Category Archives: Letters from the Ed

20H2 Alters Alt+Tab Experience

OK, then: I get it. When you run Windows 10 20H2 the OS does something different when Edge is running. Thus, when I say “20H2 alters Alt+Tab experience,” I mean that it goes through all open Edge tabs as you keep repeating that key combination. This is a little disconcerting, but something I guess I can get used to.

Exactly How 20H2 Alters Alt+Tab Experience

Prior to 20H2 if you had three applications open, striking Alt+Tab once would take you from the current application to whichever is next in the Windows sequence of open apps. Strike it again to get the third app, and again to cycle back to the start.

In 20H2, if one of the open apps is Edge, and it has multiple tabs open,  things change. When you get to Edge you’ll transition from the first (or currently) open tab, to the next tab in sequence. This  continues until you’d cycle back to the first tab you visited in this sequence.  Whatever comes up next will be the next app in the Windows sequence, at which point things continue as always.

A Possible Alt+Tab Gotcha?

Mayank Parmar, of Windows Latest, reports that some 20H2 users may find the Alt+Tab sequence disarranged after they upgrade to this new version. He doesn’t say if it applies to upgrades only, or if clean installs qualify as well. Either way, the symptoms are that the order of apps (and tabs) is inconsistent. In addition, stopping the Alt+Tab sequence on App 2 in a 1-2-3-4 sequence may drop the user into App 3, instead of App 2 as users expect it to do.

I haven’t been able to replicate this error on any of my 20H2 machines. But if you visit Feedback Hub and search on “Alt+Tab 20H2” you’ll see the top three resulting problem reports all talk their way around this issue. MS claims this has been addressed in Beta and Release Preview channel versions already. It’s not yet clear when that fix will make it to Windows Update, but it should be “coming soon.” Stay tuned, and I’ll let you know when that happens.

Facebooklinkedin
Facebooklinkedin

Pluton Enacts Prego CPU Philosophy

Here’s a blast from the past. In 1984, jarred spaghetti sauce maker Prego immortalized the phrase “It’s in there!” for its products. (Note: the link is to a YouTube copy of that very same TV advertisement.) But the tag line lives on, and comes with occasionally interesting applications. It helped me understand that Microsoft’s introduction of Pluton enacts Prego CPU philosophy.

What in Heck Does “Pluton Enacts Prego CPU Philosophy” Mean?

It means that functions currently associated with a separate chip called the “Trusted Platform Module” (aka TPM) move onboard the CPU die. That’s why I’m stuck on the Prego tag line “It’s in there!” It succinctly sums up what Pluton is and does.

On November 17, MS Director of Enterprise and OS Security David Weston wrote a post to the Microsoft Security blog. It explains Pluton nicely. The post is entitled “Meet the Microsoft Pluton processor — the security chip designed for the future of Windows PCs.” Therein, Weston reveals the notion of a ‘Pluton Processor’ as something of a misnomer — but a useful one.  Here’s what he says to help explain Pluton, already “pioneered in Xbox and Azure Sphere.” (Note: I added the emphasis in blue bolded text):

Our vision for the future of Windows PCs is security at the very core, built into the CPU, where hardware and software are tightly integrated in a unified approach designed to eliminate entire vectors of attack. This revolutionary security processor design will make it significantly more difficult for attackers to hide beneath the operating system, and improve our ability to guard against physical attacks, prevent the theft of credential and encryption keys, and provide the ability to recover from software bugs.

Thus, Pluton is not really a processor per se. It’s a set of circuitry included on the die and tightly integrated into the CPU itself. This prevents attacks on communications lanes between a physically disjoint TPM chip and the CPU.

There’s a Scare Factor There

Apparently, recent research shows that the bus interface between TPM and CPU “provides the ability to share information between the main CPU and security processor…” At the same time, “…it also provides an opportunity for attackers to steal or modify information in-transit using a physical attack.” (Note: the preceding link takes readers to a Pulse Security research paper. It explains how sniffing attacks against a TPM permit BitLocker key extraction, used to read an encrypted drive.)

The Pulse Security paper describes ways to boost security to foil such an attack. But MS apparently took the work very seriously. In fact, it introduced Pluton to make communications lanes between CPU and a security processor  impervious to attack.

Can Pluton Boost Windows PC Security?

Sure it can. It will indeed make sniffing attacks like those Pulse Security describes nearly impossible. And it should usher in a new, more secure approach to computing. This applies directly to handling “credentials, user identities, encryption keys, and personal data” (Weston’s words).

The real key, however, is that MS has all of Windows CPU makers on board with Pluton. That means AMD, Intel and Qualcomm . It will be interesting to see how long it takes for them to incorporate Pluton into their CPUs. We’ll wait awhile before the first Pluton-bearing chips hit the marketplace. I’m betting that Pluton will show up for both Windows Server and client OS chips as well (that’s not explicit in Weston’s post).

My best guess is that we’re probably two generations out. For all three makers of CPUs mentioned, it’s likely that their next-gen designs are too far along to incorporate the redesign and layout rework that incorporating a security facility on the die will require. That’s why it’s more likely two (or more) generations out, IMO. Stay tuned, and I’ll keep you posted.

Facebooklinkedin
Facebooklinkedin

20H2 RDP Mystery Remains Unsolved Until …

I’ve been raving about the SFF Dell Optiplex 7080 Micro a fair amount lately. I remain convinced it’s a good purchase and will be a great machine for long-term use. That said, there is the proverbial “one thing” that lets me know for all its glories, it’s still a Windows PC. I’ve been dealing with an RDP mystery — as shown in the lead-in graphic for this story — that actually affects RDP traffic in both directions. Its 20H2 RDP mystery remains unsolved, as all my troubleshooting efforts so far have failed.

Read on, though: I did eventually figure this out, and get RDP working. It turned out to be a basic and obvious oversight on my part. Sigh.

What Do You Mean: 20H2 RDP Mystery Remains Unsolved?

Despite chasing down a large laundry list of things to check and set, I get password related errors when trying to RDP into or out of the 7080 micro. The lead-in graphic shows what happens when I try to RDP into the box. When I try to RDP out of the box, I get an out-and-out invalid password (“may be expired” error) instead.

Obviously, something funky is up with authentication on this Win10 install, because when I try to access the device through the File Explorer network connection, I get a request for network credentials, too. Again, presenting valid credentials doesn’t work. I see a “not accessible” error message instead:

Here’s the list of what I’ve tried so far:

  1. Double-checked Remote Access is enabled.
  2. Relaxed all relevant settings in Advanced Network Sharing for Private, Guest/Public, and All Networks categories.
  3. Enabled all Remote Access checkboxes in Defender Firewall settings.
  4. Ran the Network Troubleshooter
  5. Ran the Microsoft Support and Recovery Assistant

It’s the Account, Stupid!

After noodling about with this for a couple of hours I realized that I had defined a local acount as admin. Worse yet, I had not promoted my Microsoft Account on the Optiplex 7080 Micro from ordinary user to administrator.

Because I was using my MS account credentials to attempt network login and access, I didn’t have permission to do the password lookups in LSASS needed to make the process work. Once I promoted that account to admin level, everything started working.

Sheesh! Talk about an obvious mistake. As with many problems with Windows 10, this one turns out to be entirely self-inflicted. At least, I know who to blame!

 

Facebooklinkedin
Facebooklinkedin

Astonishing Dell Precision 5550 Workstation Encounter

OK, then. Just yesterday, I noticed that Windows Update offered the Dell review unit I’ve got the 20H2 upgrade/enablement package. What happened next surely qualifies as an astonishing Dell Precision 5550 Workstation encounter. Bottom line: it took less than TWO MINUTES to download, install and process the enablement package for 20H2. This is easily 3 times faster than on any other machine on which I’ve run that package, including my brand-new Dell 7080 Micro PC. I knew this machine was fast and capable, but this takes the cake. Really.

It’s odd to see 16 hyperthreads/8 cores show up on a laptop. Apparently, they’re all ready (if not actually thirsty) for work.
[Image is shown 2x actual size for readability. CPU Meter Gadget.]

After Astonishing Dell Precision 5550 Workstation Encounter, Then What?

Good question! I need to run a bunch of benchmarks on this system, then gather up those results for publication here. But in the meantime, this system has taken everything I’ve thrown at it, and simply KILLED it. As you can see from the preceding CPU Meter gadget screencap, this machine comes equipped with an i7-10875H CPU and 32 GB of RAM. So far, I haven’t been able to slow it down much, if at all, by throwing work at it. Desultory benchmarks, like CrystalDiskMark, are frankly breathtaking (this is far and away the fastest system in my house right now). Even CrystalDiskMark turns in some pretty impressive read/write numbers:

By comparison, CrystalDiskMark results from my production desktop with its i7-6700, Asrock Z170 Extreme7+, and a Samsung 950 Pro 512GB SSD, are mostly lower. The top line reads: 1954 (read) and 1459 (write): 58% and 62%, respectively. The second line reads 1550 (read) and 855 (write): 90% and 41%, respectively. This changes in line 3 which reads: 1230 (read) and 391 (write): 194% and 109%, respectively. The two bottom lines are nearly identical, with a 42.49 (read) and 98.99 (write): 103% and 83%, respectively. There’s no question that newer-generation M.2 PCIe technology is faster on bulk reads and writes. And as you’d expect, random reads and writes being shorter and scattered about, those metrics don’t vary overmuch.

Performance Theory, As Usual, Beats Practice

According to its specifications, The P-5550’s SSD is an SK Hynix PC601A 1TB SSD. It’s a PCIe Gen3 x4 NVMe device with theoretical maximum of 958 MB/sec per lane, or 3,832 MB/sec for all four lanes. The actual performance is always slower, as the top-line numbers from the preceding CrystalDiskMark output show. But it’s not half-bad and is, in fact, the best-performing NVMe SSD currently at my disposal. At over US$4K for this laptop as configured, it’s pretty pricey: but you do get a lot for the money.

The Cold Boot/Restart Numbers

Here’s a set of average times, taken across three sets of measurements for typical PC on/off maneuvers:

+ From desktop to machine turned off (shutdown): 13.02 sec
+ From turned off to desktop prompt (cold boot): 16.01 sec
+ From desktop to desktop (restart): 30.01 sec

Across the rest of my stable of PCs, these times are at least 50% faster than anything else I’ve got. I still have don’t these measurements for the Dell 7080 Micro PCs, though. Given that they’re also brand-new and have similar CPUs and NVMe drives, i’m expecting numbers more like than unlike the preceding ones. Stay tuned! I’ll report that soon in another post.

For the moment, suffice it to say that the “Workstation” in the Precision 5550 product name is not just wishful thinking. This system delivers speed, graphics and compute power, in a beautiful, compact package.

Facebooklinkedin
Facebooklinkedin

VPN Works Around Weird Credit Union Access Issue

Suddenly, the usual login prompt from my Credit Union, where my wife and I both bank, has become inaccessible on my local network. No PC, no browser, no nothing will open the login URL. Errors proliferate like mushrooms after the rain instead. What gives?

Credit Union Access Issue. VPN login works, other access doesn't.
VPN Works Around Weird Credit Union Access Issue. VPN login works, other access doesn’t.

I’ve been working in and around IP networks professionally since 1988, and with IP networks since 1979. I’ve seen many weird things, and now have another to add to that list. From my LAN right now, no PCs can login to our credit union on the web. Nobody, that is, unless I go through a VPN link. Otherwise, when we (my wife and I bank together) try to access the login page, a raft of error messages presents. Only the VPN works around weird credit union access issue, which throws up beacoup HTTP error codes. (Explanatory text verbatim from Wikipedia.):

400  Bad Request: The server cannot or will not process the request due to an apparent client error (e.g., malformed request syntax, size too large, invalid request message framing, or deceptive request routing).
401  Unauthorized: Similar to 403 Forbidden, but specifically for use when authentication is required and has failed or has not yet been provided.
403  Forbidden: The request contained valid data and was understood by the server, but the server is refusing action.
404  Not Found: The requested resource could not be found [(aka “File not found/Page not found”)].
501 Not Implemented: Server either does not recognize the request method, or it lacks the ability to fulfill the request.
502 Bad Gateway: The server was acting as a gateway or proxy and received an invalid response from the upstream server

How VPN Works Around Weird Credit Union Access Issue

I can only assume that the address resolution for the specific login URL is somehow malformed or invalid. Changing DNS server assignments at the Windows 10 clients (in the TCP v4 Interface properties) does not help. When I switch to VPN, though, that bypasses the local DNS infrastructure. That connection uses the VPN provider’s DNS infrastructure instead. Then, we have no problems accessing the bank URL.

Now, here’s where things get interesting. I can’t remember the login credentials for the Spectrum device that acts as a Wi-Fi AP and router at the network boundary. Thus, I can’t check the DNS situation on that device, which is where DHCP tells all my Windows 10 machines to get their DNS information from. I’ve got a call into Spectrum to see if they can help me break into my router without having to do a factory reset. In the meantime, we’re using the VPN to access the credit union stuff, and plain-vanilla networking for everything else. It’s strange and unfathomable, but at least there’s a workaround.

For Want of a Nail…

Last night, I drove to the nearby Spectrum outlet and swapped my Technicolor cable modem/VoIP device for an identical replacement unit. The theory was that something about this device was behind the issue. It was sheer hell trying to get back online because Spectrum’s activation drill requires providing account, password, and other identity characteristics. I keep all that stuff in Norton Password Vault, and I couldn’t get access to that info through my iPhone nor did I have another path onto the Internet to grab the necessary data. I eventually had to spend another 45 minutes on the phone with tech support as they FINALLY activated our Internet service, TV, and VoIP phone. Reminded me too much of Catch-22 “How can you see you’ve got flies in your eyes when you’ve got flies in your eyes?” Last night, I couldn’t see much of anything for far too long!

Because our son attends school online, doing without Internet is impossible. Thus, I ordered a 5G hotspot from Verizon last night, so we have a medium performing fallback. They tell me the hotspot I ordered delivers about 200 Mbps downstream and 25 Mbps upstream in our neighborhood. I’ll be finding out — and making sure the fallback works — when it shows up via USPS early next week. Sigh.

Router Reset Solves Resolution Hiccup [Added 1 Day Later]

With a little more time to think about what could cause my problem, I formulated a hypothesis about the cause — and a likely fix — for my troubles. All nodes on my LAN had an issue with that one specific URL. But neither the site operator nor my ISP could replicate that problem. Thus it had to be on the boundary between my LAN and the ISP’s aggregation network. That means only one possible culprit: the Spectrum router. It sits at my network boundary. It also provides DHCP to the nodes on the LAN and acts as the DNS server for all internal nodes.

“Aha” I thought, “I bet resetting the router will fix this issue because it reloads — or repopulates, rather — the DNS cache.” I was right. After powering off the router, letting it sit for a minute or two, then powering it back on, our name resolution issue was gone. Glad to have it fixed because it was deucedly inconvenient without credit union account access. Ultimately, it was the “VPN trick” that led me to the solution. Sigh again.

Facebooklinkedin
Facebooklinkedin

Audible Clues When 8TB Backup Drive Goes South

Audible Clues When 8TB Backup Drive Goes South when I don't hear the backup drive run.
Except for November 10, all backups start just after 9 AM.
[Click image for full-sized view.]
This morning, I noticed something different just after 9 AM. That’s when the usual scheduled backup job on my production desktop fires off, and about 2 minutes later the drive starts clunking away. Check the timestamps for the Macrium Image (mrimg) files in the lead-in graphic in File Explorer. Except for today — November 10 — all the other jobs show a stamp in a range from 9:02 – 9:21 AM. What was different this morning? No drive clunking provided audible clues when 8TB backup drive goes south. And sure enough, when I checked Explorer at first, the drive was MIA. In fact, Disk Management showed a drive with neither GPT nor MBR disk layout.

After Audible Clues When 8TB Backup Drive Goes South, Time for Repairs

Luckily, I’ve got a commercial license for MiniTool Partition Wizard (MTPW). It includes both Data Recovery and Partition Recovery capabilities. So first, I let MTPW define the drive layout as GPT (as it must for a drive bigger than 2TB). Next, I ran the program’s Partition Recovery capability. About 30 seconds later, the drive’s contents were visible in the MTPW Partition Explorer. But I still had to assign a drive letter before repairs were complete. Immediately thereafter, I ran a manual image backup using Macrium Reflect to make up for the backup I’d missed along with the 8TB drive. As you can see from the most recent timestamp for the top file in the lead-in graphic, today’s belated backup is stored with all its predecessors.

A Bit of Insurance Against Recurrence

I also finally switched in my brand-new Wavlink USB 3.0 docking station (Model: ML-ST3334U) for the old Intatek unit I’d been using. Turns out the Inatek couldn’t handle even a 4 TB and and 8TB drive. Given that I’ve had problems with this dock before, I’d been waiting for the “next fault” to force the swap. I think that’s what happened this morning. I also think the Inatek can’t really handle ONE 8TB drive without power issues. The Wavlink, OTOH, is rated to handle 2 8TB drives. That’s why I bought it, and why I hope this means I won’t see my big backup drive go bye-bye again soon.

But weirder things have happened on my production PC, and may happen again. As we all know, that’s just the way things sometimes go (or go south) in Windows World. Count on me to keep you posted as and when such weirdness happens.

Facebooklinkedin
Facebooklinkedin

WU Gives 1903 Users Forced Upgrades

It’s not quite the apocalypse, but the end of support for Window 10 version 1903 is approaching on December 8, 2020. Thus, MS is now force upgrading PCs still running that OS through Windows Update (WU). Of course, 1903 has been out for some time, having gone GA in May 2019. It’s also been succeeded by three subsequent versions — namely 1909, 2004 and just recently 20H2. When end of support hits, MS stops issuing security updates, which makes machines running such an OS vulnerable to new security threats that won’t be patched. Not good! Time to upgrade then, which explains why WU gives 1903 users forced upgrades these days.

When WU Gives 1903 Users Forced Upgrades, Then What?

The funny thing is, Microsoft is upgrading these 1903 PCs to version 1909. What makes that funny is that this version (for Home and Pro users, anyway) will itself go out of support in May of next year (2021). Thus, those who go through an automatic upgrade through WU will have to repeat the process next May when 1909 itself runs into the same wall. Other,  newer ISO versions of Windows 10 are readily available through various sources. The Media Creation Tool for 20H2 is available through the Download Windows 10 page. Or, you can use AveYo’s excellent MediaCreationTool.bat script to access ISOs for most known Windows 10 versions. (I wrote about this for Win10.Guru on November 2, 2020.)

Given that 20H2 is still in the trickle-out process and hasn’t gone into wide distribution, it may make sense to upgrade from 1903 to 2004. In that case, you can use the afore-linked script to grab just what you need. Other good sources for 2004 include UUPdump.ml and the HeiDoc Microsoft Windows and Office ISO Download tool. Either one will also let you pick a version for the ISO you download, including 2004.

Moving Up from 1903

If you must upgrade from 1903 to some newer version — and I agree with Microsoft that it’s time to get cracking — I think 2004 makes most sense. Hopefully, these various sources for an ISO will help. And remember, to use an ISO for installation mount it as a virtual drive, then run the file named setup.exe from the root of that mounted drive to get the process underway. The Windows 10 Installer will do the rest. Cheers!

Facebooklinkedin
Facebooklinkedin

Intel Laptop Graphics Driver Upgrade Pros Cons

Here’s an interesting topic for Windows 10 power users and admins. As stated in this post’s title, there are plusses and minuses regarding Intel’s new — and frequently updated — DCH drivers. Intel graphics drivers show up on laptops with Intel CPUs. That’s simply because a graphics component is built into most such processors, particularly mobile ones. Indeed, some laptops have additional external (usually PCIe-attached) GPUs. But any of those with Intel CPUs can switch back and forth between the on-chip GPU and that external GPU . Thus it’s important to ponder Intel laptop graphics driver upgrade pros cons — particularly when choosing and upgrading drivers.

Understanding DCH Helps Unravel Intel Laptop Graphics Driver Upgrade Pros Cons

DCH stands for Declarative Componentized Hardware supported apps. This is the new, forward-looking architecture for Windows Drivers. It’s explained in a Microsoft Docs article entitled DCH Design Principles and Best Practices. There we find an explanation for each of the acronym’s letters (I quote this material verbatim):

  • Declarative (D): Install the driver by using only declarative INF directives. Don’t include co-installers or RegisterDll functions.
  • Componentized (C): Edition-specific, OEM-specific, and optional customizations to the driver are separate from the base driver package. As a result, the base driver, which provides only core device functionality, can be targeted, flighted, and serviced independently from the customizations.
  • Hardware Support App (H): Any user interface (UI) component associated with a Windows Driver must be packaged as a Hardware Support App (HSA) or preinstalled on the OEM device. An HSA is an optional device-specific app that’s paired with a driver. The application can be a Universal Windows Platform (UWP) or Desktop Bridge app. You must distribute and update an HSA through the Microsoft Store. For details, see Hardware Support App (HSA): Steps for driver developers and Hardware Support App (HSA): Steps for app developers.

Componentization is Good!

To me, the componentized piece makes the DCH driver both interesting and relevant to laptop owners. Basically, it means base driver packages from the device maker are OK — Intel, in this case. That’s because customizations from an OEM or laptop maker can slipstream onto the base level driver. And it won’t affect the behavior or reliability of the graphics circuitry. Especially for those who use their laptops for gaming (where drivers matter quite a lot, and change pretty frequently) this is good news.

Case in Point: Intel’s November 6 igfx_win10_100.8935.exe Driver Release

Late last week, Intel dropped the afore-mentioned new DCH drivers release. The release package is available at Intel Graphics – Windows 10 DCH Drivers web page. This new release covers Windows 10 versions 1709 through 20H2. It also comes in both ZIP (direct access to driver files and components) and .exe (self-installing formats). Those who use the Intel Driver & Support Assistant are already familiar with the .exe versions of the company’s drivers, because those are this tool’s default versions. If you look at the Release Notes for this …8935 version you’ll see that all of the key issues fixed call out computer games (Crysis Remastered, PGA Tour 2K21, Doom Eternal, World of Warcraft, Shadowlands, Red Redemption 2, and so forth). Hence, my earlier point about gamers as primary beneficiaries for such updates.

Other admins or owners with Intel GPU circuitry on their laptops can relax about updating laptop drivers on major-branch laptops (Dell, Lenovo, HP, and so forth). Why? Because the DCH architecture means that Intel’s base level driver is more or less guaranteed to “play nice” with any such customizations as the OEM/mfgr may add for its own laptops. In the past, I’d relied on the various vendor update services (e.g. Dell SupportAssist, Lenovo Vantage, HP Support Assistant, and so forth) as the sole source for laptop graphics drivers.

I’ve been experimenting with using Intel DHC drivers plus the occasional OEM/mfgr graphic driver on four Lenovo PCs for the past six months now. My experience has been almost completely positive, with only one install issue on a Lenovo X380 Yoga last month, easily remedied by a manual install after downloading the driver file from the Lenovo Support pages.

DCH Graphics Drivers: Worth Trying Out

Looks like DCH Intel graphics drivers are pretty safe, and ready for day-to-day laptop use. Don’t take my word for it, though. Conduct your own experiments on test machines (as I did) and see how things go. I’m reasonably certain of positive results. If not, I hope you’ll tell me all about it (comment on this post). Cheers!

Facebooklinkedin
Facebooklinkedin

Terrible Trials of Web Security

I run another Web site with a friend and colleague at Win10.Guru. Right now, the site is (mostly) inaccessible because we’ve fallen foul of Google’s Safe Site tools. Over the past couple months we’ve been hammered, dealing with terrible trials of web security. If you visit our site right now, you’ll get this dire warning:

Terrible Trials of Web Security

This is NOT an inviting entry into the website. It is calculated to scare people away.
[Click on image for full-sized view.]

If you click on the Details button, a link reads “visit this unsafe site.” Again, this is intended to discourage visitors. But because of Google’s security assessment, it’s the only way into our site right now using Chrome. Edge returns a 503 Service Unavailable Error, and Firefox times out. For the nonce, Win10.Guru is off the air. My partner and I are freaking out, trying to get this fixed. But this is only the latest installment in a litany of horrors we’ve endured lately.

What Makes for Terrible Trials of Web Security?

To start with, we faced multiple daily page injection attacks. Hackers were redirecting visitors to our website to third-party clickbait sites. (Presumably, because they could get paid for such clicks.) Some illicit redirect links also included malware, phishing scams, and other unsavory stuff. Thing is: hackers were also able to access and change the master permissions file for the site itself. This is, of course, the very special file named .htaccess that controls permissions and configuration of the file structure for the site. According to our hosting service, this is supposedly  impossible. Yet we demonstrated that our file structure changed over time because malicious actors were at work.

Once we’d shown them what was what, the provider granted us their high-end security software as a wrapper around our site. Presto! Our problems went away. But the trial period is over now, and it costs over US$300 a year for that added security on the site. My partner refuses the outlay for perfectly valid financial reasons. That said, I’m of the opinion that such a sum is better spent than having the site mostly inaccessible. Not to mention the days and weeks he’s spent trying to keep things cleaned up.

The Devil Really Is in the Details…

The Details button also lets users “report a detection problem.” My partner and I have been doing that multiple times daily. We’ve been asking our network to do likewise, hoping that a chorus might be more convincing than a couple of lone voices in the wilderness. If it’s not too much to ask, please click the preceding link and attest to the lack of ill will or intent on our part for https://win10.guru. It might make a difference.

But according to what I’m learning it takes 7-10 days for Google to review and change such rankings. I’m also trying to purchase additional security coverage on my own recognizance for the site, and keep getting an error message when I try to make payment. Gosh! It’s been one of those days, I’m afraid. Here’s hoping we’ll get this fixed soon. All I can say right now is “Ouch!”

[Note Added July 18, 2020] Crisis Averted!

Yesterday, July 17, working with the security team at GoDaddy subsidiary Sucuri.net (with whom we’ve obtained a subscription to their website security scannning and protection services) we finally got all the obstacles cleared away and a clean bill of health for the site. You can check its status any time through this URL: https://sitecheck.sucuri.net/results/win10.guru. One of their third-level tech support folks was finally able to convince Google Safe Browsing that our site was neither “deceptive” nor were we foisting any phishing exploits. I guess that means it helps to have a trusted third party vouch for your site, or something. At any rate, all the dire warn-offs are gone and the site is behaving normally. Thank goodness!

Facebooklinkedin
Facebooklinkedin

{WED} Certain Legit Tools Generate Windows Defender False Positives

The other day, I had Windows Defender scan all of my disk drives. This action artificially provoked a performance alert on one of my Lenovo laptops. While it was running it reported 8 malware items on my D: (Data) drive. Please note: all of these are categorized as “HackTool” items. MS correlates them with specific malware items and known exploits.  After overcoming my initial alarm, I looked where those items were found. All resided under parent directory D:\NirLauncher. Immediately, certain things became clear. Every one of the suspect elements is a password sniffing and capture tool in Nir Sofer’s collection of Windows Utilities. In fact, he’s got a category within that collection of 200-plus tools called “Password Recovery Utilities,” which comprises 20 items (see below). All of them popped up here. Aha!

Certain Legit Tools Generate Windows Defender False Positives .NirSoftPwdUtils

Once it found these items, Defender forced me to have it ignore these threats to retain access to them.
[Click image for Full-Sized View.]

If Certain Legit Tools Generate Windows Defender False Positives, Then What?

Once Defender finds something suspect, you must remove that item from its clutches before you can use it again. That meant I had to open Windows Security → Virus & threat protection, then click on each item it found. Next, I clicked “See details,” and then explicitly told it to ignore each threat one at a time.

As you might expect, there’s a better way to deal with this kind of thing if you prepare in advance. If you click “Manage settings” inside the Virus & Threat protection pane, you’ll find an Exclusions setting right below Controlled folder access. Click “Add or remove exclusions” and you can instruct Defender to bypass specific files or folders. I simply added an exclusion for the D:\NirLauncher folder and it will now be ignored in future complete system scans (the Quick Scan option only accesses the Windows C: drive anyway).

Pre-emption Beats Reaction Whenever Possible

Currently, I use several utilities that Defender flags as threats. In addition to NirSoft’s password utilities (which NirLauncher includes amidst its collection of tools), I’ve had to exclude Gabe Topala’s System Information for Windows (siw.exe). In days of yore, before I started using Superfly’s ShowKeyPlus, I used a tool called Magic Jelly Bean Finder that likewise got flagged. I excluded it, too.

The moral of the story is this: if you’re planning to install (or copy standalone) tools that find passwords or keys, chances are pretty good that Defender will flag them as Hacktools. If you take steps to exclude them in advance, you can avoid having to “Ignore” them later on. But please: make sure you run any such software through VirusTotal to be doubly darn sure it’s safe before allowing it to take up residence on your PC. Such tools can indeed be used for malefic purposes, as well as legitimate ones. Be safe out there!

Facebooklinkedin
Facebooklinkedin