Number 258 - November 2004

Windows XP Service Pack 2
by Brian K. Lewis, Ph.D.*, Sarasota Personal Computer Users Group, Inc,.October 2004
By now you may have already received and installed Service Pack 2 (SP2), the latest major upgrade for Windows XP. I hope you had no compatibility problems with any of your installed applications. Microsoft posted a KnowledgeBase article (884130) on August 18th that listed over 200 software applications that "MAY" behave differently after installing SP2. The initial list included applications such as Pagemaker 7.0, Nero Burning ROM, Word Perfect Office, Quicken, McAfee Internet Security, Microsoft Office 11, Outlook 9 - 10 - 11, Norton Anti-virus, Works Suite 2004, PC Anywhere 11, Zone Alarm 5 and more. Many applications on the original list were removed from an update posted on August 29th. In addition, several software and computer manufacturers have posted notices on their web sites that should be checked before users install SP2. It is up to the computer user to obtain the updates that are needed to permit their applications to work smoothly with SP2. Although Microsoft has been pushing the SP2 update to users since mid-August, they also have advisories on their web site recommending that users contact their PC maker and software manufacturers for any updated applications and/or drivers needed to prevent compatibility problems before downloading and installing SP2.    All that said why would anyone want to install SP2? For one, at least it would stop Windows update from constantly nagging you about getting it. (You can get an application from Microsoft that will allow you to put off the download of SP2.) A better reason is the improvement in security provided by all the recompiled components of Windows XP. Microsoft calls it "proactive security". There is a new Windows Security Center which provides information on the status of your firewall, A-V protection and Windows automatic updates. This is with the proviso that Windows recognizes your firewall and A-V software. There are other changes that try to improve the overall security of Windows XP. Microsoft is promoting this update based primarily on the security improvements.    The Security Center and its properties can be accessed via the Control Panel. Whenever a problem is detected a shield-shaped, red icon will appear in the System Tray, that's where your time/date information is located. Along with the icon will be a balloon message stating "Your computer might be at risk". Clicking on this message will bring up a window stating the problem and providing a means of getting a list of recommended steps to remove the problem.    Microsoft's KnowledgeBase article 883792 (8/18/2004) indicates that Symantec's A-V software, otherwise known as Norton A-V, will NOT be recognized until an update is provided to all Symantec users. Symantec has posted the following information on their web site: "Norton AntiVirus"    "Installing Service Pack 2 will not affect Norton AntiVirus. The Windows Security Center will be aware that you have Norton AntiVirus installed, but it will not be able to determine its working status due to Symantec's tamper-protection technology." "Norton Firewall/Norton Internet Security"    "Installing Service Pack 2 will not affect Norton Personal Firewall or Norton Internet Security. The Windows Security Center will be aware that you have one of these products installed, but it will not be able to determine their working status due to Symantec's tamper-protection technology."    Symantec also indicated this information applies to Norton SystemWorks. Without the ability to detect the status of your firewall and/or A-V software, the red warning icon will constantly appear in your system tray. You can turn off this warning by changing the way the Security Center functions. To get these instructions go to http://support.microsoft.com and search for article 883792. This has the step-by-step instructions for modifying the operation of the Windows Security Center.    Another error message that might appear when you run some applications is titled "Data Application Prevention". When this message shows up, it will also tell you that the program you are running, or attempting to run, will be closed. The message box includes the statement that this was to prevent a virus or other security threat from damaging your computer. This data execution prevention (DEP) is a new feature of Windows XP. This function is used to prevent an application	from attempting to run code that is in a memory page that is marked for data. To try to clarify this for the non-programmer, when you run software it loads program instruction code and the information used as data in different memory areas. A specific example would be running a word processing program. The program is loaded as instructions and what you type is considered data. These are supposed to be kept separate. Some hacker software (trojans) can overrun a data page buffer and then begin executing the code. DEP is designed to prevent this from happening. So, if you get this message when you run one of your applications, you need to check with the manufacturer for an update that will allow it to run without creating a DEP error. If there is no update available, then check article 875351 in Microsoft's support pages for how to work around this problem. You can make an exception for the program that is causing the problem.    SP2 also contains an updated and improved version of the Windows firewall. In the original version of XP and in SP1, the firewall was disabled on installation. When you install SP2 the firewall will be automatically enabled. This will happen even if you have a working, identifiable firewall on your system. If you leave both firewalls enabled, you will have operational problems and probably a severe slowdown. So, do you remove your third-party firewall or disable the Windows firewall? The Windows firewall does NOT restrict outgoing messages. This has been disputed by some other sources. However, Microsoft's documentation specifically states "the Windows Firewall does not prevent communication originating from the [protected] computer". ZoneAlarm, Sygate and other third-party firewalls do monitor both incoming and outgoing messages. In my opinion, the Windows firewall is far less useful than one of these third-party firewalls. So if you have a good two-way firewall, keep it and disable the Windows firewall. It is still possible for a Windows XP computer to be infected by means of holes in the operating system. They have not all been plugged. Should a "trojan" program make its way onto your computer by any means, it will try to communicate with a remote location. With a two-way firewall, you will receive a warning that a new program is trying to access the Internet and you can shut it down. With the Windows Firewall you will never know this is happening and Microsoft says it's not important. As far as they are concerned, once you have allowed a hacker access to your computer, it's too late for the OS to do anything about it.    If you don't want to download SP2, for example you have a dial-up connection, you can order a CD from Microsoft's web site. There is no charge for the CD and no charge for shipping or handling. Microsoft also recommends that you do not download SP2 from any non-Microsoft sites or so-called mirror sites. This is a quote from their TechNet site: "Microsoft's license agreement does NOT allow third-party sites to legally distribute this copyrighted code. The Microsoft Download Center site (www. microsoft.com/downloads) is your only authorized web source for downloading a licensed copy of Windows XP Service Pack 2." If you want to delay downloading SP2 via Windows Update go to Microsoft and search for "XPSP2BlockerTools.EXE". You can download and run this file which will give you up to four months from August 16th to download. There are complete instructions on the web site for using this application.    Microsoft also recommends that you run an anti-parasite program such as Spybot or Ad-aware before installing SP2. It wouldn't be a bad idea to run a complete anti-virus scan and a complete defrag as well. One last thing you should do before installing SP2 is to back up your computer.    All in all, SP2 is an upgrade that every XP user will want to put on their computer. However, you do need to verify the compatibility of your applications. Otherwise, you may run into problems running some of your software. Check it out before installing SP2. One source I've found does indicate that SP2 can be uninstalled. I say why go to all that trouble when you can check compatibility and download patches as needed before installing SP2. So don't rush to install SP2 if you don't have it yet.    *Dr. Lewis is a former university & medical school professor. He has been working with personal computers for more than thirty years. He can be reached via e-mail at bwsail@yahoo.com.
Number 258 - November 2004