What About KRACK?

It seems some marketing wonks at Norton have noticed the publicity around KRACK, a recently discovered vulnerability in the main wi-fi standard, and have decided to spread some FUD (fear, uncertainty and doubt) in the hope of generating a few extra sales for their VPN package.

I've been contacted by customers who have received scary emails from Norton telling them:

"All Wi-Fi connection points and devices could be vulnerable—your local coffee shop, home, or workplace connection.

KRACK can allow attackers access to important information like credit card numbers, passwords, and emails transmitted over Wi-Fi networks. This vulnerability can also allow attackers to potentially infect your devices with malware or ransomware."

Then comes the sales pitch:

"HIGHLY RECOMMENDED - Consider using a secure Virtual Private Network (VPN) such as Norton WiFi Privacy*, to help protect your data against this new threat."

Personally the last people I would trust to protect my wi-fi would be those who deliberately spread misleading information for gain, but that's a matter of personal (dis)taste.

So what is KRACK? Most wi-fi networks these days are encrypted to protect against eavesdropping, with the commonest form of encryption being something known as WPA2 (Wi-fi Protected Access 2). KRACK (Key Reinstallation Attacks) is a newly discovered way of breaking into WPA2-protected wi-fi networks. It targets the devices on the network, rather than the wi-fi as such, so changing your password doesn't help.

So far, so scary ... why am I suggesting Norton's email was more marketing FUD than engineering reality?

The way Microsoft and Apple implemented WPA2 on their PCs and laptops happens to be resistant to this particular attack, and both have released patches to fix remaining issues, so up-to-date Windows, iOS, macOS, tvOS and watchOS devices should be fine.

If you are sending credit card numbers and the like over the internet, I very much hope you are checking that the website you are sending them to uses https - every major vendor that I am aware of does. Https encrypts your details before they ever get near the wi-fi, so anyone breaking into the wi-fi would only get gobbledegook. Similarly with most passwords; and the vast majority of email providers support something similar (https, SSL or TLS) for email messages.

There are genuine concerns about smartphones. About half of smartphones being used were thought to be vulnerable when the problem was discovered (ironically, the newer ones with an Android version greater than 6.0). Apple phones should already be fixed, and Google's own phones should be updated with a fixed version of Android fairly quickly, but other manufacturers can be slow distributing updates. The comments above about https and other end-to-end encryption methods still apply though.

There are also concerns about the 'Internet of Things' - smart kettles, baby monitors used over the internet, and the like. To be honest, these have such a bad reputation for insecurity that I'm not sure KRACK makes much odds - although hopefully it will increase pressure on manufacturers to get a grip and take security seriously.

There are things that you should do as a result of this scare (under most circumstances buying a VPN service is NOT one of them):-

• Make sure your Windows/macOS/iOs is up-to-date with its scheduled updates;
• If you have an Android smart phone and its Android version is 6 or greater (or you cannot see what the version is), contact your phone supplier to ask if it is patched against KRACK;
• If your printer software asks to patch your printer firmware (check the request comes from the printer software itself, not an email or a website pop-up) then let it.
• If your broadband router came from your broadband supplier (not all do), contact them to see if they have updated the router software against KRACK.
• If you are filling in personal information on a website, make sure the website address starts with https (sometimes this is indicated by a padlock) - if it doesn't, you can often add the 's' yourself and it will take you to a secure version of the page.
• It is a good idea to protect all PCs and laptops with a reputable antivirus (Norton Antivirus is one example), for all sorts of important reasons. I suggest you seriously consider also protecting your Android smartphone with its own antivirus.

KRACK is mostly a major problem for high-level technical infrastructure and in corporate environments. For home users it is largely common sense and not letting the marketeers panic you. 

Windows 10 Missing Start Menu

Windows 10 has been around since July last year and is being heavily - not to mention heavy-handedly - pushed by Microsoft. Windows 10 is also decidedly flakey.

It's biggest problem at present is a tendency to fall over just after the monthly Windows update.

The commonest symptom I see is that clicking on the Start button (the Windows symbol bottom-left of the screen) does nothing. Then you realise that the search box next to it does nothing either. Then you find a variety of other symptoms which either stop or heavily interfere with your use of the computer. Then you curse Microsoft.

The trouble is that it looks as though that Start button is just a general weak link - a symptom which doesn't tell you much about its cause. Kind of like a headache can be anything from lack of sleep to an alien invader about to burst out of your brain (at least in theory).

So I thought I'd try to keep a record of a few fixes which have worked for me. Usual disclaimers: just because something worked for me doesn't mean it'll work for you; don't try doing technical stuff to your computer unless you know what you are doing; if it all goes wrong it is your responsibility - even if an alien chews it way out.

1. The best place to start, IMHO, is with a check disk. Windows 10 doesn't like you doing these, for some reason, so you have to persuade it (at your own risk - see above). Open an Administrator level command window (if right-clicking the Start button still works the option is in there, otherwise right-click the taskbar and choose Task Manager; from there choose File/Run new task, type in CMD, tick the 'administrative privileges' box, and click OK). Once the black command window is open type into it (after making sure all your other programs are closed, as it will reboot):

   chkdsk /f C:
   shutdown -r -t 5

   As the computer restarts it should check drive C: for dodgy indexes and file links. When it returns to Windows see if the Start button is fixed.
   
   
2. If that doesn't work, try getting Windows 10 to fix itself. Open that administrator command prompt again and this time type in:

   sfc /scannow

   This will take a while to run. At the end it will either tell you it has succeeded or failed; either way it might be lying, so reboot and see if anything has changed.
   
   
3. If there is still no improvement, try this more comprehensive version. Open that administrator command prompt again and this time type in:

   dism /online /cleanup-image /scanhealth
   dism /online /cleanup-image /checkhealth
   dism /online /cleanup-image /restorehealth
   sfc /scannow

   One of those first two lines is probably unnecessary, but the second is very quick, so you might just as well do both. These will take ages to run. At the end it will still either tell you it has succeeded or failed; either way it still might be lying, so reboot and see if anything has changed.
   
   
4. Finally, for now, a combination of Dropbox and a Windows update can horribly break the Registry. When I came across this it had the additional symptom of popping up a box when you click on the Start button telling you there is a critical error which it will try to fix next time you log in. Of course it fails.
   
   I did two things to fix this: a system restore back to before the latest Windows Update, then I uninstalled Dropbox, rebooted, and it all worked again. I have no idea whether the system restore was necessary, but that's what I tried first.
   
   For those interested in technical details, it seems that somehow the Dropbox had corrupted the user classes segment of the registry, such that it failed to load in the general classes when you log in (so in Regedit, under HKCU/SOFTWARE/Classes you just end up with a few Dropbox classes and very little else). It seems that Windows 10 assumes everything is present in this part of the registry when it runs, so if the general system-level classes are missing it fails in weird ways. When you uninstall Dropbox it undoes the damage to the user classes so Windows 10 can load in the system classes again.

Somehow I get the feeling this problem is going to run and run, so I'll add extra fixes as I find them. If you have found a different fix for this which worked for you, please add it as a comment so that others can learn from your experience.

How To Remove The 'Get Windows 10' Icon

A quick techie post for anyone who, like me, objects to Microsoft sticking advertising for its next operating system in their notification area and all over their Windows Update screen.

If you have Windows 7 or 8 and have suddenly had an icon appear in the notification area which says 'Get Windows 10' when you hover over it then, as far as I can tell, this has appeared because of a 'recommended' windows update KB3035583. I got rid of it (and an associated splash screen in Windows Update itself) by uninstalling that update and then hiding it.

Do note that whilst this worked for me, you should use due diligence on your own computer. I take no responsibility for anything which may go wrong.

Edit: Somewhat annoyingly, KB3035583 appears to have unhidden itself and installed as part of July's patch-fest. I've uninstalled and hidden it again ... so far, so good. I'll have to watch August's patches more carefully.

Defragmenting Windows 7

I'm a big fan of Windows 7, more so than any other version of Windows since Windows 2000, and far more so than Linux and the like. I find the user interface easy to use for everyday computer work, yet flexible and easy to drill down in when there is a problem or I want to do something more complex. However, as Windows 7 gets older it is starting to develop a couple of bad habits.

One problem has been a tendency to corrupt its own user login, leading to the dreaded "User profile cannot be loaded" message when you try to sign into Windows. This is discussed by Microsoft here, although their solutions are somewhat incomplete, I think. I haven't seen this problem recently, so with a bit of luck Microsoft have corrected it in one of the enormous number of recent fixes they have put out.

The other problem is the old bugbear of disk fragmentation. This is where files are held on the disk drive as several different pieces, which Windows then reassembles as it reads them. This can slow things down a lot because it takes several disk accesses to get one file, because it undermines various read-ahead strategies used to speed things up, and because it uses up processor power doing the reassembly.

Important: for SSD drives, disk fragmentation doesn't affect performance as much, but defragmenting an SSD can significantly reduce its life expectancy. Don't do it.

'Defragging' used to be one of those things which 'everybody knew' was needed to speed up your PC, although by Windows XP disk fragmentation was unlikely to be the main cause of slow PC performance. Fragmentation came out of the cold with Vista, where the built-in defragmenter is supposed to run automatically, but often doesn't, and where the interface heavily discourages manual defragging. Windows 7 was supposed to have sorted this, though, by making automatic defragmentation more effective, and by making manual defragmentation at least a little more visible and easy to run. For several years I thought this was working well.

At Christmas I got a copy of the game Dragon Age Inquisition. It is an enormous game, which takes an age to set up, and is very slow to load. Even given the game's size though, I was getting level load times of around two and a half minutes, which is simply ridiculous.

Pretty much the first thing I checked was disk fragmentation: the Windows defragmenter had run a few days before and reported a fragmentation level of zero. So I checked various other things, to no effect, then went online to see if anyone else had this problem. A few people did, and it was clear that my load times for changing level/area were way over the top. One common factor in other people's problems seemed to be disk fragmentation.

The Windows 7 defragmenter doesn't show the pretty picture of where everything is on the disk, colour coded according to how fragmented files are in each disk area. Defraggler does, so I downloaded it and had a look.

According to Defraggler, the disk defragmentation level was something like 33%, most of the occupied drive showed up red, and when I looked at individual files there was a whole stack of Dragon Age files all with multiple fragments. It seems that the Windows 7 defragmenter has a different definition of fragmentation from Defraggler (and from me).

So I ran a Quick Defrag from Defraggler - it made no difference. Then I tried a Full Defrag - it took forever and made little difference. It looks as though the built in Windows defragmenter doesn't report fragmentation which can't easily be dealt with.

When I looked at the details of what was fragmented, it turned out to be mostly System Restore files. Windows 7 has massively increased the amount of stuff it puts into system restore: it uses it for file level 'old versions' as well, so that is probably why fragmentation is suddenly becoming important again.

On another PC I have looked at, with Norton 360 on, there was also a pile of hard-to-defrag Norton files, and Norton's own defragmenter also failed to either defrag or report on fragmentation it couldn't fix.

Defraggler lets me defrag individual files, so I manually defragged everything I could. Then I went to 'Disk Cleanup' and chose 'Clean up system files' when it came up. As well as (partially) emptying temporary files, this also gives the option (on the 'More Options' tab) of removing all but the lastest System Restore files. NB: this should not be done lightly. I made sure my backups were good before I did this.

For the computer with Norton 360 I then went to Safe mode and manually defragged the Norton files in Defraggler.

Then the full defragment worked a lot better, as there were fewer immovable files present.

Then I created a fresh set of System Restore files, in the less-fragmented space now available, and went around the cycle of cleaning up old System Restore files and defragmenting again. Finally I had fragmentation on that disk down to about 2%, which is good.

After all of this Dragon Age Inquisition loads levels/areas in just under a minute, typically. Since I am playing it a lot, and moving between areas is a big part of the game, I consider all of the effort spent defragging well worth it (especially since I was able to apply the knowledge gained to massively improve the responsiveness of a customer's PC shortly afterwards).

Don't Panic But ...

They really are out to get you. Malware producers, that is ('malware' = viruses, trojans, rootkits, adware, spyware, junkware, spam-bots, etc, etc). And they're probably winning.

There was a time when the vast majority of infected PCs I saw had no antivirus and were used by teenagers who regularly downloaded 'free' pirated music. There was one parent who I was seeing about every six months until I pointed out how much cheaper it would be to use a legal paid-for service to download his son's music, rather than paying me to keep cleaning the PC up.

Nowadays most PCs have some sort of antivirus, and most people have at least some degree of wariness about the internet, yet the proportion of infected PCs continues to rise.

On Tuesday I came across my first infected broadband router. It had been reprogrammed so that all internet access using it went via a rogue website first. Fortunately it had been crudely done and the user was sensible enough to notice that something was wrong and call me in. Also fortunately she was still using Windows XP, which made it easier for me to see the fingerprint of the router infection; neither her Norton nor my anti-malware tools could see anything amiss.

If you are interested you can see a description of the way the router had been hijacked on Jakob Lell's blog (subtitled "Technology changes ... insecurity remains", which could be an alternative title for this post).

Most users just seem to accept that their PC does strange things that they don't understand, and that it runs frustratingly slowly. If they do notice the latter then they see an online ad saying something like "Speed up your PC" and casually download it, clogging their PC up with even more junkware (at best) and making it go even slower.

Governments don't help to clean things up, instead they just add to the mess. China has long been known to use malware to steal advanced technology, spreading viruses far and wide in the process. Israel and USA cooperate to create malware to attack Israel's neighbours, incidentally catching the rest of the world in the crossfire. Now we learn that the US's NSA and our very own GCHQ are busy creating ever more sophisticated malware in their quest to spy on all of the people all of the time.

It's like the wild west out there, but with the marshals leading the worst criminal gangs.

Is there anything you can do? Up to a point:-

1. Make sure you have a decent antivirus running, and that it is this year's version. My list of 'decent' antiviruses includes Norton, Kaspersky, F-Secure and AVG. I do not consider McAfee or Microsoft Essentials to be effective. Most antivirus programs include a year number as part of their title; Norton doesn't but has a 'New Version Check' in its Support menu. Unless you really think the extras are useful, I would recommend sticking with the basic 'antivirus' versions of these products - they are a fair bit cheaper and do the important job.
2. Apply Windows updates and Adobe updates religiously. Unless you are really sure that you need it, uninstall all versions of Java. When downloading Adobe updates make sure you untick their 'optional offer'.
3. Run a 'full scan' with your antivirus at least monthly. If you can't remember when you last did a complete virus scan then do it now: don't read the rest of the points, just do 1) and 2) above then run that full scan. It will take a while, but there are millions of infected PCs out there whose users just don't know it: make sure yours isn't one of them.
4. Don't install registry cleaners or other 'go faster' tools. If you have any already installed I would recommend removing them. CCleaner (free) is an exception: it is a decent disk cleanup tool but don't use its registry cleaner unless you are really, really sure you know what it is doing.
5. Similarly don't install multiple toolbars. Google or Bing or the BT one can be useful, but not the gimmicky 'something for nothing' ones.
6. Avoid free downloaders - they are hardly ever useful with modern broadband and several add extra nasties to the downloaded programs.
7. If you are still using Windows XP, double check your Windows Updates are installed and download and use Firefox or Google Chrome for your internet - the XP version of Internet Explorer (the big blue 'e' symbol) is far too vulnerable. This also applies, with slightly less urgency, to those using Vista.
8. Keep backups of anything important to you, especially digital photos. Not only do computer drives fail sometimes, but there are now viruses known as 'ransomware' which encrypt all of your files and charge you hundreds of pounds for the key to decrypt them again (which they may or may not then provide).
9. If you have a management program for your broadband router then use it to change the access password (and don't save the password in your browser when it asks) and, if you can find the option, don't allow access to the router from the internet (or the WAN as the option may put it).

You probably don't want to go paying a tech support person for every little oddity or slowdown on your PC, but do ask around to find a reputable PC support person in your area so there is someone you can call out when needed (it's the same general theory as plumbers - you don't want to wait until there's an emergency before trying to find one you can trust). If your PC is more than a couple of years old, you might find it useful to have it serviced - even without malware in all its guises, Windows itself tends to accumulate crud and slow down over time.

I think that PCs are wonderful things, which can open an amazing window onto the world - especially for older or less mobile users. It is a crying shame when unnecessary problems and malicious garbage prevent people from enjoying the benefits.

Windows 7 Gets The Black Screen Of Death Too!

Well, probably.

In this case it was a Vista laptop which the supplier had upgraded in-place to Windows 7 before supplying it (which seems dubious to me) and then the owner had upgraded again to Windows 7 Professional. So it is still just possible that a clean Windows 7 installation is a little more robust than Vista to these extremely aggravating KSODs (blacK Screens Of Death).

I wrote about KSODs in Vista way back, here and here. Essentially there are two flavours, both showing the characteristic black screen with just a white mouse pointer moving around it. The important difference between the two is that one occurs before you log into Windows, the other after. If the black screen occurs after you log on, you have a fighting chance (although it may still be difficult to fix). If the black screen is before you log in then you are in trouble: basically all of Windows' security is aimed at stopping you from changing anything.

In the case of the Vista KSOD-before-login linked above, I never actually managed to fix it - which was deeply frustrating. So this time, when I got a Windows 7 KSOD-before-login I was concerned, but hopeful that I could find a way around it this time.

I did eventually get Windows to boot ... unfortunately not until I had essentially given up, so I ended up trying several things at once and it's not clear which made the difference. And I certainly don't plan to try to recreate the KSOD again just to check them out.

But if you have a KSOD yourself, Vista or Win7, then hopefully some of this may help you do things a little more systematically and find a consistent solution.

IMPORTANT: do not do any of this unless you really know what you are doing in the technical nitty-gritty of a Windows 7 computer and unless you recognise that is you mess anything up it is entirely your own responsibility.

The least damaging of these possible fixes is simply to repair the partition boot sector (I suggest you refrain from fixing the MBR unless you really have to, as many manufacturers put special code in there for recovery partitions and the like). From the W7 repair console this is simply a matter of typing:

Bootrec /Fixboot

Reboot and see if this has helped. This is such a simple thing that it is probably the best first thing to try. Then try the fixes in my earlier post, linked to above, in case one of those helps you. If not, the other thing I did was much more drastic: I opened up file permissions to everyone in the Windows and root folders. This will make a mess of Windows and you will need to do a repair installation to (maybe) fix it - so it is very much a last resort.

First, try:-

 ICACLS C:\ /grant "Everyone":F

Then, from the root directory:-

ICACLS *.* /grant "Everyone":F

And finally, from the \Windows directory:-

ICACLS *.* /grant "Everyone":F /t /c

It is unlikely that you need all of these so try them one at a time and see if one of them does the trick.

If you do find a solution to the pre-login KSOD please leave a comment to let me, and others, know how worked for you.

Trusteer Rapport Problems

Over the past month or so I have had half-a-dozen PCs in with serious problems which turned out to be caused by Trusteer Rapport. Now, fixing PCs is what I do for a living so I guess I shouldn't complain that all the online banks who promote Rapport are generating work for me. Nevertheless, it just seems wrong that a product which is supposed to protect people ends up stopping them using their computers. Anyway, a lot of my customers I have known for years and I hate to see their time and money wasted.

Half of the crippled PCs simply wouldn't start at all: windows was just giving a BSOD (Blue Screen Of Death) and promptly rebooting. The other half started okay but Internet Explorer wouldn't run. These are, of course, typical virus symptoms, so I wasted time (and money) running thorough virus checks.

The BSOD machines would start in Safe Mode so, once viruses were ruled out, I was able to load a tool I use which tells me which drivers have crashed the system. Once I had identified that the drivers causing problems had names like 'rapportxx' I was able to rename all Rapport drivers and so start Windows properly. After that I restored the driver names and (without rebooting) uninstalled Rapport. Problem solved, and I simply added a note to the invoice to tell the customer what the problem was and suggesting that, if they believe Rapport to be useful protection, they should talk to their bank to download a fresh copy from scratch.

In the cases where Internet Explorer wouldn't run, once I had eliminated the thousand and one other causes of IE problems, I was able to find a FAQ entry on the Trusteer website telling me what to do in that situation - quite how anyone is meant to find that FAQ when their internet browser isn't working is another matter. The FAQ tells us to start Rapport Console (a program in the Start/All Programs list), to burrow deep into its settings to find the one which is about protecting Rapport from tampering, and to turn it off. Hey presto, the internet is back. The fact that there is a FAQ entry there implies that this is not an uncommon problem; the fact that Rapport fails to give any error messages as it disables Internet Explorer implies that people are unlikely to look at the Trusteer website for their FAQ because they wouldn't know they need to.

If Rapport was just another piece of Internet Security software, chosen and installed by the users themselves, these problems wouldn't be so bad - all software has its issues and antivirus programs in particular are inclined to go wrong, because they are always on the frontline of the battle against the bad guys trying to use our PCs to steal money. But Trusteer Rapport is not just another security program: it is very heavily pushed by the internet banks onto users who are not technologically savvy and who believe what their banks tell them. Those banks should not be promoting software which doesn't have the quality control in place to avoid breaking users' PCs and/or disabling their internet access, particularly when it does not even give clues that it is Rapport doing the breaking.

The first couple of Trusteer Rapport problems I encountered, I just assumed that they had released a duff update and it was a one-off. Now I am suggesting to customers that they might want to have a word with their bank to find out just why they are promoting software which is costing said customers time and money by breaking their computers.