Security Update: Windows 7

I was installing Windows 7, and decided to review the current situation in the area of security software.  This post summarizes what I found.

I was concerned about the possibility that some reviewers would be influenced by advertisers, so I started with About.com.  From their list of security software reviews, I went to the most recent AV-Test report.  Its top five antivirus offerings for Windows 7 in terms of protection, in descending order, were AVG Internet Security 9.0, G Data Internet Security 2010/2011, Panda Internet Security 2010, Norton Internet Security 2010, and F-Secure Internet Security 2010/2011.  The top five in terms of repair were Avira Premium Security Suite 10.0, Kaspersky Internet Security 2010, Panda Internet Security 2010, Eset Smart Security 4.2, and F-Secure Internet Security 2010/2011.  The top five in terms of usability (which presumably included interference with other programs and other hassles) were BitDefender Internet Security Suite 2010/2011, F-Secure Internet Security 2010/2011, G Data Internet Security 2011, Kaspersky Internet Security 2010, and Microsoft Security Essentials 1.0.

I decided to treat protection and repair as two parts of the larger issue of effectiveness.  In terms of effectiveness, then, the programs appearing on both of those lists were Panda Internet Security 2010 and F-Secure Internet Security 2010/2011.  Of those two, only F-Secure also appeared among the usability top five.

The AV-Test report was cited by reviewers at various commercial sites, which nevertheless came up with somewhat different lists.  At TopTenReviews, the top five were BitDefender Antivirus, Kaspersky Anti-Virus, Webroot AntiVirus, Norton AntiVirus, and Eset Nod32 Antivirus.  The only one not having a perfect score on the three criteria considered by AV-Test (above) was Eset, on protection.  I also looked at CNET, which offered lengthy reviews of each program.  From their list of kinds of antivirus and filtering programs, I looked particularly at the Antivirus and Desktop Firewall categories.  The most recent review in either category was about 15 months old, which seemed ancient in antivirus terms.  Ranked by editors, the antivirus programs to which they gave four out of five stars (leaving out duplicates from earlier years) were Norton AntiVirus 2010, Kaspersky Anti-Virus 6, McAfee VirusScan Professional 8.0, and McAfee Internet Security Suite 6.0.  At PCMag, the antivirus programs scoring at least 4.5 stars (excluding previous years' versions of the same programs) were Ad-Aware Free Internet Security 9.0, Ad-Aware Pro Internet Security 9.0, Norton AntiVirus 2011, Norton 360 Version 4.0, and Webroot AntiVirus with Spy Sweeper 2011.  Security suites (drawn from an apparently overlapping list) getting that score were Norton Internet Security 2011, Norton 360 Version 4.0, ZoneAlarm Extreme Security, and Webroot AntiVirus with AntiSpyware 6.0.

I decided to treat PCMag as authoritative among commercial sites.  Their list diverged almost completely from the AV-Test list shown above.  I decided to rely on AV-Test above PCMag.  From their list, F-Secure Internet Security 2011 seemed to be the best program.  I wondered what would have happened if AV-Test had tested Ad-Aware Free Internet Security 9.0.  CNET's review noted that the free version was not able to scan networked drives, a killer for my purposes.  It looked like I would be shopping around for a copy of F-Secure Internet Security 2011, available from their website for $40.

Trendnet TU2-ET100 / ASIX AX88772 USB to 10/100 Mbps Adapter

I was having problems with my laptop's Internet connection.  The wireless worked fine; the cable connection didn't work at all.  After lots of troubleshooting with tech support, a replacement motherboard, and so forth, the problem persisted.  So I decided to try a USB-to-ethernet adapter.  The first one I got, a cheap little item, didn't work, so I bought a more expensive Trendnet TU2-ET100.  This one came with a driver CD.  The drivers installed without a problem from the CD.  When I then plugged the TU2-ET100 into the USB port, Vista Ultimate recognized it immediately.  In Device Manager, it showed up under Network Adapters as an ASIX AX88772 USB2.0 to Fast Ethernet Adapter -- but that turned out to be just the name of the controller chip.  (Oddly, CNET seemed to be offering version 3.4.3.11 of the driver, added Sept. 8, 2004, for current free download, whereas Device Manager was telling me that the version installed from the CD-ROM was 3.8.3.5 (built by WinDDK), dated January 20, 2007.)  A Wikipedia article seemed to indicate that ASIX specialized in these kinds of chips.  It looked like quite a few other adapters used the same chip.

Anyway, once it was plugged into the USB port and had finished installing itself, I connected it to my ethernet cable.  (The cable was known to be good; it was the one I was using to post this blog note.)  The unit's 100Mbps light went on solid, and the Link light was blinking.  Everything seemed good.  But neither Firefox nor Chrome nor Internet Explorer (IE) were able to get to a webpage.  Microsoft Security Essentials was also unable to download updates.  And yet, as before, Windows Network Diagnostics said, "Windows did not find any problems with this computer’s network connection."  But when I closed out of that, I found myself looking at something I hadn't seen before:  a Problem Reports and Solutions window.  I don't know -- maybe the system had updated itself, the last time I went online via the wireless connection, and was now in a position to tell me what had failed with the previous wired connection attempt.  I sorted this list by date and selected just one, the most recent item in this first group.  This was an AntiMalware Service Executable item whose problem was MpTelemetry.  When I clicked on Check for Solutions, it said it was "Checking for solutions" and "Reporting problem 1 of 157."  Then it said, "Unable to check for solutions."

The User's Guide on the CD had only installation information.  Using the CD, I installed the TU2-ET100 adapter on this Windows XP desktop computer that had been connecting to the Internet without any problems.  Again, a hassle-free installation.  After I plugged the ethernet cable into the unit, using the same cable, and got a notice that the new hardware was installed and ready to use, I tried getting to a webpage in Firefox, which I had just been using, but now Firefox said, "Connection Error" -- even though Network Connections reported that the ASIX AX88772 was Connected. IE couldn't connect either.  Very strange!  I left the TU2-ET100 connected to a USB port on this desktop computer, but removed the ethernet cable from the unit and plugged it directly into the computer again, and now the connection problem persisted.  I unplugged the TU2-ET100 entirely and tried again.  IE still said, "Internet Explorer cannot display the webpage."  I clicked on IE's "Diagnose Connection Problems" button.  It said, "Consult your computer manufacturer's troubleshooting information."  The diagnostic log had several instances of "Error 12007 connecting to www.microsoft.com:  The server name or address could not be resolved" (and likewise for FTP).  I connected the cable (without the TU2-ET100) to a third computer.  It had been online previously and was able to find new webpages again without any problem.  On the second computer, where I had connected the TU2-ET100, I tried refreshing the network connection, but I still couldn't go online.  I had to reboot that one to get it back to a normal online connection.  I suspected that the problem there was that I had previously installed two separate ethernet adapters on that computer (one on the motherboard, one on a PCI card), while troubleshooting a network connection problem there, and that the addition of the TU2-ET100 had simply confused the system.

I wondered if a reboot would help the laptop too.  I went back to it and plugged in the TU2-ET100 and ethernet cable there.  The lights on the unit were functioning as before.  Before rebooting, I ran Network Diagnostics again -- noticing the red X beneath its Local Area Connection icon in Network Connections.  This time, I got, "A cable is not plugged into the network adapter "Local Area Connection."  Well, OK, the ethernet cable was plugged into the TU2-ET100, not directly into the laptop.  I plugged the ethernet cable directly into the laptop, and now that connection seemed to be recognized.  But now I noticed that, under the Local Area Connection icon in Network Connections, it was referring to a Realtek PCIe controller.  That was the controller on the motherboard, not on the TU2-ET100.  So, hmm, maybe the TU2-ET100 had not even been recognized previously?  I right-clicked on Local Area Connection and disabled it, and then rebooted.  When the system came back up, I saw that Local Area Connection 2 was now listed as having the ASIX AX88772.  But IE, Chrome, and Firefox still couldn't go online, and I still couldn't download updates.  I right-clicked in Network Connections, ran diagnostics, and found no problem.  I tried the Reset option, but no joy. In short, it did not help to disable the onboard ethernet connection (i.e., Local Area Connection), plug the ethernet cable into the Trendnet unit, and enable that unit as Local Area Connection 2:  IE and Firefox were still not able to go online.

It suddenly occurred to me that possibly the brilliant Compaq/HP engineers had constructed the laptop such that it would not go online via wired connection when I had the button for the wireless connection turned off.  I punched that button, the red one next to the power button.  It turned to blue, as the system searched for wireless connections in my area.  But no, that didn't do it either.  I tried plugging the unit into a different USB port; no difference.

I went searching for ideas.  I saw an improbably high number of perfect scores for the device at TigerDirect (and CompUSA, which seemed to have the same reviews), making me wonder whether they were padding their customer feedback to make it look like they were getting more buyers than Newegg.  But maybe they were; I had bought from Newegg, where the price had only recently been dropped $8 from what I paid -- to a dollar less than TigerDirect was now charging.  Anyway, Newegg did get a more mixed batch of scores and comments, but no troubleshooting advice for me.  Ditto Amazon. (Later, I found a Wize webpage that seemed to aggregate these multiple sources of buyer reviews.)

A couple of reviewers did say that they had better luck with the drivers from the Trendnet website than those on the CD, so even though the device was being recognized OK, I went to Trendnet's download page.  There, I saw that there were three versions:  A, B1, and V3.0R.  The pictures made plain that I had the V3.0R.  They offered what seemed to be version 3.2 of the driver (full name:  Driver_TU2-ET100(V3.0R)_CD_ver3.2.zip).  That was below the numbers cited above, but the date (April 3, 2008) was newer.  It didn't seem to matter which operating system I had.  I downloaded it, copied it over to the laptop, unplugged the unit, and installed the driver.  The Trendnet dialog said "Install OK," but it came up really quickly, and I wasn't sure -- especially when Vista popped up a Program Compatibility Assistant note that said, "This program might not have installed correctly."  Well, OK, I plugged in the unit to see.  Vista indicated, "Device driver software installed successfully."  With great hopes, I tried going online again.  Diagnostics still found no problem with the network connection, and yet IE and Firefox were still not getting anywhere.  I unplugged the unit, went back to that Program Compatibility Assistant dialog, and tried "Reinstall using recommended settings."  This time, the Trendnet dialog incorrectly identified the system as running Windows XP rather than Vista.  I said, OK, let's see what happens.  I went ahead with that and got a Confirm File Replace dialog telling me that I was about to overwrite the newer file that was already on the system.  I said Do It.  It finished.  I plugged the unit into a USB port again.  Dead!  No lights.  Ah, but wait.  The lights came up eventually -- not immediately, like before -- but no difference.  Still no connection.

Confusingly, I now found a Trendnet page telling me, "Please wait while we are developing drivers for Windows Vista."  But that seemed to be just a generic notice; it led me to another page where I saw a link to a Vista-compatible driver download; but that turned out to be the driver I had just downloaded, which of course had detected that it was being installed on a Vista system.  In other words, it didn't appear that I could be expecting any new drivers -- especially when all these other happy campers were doing fine with the drivers provided on the CD or the website.

These adventures left me with a couple of possibilities for testing and exploration.  One was to cycle the router and the laptop.  I had tried that before, without success, but maybe it would be different with the Trendnet unit -- though I didn't see why it should, when the desktop computer was working fine with the same router.  Another was to try installing the Trendnet drivers on the desktop computer after removing that extraneous ethernet card.  From the comments, it had seemed that virtually the only problems people had were that a few buyers got units that were DOA, and this one certainly wasn't that; it was being recognized and seemed to be installing correctly, especially in Vista.  A third possibility, which I had also tried before, but not with this Trendnet unit, was to reboot the laptop in Ubuntu and see how things went there, in case it was somehow a Vista- or Windows-specific problem.  A few people had indicated that the unit had worked for them in Linux, so it seemed like it should work for me.

I decided to start with the third option.  Leaving the unit plugged in, I rebooted this dual-boot laptop into Ubuntu 10.04 (Lucid Lynx) (I probably could also have tried with a live CD) and clicked on the network icon on the top panel.  It opened a window that said "Wired Network (ASIX Elec. AX88772) -- Auto eth2" and gave me an option to disconnect.  So apparently Ubuntu believed that I was connected.  I clicked on the Disconnect option and got a little notice that said "Disconnected -- you are now offline."  I went back there and connected, and now it said "Connection established."  So, yeah, I was online.  I opened Firefox and tried to go to CNN.com, but after a while it said, "Firefox can't establish a connection to the server."  I also couldn't download package information using Synaptic.  And still the light was blinking merrily on the TU2-ET100.

It seemed that I had a hardware problem on the laptop.  It wasn't clear whether I also had a nonworking Trendnet unit.  But even as I was writing these words, Synaptic began, ever so slowly, to download updated packages.  Woo hoo!  Something appeared to be happening.  So, another possibility:  for some reason, the hardware was so impaired that it could only operate at a very slow speed -- too slow to keep webpages from timing out.  But no, as I looked at Synaptic's list of individual files, it seemed that its efforts were failing in each case; it was just taking a long time on each file to make sure there was no way.

I located another desktop computer, one where I had not previously tried to install the Trendnet unit.  I went through the original TU2-ET100 installation process, using the CD, and then connected the ethernet cable and plugged the unit into a USB port.  Device Manager considered it to be working properly, but the Trendnet unit did not enable this Windows XP computer to connect.  Baffled, I posted a question on it.  That was as far as I went with this investigation.  I moved to a different apartment shortly after this, and the laptop was able to go online normally there.  I never did find out why it was having such a hard time at the other place.

AT&T DSL Installation

I decided to try using AT&T's DSL as my Internet service provider (ISP). Based on what the AT&T representative said, it sounded like I would want their Pro service, at $30 per month, for a connection speed of "up to" 3.0 Mbps, if I wanted speed comparable to cable. There was also the Elite service, for $35, for a 6.0 Mbps connection. Less expensively, AT&T offered Basic ($20) and Express ($25) services, with connection speeds of "up to" 768 Kbps and 1.5 Mbps, respectively. She said I could change at any time, with just a phone call, so I decided to see what the Express service would give me for $25 per month. (For reference purposes, that 1.5 Mbps service, at 7 AM on a weekday, looked like it would give me a 700MB Ubuntu ISO download in about 105 minutes, when I was not doing heavy browsing or otherwise taxing my machine, for an average of about 6.7MB per minute, or about 110KB per second. I say it "looked like" it would do that, because in fact it did not complete the job. After a half-dozen abortive tries, I gave up and went over to the university with its very fast connection, where I downloaded the same ISO in about five minutes.) The representative didn't tell me that I could get the $50 modem or $80 gateway for free if I ordered Pro or Elite service online. I would have done my shopping online, but unfortunately I could not go online -- not at home, anyway. At this writing, I was thinking I probably should call AT&T and suggest that their introductory recording should notify callers that they will get a better deal by ordering online -- which I would have done, at a public computer if necessary. When I called to follow up on my order, the automated voice system for DSL service (877-722-3755) told me that my service was to be installed by 8 PM. But 8 PM came and went and there were no fireworks, no bells ringing, no amazing flashing lights on the Internet switch that I had been using to connect two computers to the single incoming line in my previous Ethernet-wired building. I called their voice response system again and got the same recording as before. This time, I insisted on speaking to someone, and that got me through to a nice woman -- in India, I guessed, from her accent. She walked me through the process. This was necessary because the installation CD that came via UPS with my new Motorola gateway modem was strongly convinced that I did not have an Ethernet adapter in my computer, and I was not able to persuade it otherwise. The installation CD balked and would go no further, so I carefully placed it into that special zone that I reserve for CDs that disagree with me. I didn't take good notes while talking to the lady, so you'll probably have to call her for yourself, if you want to relive my own experience in that tech support call. One thing that happened was that she steered me to a webpage that asked all kinds of goofy verification questions (e.g., what was the color of my third least favorite cat -- to exaggerate slightly), and eventually I finished the registration experience and had my own AT&T e-mail account and login page (att.yahoo.com), as well as the address of a page for further tech support (helpme.att.net). Everything was good, and I was up and running. Next day, however, when I turned on the computer, I found that neither Internet Explorer nor Firefox would connect to any webpages. I called back to the 800 number (or, I guess, the 877 number) and was privileged to work with another Indian person, although this one was male and not nearly as nice or communicative as the young lady who had kindly assisted me the previous evening. He was OK, and we did OK; I just didn't find that he was really having his best day. He kept referring to screens and options that did not exist until I worked out for myself what he was trying to say. What emerged from that conversation was that AT&T DSL was incompatible with the ZoneAlarm firewall unless I cared to figure out, on my own, how to configure Zone Alarm so that it would be compatible. The man did not know why I was able to browse without any problem on the previous evening. But my tinkering did verify that, specifically, I could browse online only if (a) I right-clicked on the ZoneAlarm icon in the Windows XP system tray and selected the "Shutdown ZoneAlarm" option or (b) I opened up the ZoneAlarm Control Center and, within the Firewall tab, set Internet Security to medium rather than high. I was not entirely comfortable with the medium setting because ZoneAlarm said that this meant my computer would be visible to hackers. I preferred the "stealth" posture afforded by the high security setting. To achieve high security, I tried going into ZoneAlarm's Firewall > Zones option, where I added my modem's IP address. I wouldn't have known what this was, but the somewhat nice Indian gentlemen had let slip that 192.168.1.254 was the IP address of my modem, and later I noticed it was actually printed on a sticker on the back of the modem. (That number is apparently the default for a lot of modems.) So that's the IP address that I typed into the ZoneAlarm IP Address box on the Zones tab. But apparently that's wasn't good enough, because I still wasn't able to browse until I went back to the Firewall > Main tab and set the sucker back to medium. (We're talking about the slider for the security level for ZoneAlarm's Internet Zone, not for its Trusted Zone.) I thought maybe someone else would have superior expertise in this area, so I tried a customized Google search. A posting by La Luna at Broadband Reports made me think that possibly I was having this problem because of some Microsoft updates I had just installed the previous evening, during my browsing. (Later, while waiting on hold with another tech support call to AT&T, I heard a recording that said Microsoft had indeed released an update that had the effect of restricting access for some Windows users. "Some" may have included me. But meanwhile, events continued to unfold, and ultimately appeared to render the point moot for the time being.) Having downloaded some but not all of the available updates on this new WinXP installation, I was thinking that more updates could be the solution for me. I saw, from Zone Alarm > Overview > Product Info, that I was using version 7.0.470.000. I downloaded the latest version of Zone Alarm, but was not sure what version that might be. The website wasn't saying and it wasn't in the filename. It seemed I would have to install the version to see what version it was. But we didn't get there. I started scouting around for others who might have insights of value. It looked like MistyEyes on the ZoneAlarm forum was having exactly the same problem. In response to his/her question, the advice from Oldsod was as follows:

Make sure your DNS and DHCP server IP's are in your Firewall's Trusted zone. Finding DNS and DCHP servers, etc.:

1. Go to Run type in command , hit 'ok', and type ipconfig /all then press enter. In the returned data list will be a line DNS and DHCP Servers with the IP address(s) listed out to the side. 2. In ZA on your machine on the Firewall>Zones tab click Add and then select IP Address. Make sure the Zone is set to Trusted. 3. Click OK and then Apply and see if that works to fix it. 4. The localhost (127.0.0.1) must be listed as Trusted. 5. The Generic Host Process (svchost.exe) must have server rights for the Trusted Zone. Plus it must have both Trusted and Internet Access. http://zonealarm.donhoover.net/dnsdhcp.html

But I didn't get to that point either, because now my virus scanner informed me that, after a mere two hours of screwing around online, I had already contracted a Trojan virus. That gave me pause. I had been computing for two years without a virus. Now, in a couple of hours, I had one, apparently because I had lowered my firewall because the AT&T DSL modem wouldn't work otherwise. Further scouting around online led to the understanding that people who use cable or DSL modems are advised to use both hardware and software firewalls. ZoneAlarm would be an example of a software firewall. I wasn't sure if a purchased copy of ZoneAlarm (I was using the free download version) would get along better with my DSL modem; some posts online made me think that it might not make any difference. It seemed that the reason I had had no viruses during the previous year, at least, was that my roommate had been using a wireless router and this had served as a hardware firewall. So if I wasn't going to be computing in a place (e.g., a corporate office or university) where they had a dedicated tech support staff and equipment to trim out the riffraff, and if I wasn't going to have a roommate with a wireless router, it appeared that I would have to buy one for myself. I priced one at Newegg for about $55 with shipping. I was just about to buy that router, and then I paused to think. We were talking about a router for $55, plus a delay of maybe five days (including a weekend) before Newegg would have it to me; and then the possibility that I would have to buy a more professional software firewall or other security program. I also discovered, along about this time, that my existing Symantec Antivirus was not even detecting the Trojan, and that the other freebie program that detected it was not going to remove it unless I bought a copy of their full program. (I might have suspected that they were just inventing the virus in order to persuade me to buy their product, but I had been using the freebie version for a year or more without any virus alarms until now.) So $55 for the router, maybe $40 or more for the security program, and downtime for the merchandise delivery. And the prospect of future downtime if it turned out that I still didn't have the virus formula quite right, and got another one. Plus the risk of lost files or information. It was enough to provoke some serious thinking. The computer on which I was trying to install the DSL modem, and was having all these hassles, was the second of my two computers. Some time previously, I had worked through the issues involved with getting a KVM switch, so that I could use one Keyboard, Video screen, and Mouse (KVM) for both computers. I had also been thinking, for quite some time, about installing Ubuntu Linux, but had previously decided that it was not quite ready for prime time. Now, however, as I saw that Linux continued to have a reputation of being relatively free of viruses and spyware, and as I reflected on how it had felt to worry that a hacker might be able to get his/her hands on my private data (having also read that financial motives are behind much of the hacking that takes place nowadays), it seemed to me that I could try this DSL thing again with Ubuntu. If that worked, I would not have to buy the router and all that Windows-oriented firewall software etc. -- at least not yet. So now the scenario was that, quite possibly, I would have only one of my two computers connected to the Internet. This would be an Ubuntu computer, my second (i.e., backup) computer. If I needed to look up something or download something, I would do that on the second machine. The main machine would still be a Windows XP machine; it just wouldn't have Internet privileges anymore -- or at least not until I invested in the router etc., or until I moved the computer to a different place with a safer Internet connection. To try this idea, the main challenge was to get the alternate computer set up with Ubuntu. I had a spare hard drive lying around, a small old one, but Linux doesn't generally take much space, so that was good enough. I unplugged the Windows drive (and just left it sit in the computer) and plugged in, instead, this other old drive. I used the downloaded Ubuntu ISO to burn a CD, and I used the CD to install Ubuntu on the old, spare drive. Installation was painless. It was really quite easy. Ubuntu 08.04 (meaning the April 2008 version) had continued to improve over its predecessors. The harder part was getting connected to the Internet. A very nice lady at AT&T tech support in India tried to help me, but really had no idea what I needed to do, and she said it would be a fee-based service if I wanted one of their Linux-trained techies to walk me through an installation. Reserving that option, I tried calling a tech support guy at the university. He was a little bit amused, but he also did seem to have some familiarity with Ubuntu or at least with Linux generally, and between the two of us, we were able to figure it out. Again, I did not take precise notes, but the following is a reconstruction of what I think we did. First, at the top right-hand corner of the default, unmodified Ubuntu screen, I left-clicked on the monitor-like icon whose yellow tooltip pop-up says "Manual network configuration." That gave me exactly one option, "Manual configuration." Being the kind of person who is very practical when there is no alternative, I selected that option. This took me to a Network Settings dialog with four tabs, of which I would need only the default Connections tab. There, I had two options, both of which were greyed out. Down at the bottom right corner, I chose the Unlock button, and that wiped away the grey. Now I chose Wired Connection, clicked on Properties, unselected Enable Roaming Mode, and chose Automatic Configuration (DHCP). I then clicked OK and Close. Then I went back to Firefox, which comes pre-installed with Ubuntu. I cleaned out the Address bar and typed in just the IP address of my modem again, with nothing else -- the same 192.168.1.254 number as above -- and hit Enter. That gave me a confirmation screen that I had seen the previous evening, when the Windows setup had been working OK with DSL. The tech support guy suggested I try a regular webpage, so I tried CNN.com. It worked! It was really that simple. I am typing the final paragraphs of this message on Firefox in Ubuntu, less than a half-hour after making that tech support call. It remains to be seen what all I can or cannot do in Ubuntu now, but at least the preliminary plan is to keep it running as my Internet gateway, and pick up whatever other Linux knowledge that may come my way as I go along. So, see, let it not be said that I hesitate to take a risk on something new. It has been less than nine years since I first became a Linux newbie, and already I'm at the point of being able to use Ubuntu to go online. I know, it's like -- whoa, slow down -- but that's the naked truth of the matter.