570 or error 0x80070570 (which apparently means ERROR_FILE_CORRUPT), then you can try these troubleshooting tips to see if they fix the issue.

First, try disabling or closing your security or anti-virus software (McAfee, Norton etc) or other anti-malware, and try Windows Update again; then re-enable the protective software.

If that still doesn't work, it seems the issue could be down to:

  1. Windows Update not working properly, or
  2. The Windows Update Temporary folder having got damaged or corrupted.

In my case, it was no. 2. But here's how to sort out no. 1:

  1. Click the "Start" button bottom left, in the "Start Search" box, type: "services.msc"
    (without the quotes) and hit Enter. (If you have to OK or type a password, do so.)

    services.msc
  2. In the window that comes up, double click "Windows Update":

    A dialog box now comes up. Go to the "General" tab. If the "Startup Type" is "Disabled", use the dropdown to change it to "Automatic" or "Manual":

  3. Click the "Stop" button under "Service Status".
  4. Then click the "Start" button (to the left of the Stop button), and click OK.
  5. Rinse and repeat with the "Background Intelligent Transfer Service" service in the Services window (the one where you found the Windows Update service), to stop and start that again too.
  6. Now try Windows Update again (Start menu, Windows Update) and see if it'll work properly now.

If that didn't solve your problem, try renaming the Windows Update Software distribution folder as follows:

  1. Close the Services windows you opened earlier.
  2. Click the "Start" Button, "All programs", then"Accessories".
  3. Right-click "Command Prompt", select "Run as administrator":


  4. A "Administrator: Command Prompt" window comes up. Here, type "net stop WuAuServ" (without the quotes) and press the Enter key.
  5. Wait for this window to confirm it was successfully stopped:


  6. Now click the Start button, and in the "Start Search" box type:
    "%windir%"
    (without the quotes) and hit Enter.
  7. A folder window will open. Find the folder called "SoftwareDistribution", right-click it, select Rename and type "SDold" (without the quotes) to rename this folder (or call it anything else you like, just not the current name).

  8. Go back to the "Administrator: Command Prompt" window. Type:
    "net start WuAuServ"
    (without the quotes) to restart the Windows Updates service, and wait for it to say "The Windows Update service was started successfully".

Now if all that doesn't work, don't despair - Microsoft offer a free support service just for Windows Update issues.

To use it, go to this page and put in a support request with Microsoft there, and follow their advice. Good luck!

Saturday, 27 December 2008

Microsoft SeaPort Search Enhancement Broker, Office Live add-in toolbar – how to uninstall / disable





Here’s tips on how to disable or get rid of two unwelcome additions that just seem to install themselves whether you choose to install them or not (unbeknownst to you, in the case of SeaPort at least!):
  1. Microsoft SeaPort Search Enhancement Broker.

  2. Office Live add-in toolbar.

What is Microsoft SeaPort Search Enhancement Broker?

The description against SeaPort in Services (see below) says:
“Enables the detection, download and installation of up-to-date configuration files for Microsoft Search Enhancement applications. Also provides server communication for the customer experience improvement program. If this service is disabled, search enhancement features such as search history may not work correctly.”
I’m not entirely sure from that description exactly what Seaport does, but I think I know how I got it: from Windows Live (see Back-story below if you’re interested).

How to get rid of i.e. disable Microsoft SeaPort Search Enhancement Broker

From an online forum I found out SeaPort was running as a service, so here’s how to stop it if you want to - at your own risk etc (if you believe that it’s needed for “search enhancement features” then feel free to leave it alone if you wish!).

I like keyboard shortcuts so this is the way I’d use:
  1. Vista: click the Start menu and in the "Start Seach" box just type (without the quote marks) "services.msc", then hit Enter.

  2. XP:
    1. Hold down the Windows key (next to the Alt key) and tap the r key and release both keys. (Non-keyboard way - Start menu, Run)

    2. In the window that pops up, type: services.msc
  3. Click OK and a window like the following should come up:


  4. Scroll down to locate SeaPort under the Name column and click on that line to select it.

  5. Then rightclick on the highlighted SeaPort line and choose Properties:


  6. In the window that appears, click the dropdown arrow under Startup type and choose Disabled (or Manual, if you want to play it safe and allow it to start itself up manually – but then you’re not really stopping it from doing whatever it wants to do on your system).


  7. Then click OK, but before you do that, if you want to stop SeaPort as it’s currently running, click the Stop button (outlined in red above), let it do its thing and then OK.

  8. There you go, it’s stopped and Disabled from starting again (unless you picked Manual), and you can close the Services window.

  9. (If you have problems with your Search History and want to get it back, just repeat the above but choose Automatic from the dropdown in step 6 instead of Disabled.)

Note: Is SeaPort related to searching IE history? My Internet Explorer history sidebar had recently stopped working (I couldn’t access the sidebar for History, Favorites, anything, though the info was still recorded behind the scenes) but I’ve got it back now through reverting to IE 7 (I was using IE 8 beta 2) and fiddling with the add-ons, so I don’t think it’s anything to do with SeaPort. Especially as I’ve always stopped SeaPort from accessing the Internet whenever my firewall popped up a warning about it, yet I can access my IE history. Maybe it’s only the searching of my Search History that’ll be affected by SeaPort, who knows. I think it’s unrelated anyway. But I'm mentioning this so you know, in case getting rid of SeaPort causes history problems for you.

How to get rid of i.e. uninstall the Microsoft Office Live addin toolbar

This one’s easier, thanks to this (to uninstall the download):
  1. Go to Start menu, Control Panel.

  2. Then doubleclick Add/Remove Programs (XP) or Programs and Features (Vista).

  3. Wait for the list to come up, scroll down to find “Microsoft Office Live Add-in Beta”, and then click Uninstall or Remove and follow the instructions to remove the add in.

Back-story i.e. allow me my grumble


Those two things got installed recently through upgrading my Microsoft Windows Live Writer blogging software, which I’ve been using for a few months and had been really happy with (expect a review at some point). But those two additions I’m not so happy with, as I didn’t ask for them and wasn’t told about them, even if they let people use Word, PowerPoint or Excel with their Microsoft Office Live “online workspaces”, kind of Microsoft’s competitor to Google’s Docs.
Put it this way, I would prefer that all Windows Live software boxes are not ticked by default when you try to install just one product. I’m pretty sure I unticked everything except Live Writer when I tried to upgrade Writer, but the toolbar and “Seaport Search Enhancement” still got installed. Maybe I'm mistaken, but I didn't see any option to untick the Toolbar. It also used up some of my bandwidth capacity downloading 134MB of Windows Live software (including for Messenger, Mail, Gallery, etc) just to install the one Live product I wanted. I unticked the toolbar from Word’s View, Toolbars menu but it kept coming back whenever I reopened Word so I went hunting for how to get rid of it. It would have been helpful to see an explanation of SeaPort when it was being installed, so I knew what it was, rather than being surprised when my firewall first alerted me to its presence.

(UPDATED to move howto higher etc. )

Thursday, 11 September 2008

IE8: Microsoft blanks out Google?





No, this isn't a comparison of Microsoft's Internet Explorer 8 beta 2 with Google's Chrome - that browser comparison will follow in a future post.

This is just an initial observation that, when it comes to the basic job of a web browser - namely, displaying a web page - IE 8 beta 2 just seems to fail with some sites, showing only a webpage that's blank page, or that's blank in parts that should have content. (Whereas those pages show up fine in Chrome.)

For instance, here's the Transport for London website as seen in IE8 beta 2 - completely blank!:

ie8-1

And here's the BBC Worldwide's "About" page in IE8:

ie8-2

What I find amusing though - and is it a deliberate "feature", rather than a bug?? - is what Internet Explorer 8 beta 2 does to Google web pages.

F'rinstance, here are the results of a Google search (it was OK when I hit Reload though, but I've had this a few times on searching via Google using IE8):

ie8-3

Furthermore, if you sign out of Gmail / Google Mail and then someone tries to sign back in as a different user, that "Sign in as a different user" link just doesn't work - you're stuck with the previous username, pre-completed and uneditable (scrubbed out below), when you try to go to Gmail, even if you delete all cookies (until you close and re-open IE 8, at least):

ie8-4

And, when I'm writing or editing an email in Gmail / GoogleMail using IE8, sometimes I find I suddenly can't add or edit anything in the text box for writing the body of the email for a few seconds or even longer. (It could be down to Google I suppose, but I've never experienced this issue before using IE 8.)

Well, blanking out, refusing access to and generally scuppering the use of Google sites is certainly one way for Microsoft to shaft one of its big competitors..!

UPDATE: the solution or fix for blank or odd webpages in IE8 is, whenever you get a page that doesn't display properly on IE 8, to click the compatibility button that then appears in the address bar. Unfortunately when you go to another page on the same site you may have to click that button again. And again. But at least it works for the individual page!

Monday, 9 June 2008

Vista & BT Home Hub: limited connectivity to internet - a solution





Problems trying to connect a Microsoft Windows Vista computer wirelessly to the Internet via a BTHomeHub router? The "Limited connectivity" or "No connectivity" message, with no ability to connect to the Net at all from the Vista computer (even though the computer seems to connect to the Home Hub), may be all too familiar to you. But there's no help for this on the BT Broadband Vista support page.

It seems lots of people using BT Total Broadband as their ISP via the BT Home Hub have had this problem. So a tip, in case it saves you some troubleshooting - it may not just be the wifi, but a combo of Vista and BT's Home Hub (more specifically, a firmware "upgrade" to the HomeHub), so that the hub won't assign the PC an IP address.

Some people seem to have sorted it by resetting the Home Hub (press and hold the grey "Wireless Association" button at the back of the HomeHub, towards the bottom of the right; for newer Home Hubs, reset to default buttons are on the side) - as BT say, you then have to reactivate BT Broadband Talk again, if you use it.

I solved the problem for a friend who recently got a new Vista Home Premium laptop, where the issue seemed to be that "In Windows Vista, the BROADCAST flag in DHCP discovery packets is not disabled. Therefore, some routers and some non-Microsoft DHCP servers cannot process the DHCP discovery packets".

I sorted it by trying the step by step instructions to edit the Vista computer's Registry set out by Microsoft in "Windows Vista cannot obtain an IP address from certain routers or from certain non-Microsoft DHCP servers", as pointed out by this page.

Now all that stuff may seem like gobbledygook to you (and indeed me), but if you want to try it too, just follow the instructions in the previous link, making sure you backup your Registry first and also know how to restore it if need be (and I disclaim all responsibility if anything goes wrong and your computer stops working, so don't say you haven't been warned! You could also use Vista's System Restore feature to manually create a system restore point immediately before you try delving into the Registry and, if all goes wrong, boot the computer into safe mode and go back into System Restore and choose your restore point, to roll things back to where they were).

You'll see from the steps on the MS page that you're supposed to navigate in your Registry to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
\Tcpip\Parameters\Interfaces\{GUID}


Then you're told to "click the (GUID) subkey that corresponds to the network adapter that is connected to the network" and add the new DWORD as instructed (on the Edit menu, point to New, and then click DWORD (32-bit) Value; in the New Value #1 box, type DhcpConnEnableBcastFlagToggle, and then press ENTER; right-click DhcpConnEnableBcastFlagToggle, and then click Modify; in the Value data box, type 1, and then click OK; close Registry Editor).

In case it helps, here are some screenshots with the key paths to navigate down outlined in red:

You'll need to scroll down quite a bit under Services to find Tcpip and the rest. Here's what it looks like after creating the new DWORD (with the new DWORD highlighted on the right - and you can copy/paste the DhcpConnEnableBcastFlagToggle for the name if you prefer, for greater ease and accuracy - exactly as it is, upper and lowercase):


Now to clear up one possible source of confusion for non-techies. There's nothing that says "{GUID}" under Interfaces. That's because "GUID" is just an indicator; what it will actually read isn't "GUID".

There are three sub "folders" (subkeys) under Interfaces, and their names are just a string of letters and numbers enclosed in curly brackets - the pic above shows what they were called on my friend's computer, but yours may be different. It'll be one of those.

So how do you know which is the right subkey? In my case the first one was pretty empty when I clicked on it, so I thought I'd try the other two first, as they had lots of stuff on the right saying "DHCP" (which I figured meant it had to be one of them, given that the issue is related to DHCP!).

I thought one of them must be the network adapter for the wi-fi connection, and the other one must be for the Ethernet network connection as the computer had an Ethernet port for connecting to a network with a cable. You need to tweak the setting for the wi-fi adapter. I wasn't sure which was which, so I added the DWORD for both of them (obviously do that yourself at your own risk!).

For me, this fix worked to solve the "limited connectivity" problem on my friend's PC. The Vista computer was then able to go on to the internet, surf Web pages etc with no issues at all, after that.

Note on Vista firewall and security

NB - also don't forget to set the computer's firewall to allow outgoing connections to the Net from your main browsers and other applications that need internet access. I also downloaded and installed the free Vista Firewall Control for my friend, as a firewall is absolutely essential now if you have a computer (especially a Windows one) and are using the Net, even if it's only for a few minutes.

As the article I linked to explains, a firewall is no good unless it watches not just incoming Net traffic, but also outgoing traffic - because you could have inadvertently installed a trojan or other malware thinking it was fun or useful free software, but behind the scenes it's actually sneakily going out from your PC to the internet, reporting all sorts of info about you or your computer to the bad guys, and maybe even enabling them to take over your computer without your suspecting a thing.

Windows XP's firewall is only one-way, blocking incoming connection attempts but not outgoing.

With a two-way firewall, whenever software on your computer tries to access the Internet the firewall should stop it, alert you as to which application is trying to do what, and ask you what to do - normally, either let it through all the time (in or out or both) if you trust it, so it won't keep asking you again each time it tries to access the net, or let it through just once, or always block it. Obviously your web browser and email programs need to access the net, but freebie software from someone you've never heard of shouldn't need to (e.g. a graphics program), unless it's to check for an update, and even so I prefer to block those and manually check for updates myself, just in case it's pretending to check for an update but in fact it's doing something else.

Now Microsoft claim their Vista firewall is two-way, but the outbound-checking part is inexplicably turned off by default, and it's not at all easy to find and configure.

So installing something like the free Vista Firewall Control, which greatly simplifies the process, is a no brainer if you care about the security of your computer and your information on it:


Monday, 5 November 2007

Windows - no disk Exception Processing Message c0000013 Parameters 75b6bf9c 4 75b6bf9c 75b6bf9c - fixed!






"Windows - no disk Exception Processing Message c0000013 Parameters 75b6bf9c 4 75b6bf9c 75b6bf9c"

Here's a tip to save you hunting for the solution to fix this "Windows no disk" problem in Windows XP (UPDATE: a commenter says changing the drive letters works in Vista too), at least if it's to do with your card reader, or CD or DVD drive.

UPDATE - summary added, history moved to end: This problem seems to be caused either by malware (virus or spyware etc), or by software following a Windows update or some other software installation or uninstallation (particularly HP, Norton or QuickTime software) trying to check for removable media that isn't there (e.g. disc in DVD drive or card in card reader), when it shouldn't be doing that check.

So if you get this error message, try these steps (UPDATE - in whatever order you like, bearing in mind 5 is probably a less than satisfactory last resort, but by all means try 4 before 2 if you prefer):
  1. scan your computer with a virus checker and anti-spyware etc - try more than one product (e.g. there's also NOD32 ESET), clean any infections and reboot

  2. if that doesn't work, try changing your drive letter assignments as shown in the step by step howto below - this works for lots of people

  3. if that doesn't work, try uninstalling your floppy drive as shown below - or just always keep media in all your drives, though the next two steps are preferable if they work

  4. then try making your software stop looking for drives: e.g. uninstalling and reinstalling an upgraded (or latest possible) version of QuickTime; similarly with your Norton and HP software if you have any, and clearing your most recently used documents or files lists

  5. last resort: make the error message go away. This doesn't fix the problem, it addresses the symptom not the cause, so it really is a last resort if you can't fix it any other way, but if you're being driven mad, it's better than nothing.

So here's a step by step howto for the various suggestions above.

How to change your drive letter assignments in Windows XP or Vista to fix the "Windows - no disk" etc error message, and how to uninstall your floppy drive

There are Microsoft instructions but I think the following is quicker (UPDATE: this is closer, though the problem doesn't just apply to Zip drives configured as drive C. The steps below do reflect its solution - but I think having screenshots makes it easier for people to follow). I have XP SP2, hopefully it's not much different for SP1. I gather both XP Pro and XP Home can suffer this problem too. The steps below are probably trying to get at the same thing as uninstalling the USB drives, but much less frightening and more effective.

UPDATE: if you have Vista, the quickest way to get to the Disk Management window shown in no. 3 below is:
  • Go to the Start menu
  • In the Search box at the bottom, type (without the quote) "diskmgmt.msc" then hit Enter or click the magnifying glass search icon.
  • The rest will be as per no. 3 onwards.
  1. UPDATE: First, make sure all your removable drives or removable media drives are already connected to your computer (they don't have to have media in them). On your desktop, rightclick My Computer and choose Manage:


  2. In the window that opens up, choose Disk Management.


  3. Wait for the right hand side of the window to show up properly, it may take a few seconds. You'll see something like this:


  4. My mistake was to rightclick the stuff in the top right hand bit. Don't you do the same! Check out the bottom right hand quarter, see the pic above, and scroll down in that mini window (see the mouse above) till you find the first drive that says "Removable media" and No media". Right click its name (e.g. "Disk 3") then pick "Change Drive Letters and Paths":


  5. Click Change:


  6. Then in the dropdown list pick a different drive letter (I'd use one somewhere near the end of the alphabet like R, just in case):


  7. Then click OK to save the changed assignment. Rinse and repeat for all the other removable drives in the bottom right hand window which have no media in them. Do the same even for the card slot/drive that does have a card in it (if it does), just in case. Obviously each one must have a different letter. In my case I changed drives G, H, I and J to R, S, T and U. Strong warning - although BeckhamSquared did it, I really, really wouldn't change ANY of the drives to C. Leave drive C well alone, don't change it. (It shouldn't let you, but just in case...)

  8. Then reboot, and with any luck it should work to kill that error message once and for all. It certainly did for me. And if you then want to change the drive letters back to what they were, do so by all means - but at your own risk, in my view if it ain't broke don't fix it (hopefully changing them back shouldn't muck it up again, but you never know).

    See also 9 and 10 below if that didn't work for you.

  9. If it's still coming up with the same error and you can tell (from the sounds it makes - well I can) that it's trying to access your floppy drive, the above method won't let you change drive A. But what you can do is try this (at your own risk!): rightclick My Computer, choose Properties, Hardware, Device Manager, expand both Floppy Disk Controllers and Floppy Disk Drives, rightclick Standard floppy disk controller and Uninstall, and do the same Uninstall for Floppy disk drive if necessary. Reboot your computer, and it should reinstall the disk drive A. And hopefully also fix the error message for good. But if that doesn't work don't blame me!

  10. UPDATE: This isn't a fix, just a workaround, but if changing your drive letters doesn't work try always having a disk or card in all your removable media drives i.e. floppy drive, CD or DVD drive, all your card reader slots. Or try the software fixes or "last resort" registry edit, below.

Or is it QuickTime, Norton or Hewlett-Packard or other programs?

If all that doesn't work for you, well the other thing I did was uninstall QuickTime, which I'd updated recently and which apparently did the trick for some people when they uninstalled it. Similarly for HP and Norton software.

But it's a bit more drastic than the above, so I'd try changing drive letter assignments first.

UPDATE: As it's probably software trying to look for media in drives when it shouldn't, you could also attack the problem by trying to stop your software looking for it, as per this comment - and uninstalling & reinstalling QuickTime or clearing its cache etc is certainly one way to help in this regard.

You could therefore also try clearing your recent documents or recent files lists in Word, Excel (go to the Tools menu, Options) and your other programs that keep lists of recently opened files. And also, generally in Windows, I'd suggest you try clearing your most recently opened documents list from the Windows start menu by trying these steps (instructions are for XP):
  1. rightclick the Start menu
  2. choose Properties
  3. go to the Start Menu tab, make sure that Start Menu is selected, click the "Customize" button near it
  4. go to the Advanced tab
  5. click the "Clear list" button
  6. click OK and OK again.
(I didn't mention clearing those lists previously because it didn't work for me, but it's worth trying if the above didn't work for you.)

Last resort - just make the error message disappear

I've also seen as a last resort this suggested registry change (XP only, don't know if it works in Vista). I didn't need to try it so I haven't done it but it's worked for others. However as the writer warns, it's really a last ditch solution because it doesn't stop the problem from happening, it just makes the error message go away, and ideally you should try to address the underlying cause of the problem.

UPDATE: But if you aren't comfortable editing your registry manually then:
- try clicking this link to do the same thing (NB before doing that backup your registry or that key first, and it's at your own risk etc!): stop windows no disk error message (click Run in the next dialog box). You shouldn't need to reboot.
- and try this link if you want to reverse that registry change later: reverse stop windows no disk error message.

UPDATE: I've moved the history to the end and beefed up the howto at the start.

History of solutions tried - skip this unless you're interested in the problem solving steps!

If the above error message sounds familiar to you, if it's been driving you mad, well me too. It's been killing me this last fortnight. Whenever I booted my Windows XP computer, it would come up and I'd have to hit Cancel (or Continue) several times in a row before I could get it to go away. (Tip: a few apps did seem to carry on starting up in the background. If I just left my PC alone and let them do their thang before I finally clicked Cancel or Continue, that annoying irritating slowing-me-down error message wouldn't crop up again. But I'd still have to get rid of it at least once). And unlike some other people, I did not have anything but my main hard drive as C.

That kind of incomprehensible gobbledygook of a computer error message doesn't exactly follow good design guidelines for exception messages, does it?

I tried all sorts of things. If regular readers are wondering why I've not blogged much this weekend, when the weekend is usually the time when I get down to my ACE posts, it's because I've been tearing my hair out hunting for and then trying different options I'd seen other people say had worked for them (so I can blame them for all the ones that didn't work for me!).

What was the problem? Checking removable media drives for media that ain't there

It's obvious that something had changed to make the problem start in the first place. It could be a Windows update (helloooooo Microsoft are you listening?), but to be fair it could have been an upgrade to some other software that caused it. For example lots of people have had difficulties with HP computers or HP software, and I have an HP printer myself with HP Solution Center, so that would have been one of the things I'd have tried next (upgrading the HP software e.g. HP ImageZone), if this one hadn't worked. For other people it's something to do with Symantec Norton software. For yet others it doesn't happen on turning on their PC, but only on launching certain software, or using certain hardware. We don't care if it's a bug, a conflict etc, we just want it to stop!

A very common thread though is that it often seems to involve drives for removable media. Some software process (which I wasn't able to track down, myself) has clearly been initiated at startup which was trying to access or at least check all the disk drives attached to my PC. It's not finding something that it was expecting to find - whether a CD, DVD etc in a CD-ROM drive, DVD-ROM drive or Zip drive for some people, or in my case cards inserted into all the slots of my card reader (which enables me to transfer photos, MP3s and other data from SD cards, Compact Flash cards etc to my computer and vice versa). Hence it's throwing up the error message. At one point it even seemed to be checking for a floppy disk in my floppy disk drive.

In my own case, I found that if I didn't have my card reader connected permanently, I didn't get that error message. I could plug it in later. So I knew it was to do with the card reader.

But the message came back if I'd left it connected when I booted again, so that wasn't much good if you don't feel like always having to remember to unplug and re-connect it (and it may be impracticable if the socket is somewhere inaccessible).

Also others have found that if you leave media in the drive that's causing the problem, e.g. a CD in your CD-ROM drive, or a floppy in your floppy drive, etc, that also stops the error message. But to me that's just a workaround, it doesn't solve the problem.

So, it's looking for disks etc that aren't in drives. Now one way to stop that is to stop it starting up at all, but I couldn't figure out what it was and I'd wasted the whole weekend trying other stuff, man, troubleshooting to try to solve problems that shouldn't be there in the first place is the worst waste of life I can think of.

Here's what I tried that didn't work, for light relief, so you can point at it and have a good larf - "Hahahaha, that would never have worked, why'd she do that?!!":
  • uninstalled all my USB devices (including card reader) in Device Manager - scary, and stupid of me as I went too far in my panic and uninstalled other stuff that weren't removable media drives at all (see below), and I had to find a driver disks for one of them when I rebooted as it wouldn't reinstall properly! Lucky I still had it and it didn't take too long to find. But still.

  • uninstalled my floppy disk drive (actually I think it did fix part of the problem, as it stopped trying to access my floppy drive, but not the rest of it as I still had a card reader - see below)

  • cleared the QuickTime cache.
Now, what did work? Yeah I know you should do things one step at a time and reboot, but by the time I reached that point in the evening, I'd given up. So I tried two things at the same time, then rebooted.

I'm pretty sure I know which one it was that did the trick, as Kirk (thanks Kirk!) had pointed me to it earlier, and that man is always right - but I didn't think it had worked at first, only because I hadn't done it properly even though I'd seen the same suggestion elsewhere in my hunting. So I'll set out the solution below for those who like me might have missed it.

The thing I did which I'm pretty sure is the solution was to change the drive letters for my card reader slots - thank you BeckhamSquared, who said: "in resetting the drive letter whatever got corrupted during the [Norton removal] was fixed". (The person there first encountered the problem after uninstalling Norton SystemWorks. I didn't uninstall it myself, yet I also got the same problem - there are clearly lots of different causes).

At first I did it wrong because, foolish me, yeah I can laugh now, I only changed the drive letter for a removable card drive which did have media in it. Duh and double duh and triple duh. I should have changed the letter assignments for the empty drives, as they were the ones that weren't being detected. So I did that, after like the zillionth unsuccessful reboot, and yay - it worked!

(I'm giving this post the stopirritatingme tag in honour of Tom Morris!)

Monday, 29 October 2007

Refund for Microsoft software? Linux joy





Linux fans who resent paying for a pre-installed Microsoft Windows operating system or other Windows software that they don't want and won't use should be perking up, at least in Europe.

At the end of September a French court ordered Acer to refund to a notebook buyer a total of 311.85 euros out of a total price of 599 euros (135.20 euros for Windows XP Home, 60 euros for Microsoft Works, 40.99 euros for PowerDVD, 38.66 euros for Norton Antivirus and 37 euros for NTI CD Maker) - plus another 650 euros for, amongst other things, legal costs.

And now, an Italian court has recently told Hewlett-Packard to refund to the buyer of a HP Compaq notebook computer, which had Microsoft software pre-installed, a total of 140 euros - 90 euros for Windows XP, and 50 euros for Windows Works 8.

That was apparently based on Microsoft's End User License Agreement (EULA) which includes the statement "IF YOU DO NOT AGREE, DO NOT INSTALL, COPY, OR USE THE SOFTWARE; YOU MAY RETURN IT TO YOUR PLACE OF PURCHASE FOR A FULL REFUND, IF APPLICABLE". It seems that the court rejected HP's argument that the licensing conditions had been unilaterally set by Microsoft; HP must have known about those conditions.

While no similar court rulings are known from Germany, there has been a newspaper report about a customer who ordered a notebook from Dell Deutschland in March 2007. They replaced the preinstalled Windows with Linux, and managed to get a credit of 78 euros for the Windows operating system and a (further unspecified) Microsoft program - without having to sue for it.

I wonder if any Linux user in the UK or US has tried to return unwanted software and asked their supplier for a refund for the Windows programs, and if so what happened? (obviously it's a good idea to do that as soon as possible after you get the computer - don't wait months if you're going to try it!). I'd be interested to know if anyone has heard anything about this or tried it themselves, and what luck they had?

The Italian buyer in that court case has posted a "fill in the blanks" letter asking for a refund, English translation here. I've no idea if it could be used outside of Italy, but hey it's a starting point if anyone wants to have a go (remembering that this isn't legal advice etc, I haven't a clue if it would work outside of Italy or France!). Still, they've struck a blow for consumers and Linux users - if you're a Linux-only user, why should you have pay for software you don't intend to use just because the vendor insists on preinstalling it with the PC hardware you buy? (I use both Windows and Linux, myself.)