Kill those Vista and Win7 gadgets now!

Topic

New Reply

	TOP STORY Kill those Vista and Win7 gadgets now!
	By Woody Leonhard In the unlikely chance that you’re using Windows gadgets, you need to get rid of them — right now! Those seemingly innocuous accessory apps that you stick onto your desktop, included with Vista and Windows 7, could be used to subvert your system.

---

The full text of this column is posted at WindowsSecrets.com/top-story/kill-those-vista-and-win7-gadgets-now/ (opens in a new window/tab).

Columnists typically cannot reply to comments here, but do incorporate the best tips into future columns.[/td]

[/tr][/tbl]

Reply | Quote

Replies

Is the danger confined to gadgets which might be inected that you download or can it apply to gadgets you already use that are virus free? I like my gadgets

Reply | Quote

Re your newsletter article you refer to MS Article 2719962 but when you click on this you get 2719662. Anay significance in the different number or just a typo ?

Reply | Quote

My biggest question is why by this Thursday? It sounds like doomsday, or the Attack of the sidebar Widgets day. To remove at anytime, I understand entirely. But by Thursday? Why the deadline of Thursday?

Reply | Quote

This article seems a bit alarmist to me. Surely if your PC is well-guarded already, the widgets don’t provide a back door through firewalls, etc….

Reply | Quote

I sent the following response to Microsoft re the FixIt article that you referenced (MS Support article 2719962)

It says”To enable or disable this Fix it solution, click the Fix it button or link under the Enable heading or under the Disable heading. Click Run in the File Download dialog box, and then follow the steps in the Fix it wizard.”, but then promptly has the “ENABLE” over the Fix It button that has the text “Disable Windows Sidebar and Gadgets – Microsoft Fix it 50906”!!!! and “DISABLE” over the Fix It button that says “Enable Windows Sidebar and Gadgets – Microsoft Fix it 50907” !!!!!! Look for yourself – so which one should one click to DISABLE the gadgets???
Please unscramble the confusion and pass on the correct one to choose, thanks.

I would be interested to hear your take on which button to click
Brian

Reply | Quote

I would dearly love to apply the quote that “In Windows 7, you can run gadgets with or without the Sidebar”. I seem to be able to run Gadgets only if the sidebar.exe is running (as shown in Task Manager). Could anyone tell me how to uninstall sidebar.exe but still be able to run the few gadgets that I use many times each day?

I know that I can drag the gadgets off the sidebar area and place them anywhere on the desktop, but that isn’t really running the gadgets “without the sidebar” because if I then close sidebar.exe, all the gadgets close as well.

Windows 7 Home Premium 64 bit.

Reply | Quote

Hello Brian (BGCP)
I didn’t even notice the Enable and Disable text above the lines. (der) I just clicked the Fix It button on the left over the link “Disable Windows Sidebar and Gadgets” and text “Microsoft Fix it 50906”. When I ran the file, it removed my widgets, so it seems to be the right one. Hopefully. . . .

Cheers
Sue

Reply | Quote

Personally (as I said in another post), I love my gadgets and will NOT be disabling them. Since I only use ones that have no internet connections (clock, CPU, network, calender and app launcher), I can’t see why I need to get rid of them.

I think the article was very alarmist.

Alan

Reply | Quote

When you go up to Microsoft’s gadget gallery, it does indeed say that ” the Windows website no longer hosts the gadget gallery. ” It also states: “Gadgets installed from untrusted sources can harm your computer”. I guess my questions are: Is Microsoft a “Trusted Source?” Are the 9 gadgets that came with Windows 7, “Safe?” Are we being draconian by eliminating the feature entirely? Note: These are not rhetorical questions, I really would appreciate answers. – Thank you

Reply | Quote

Hello,
Just noticed that by disabling my Gadgets with the Microsoft FixIt… I also disabled my SOUND.

Running the other FixIt, re-enabled my sound…

I can’t do without my sound, so what do i do now?

Is there another way to disable the Gadgets?

Help…

Thanks,
Ben

Reply | Quote

Would anyone know if Google Side Bar and Gadgets have the same problem?
//Ove

Reply | Quote

Safe to say that no one else had problems with their sound?

Ben

Reply | Quote

I have a few gadgets that are quite old and I like to use. I have had them for years and I don’t see why suddenly due to some convention that hackers will be out there looking for my Vista-era gadgets on my Windows 7 machine which is has a good firewall. Seem like they have been being phased out for quite some time and I just don’t think they will be much of a target.

Reply | Quote

@all those talking about “alarmist”: You don’t see the potential impact of unsafe software already running on the computer.

@alan sh: You LOVE your old duds (unexploded bombs) so much that you still sit on them when someone is beginning to hammer on the detonator. Comfortable place to be in!

With (hopefully some) reason: When Micro$oft comes out the way they did then they (M$) know that there is a really big dud sitting around.

Okay, there is some confusion about numbering. Go to Micro$oft’s support web site and dig through it there! Not every piece of ice cream comes prearranged on a golden spoon!

What strikes me is NOBODY (so far) reported the error massage (“This installation package could not be opened …” that I get when I try to run it (Win7 64-bit, fully up to date). Maybe I have overlooked something.

Reply | Quote

Anybody remember that early 2007 (release of Vista) many machines were sold that I considered off the bat as underconfigured? In those machines the Sidebar and the Gadgets caused IMHO perceivable performance hits.

I remember many warnings to turn them off because of that and I gave that warning to all my customers with Vista or 7.

It always amazes me how many people use things like gadgets mainly because they are there.

Just a thought.

Reply | Quote

Tried twice on my system (Win 7 Ultimate), but couldn’t instal downloaded .msi file – got an error message (think it was 2378 or 2738). No apparent ill effects so far.

Allan

Reply | Quote

I too got a 2738 error. Dowmloaded the .msi twice to no avail.
G++

Reply | Quote

FWIW: [Running Win 7 Pro.] Read today’s posting in WS about the Gadget security issue. Clicked the link in the article, arrived at MS support page. Clicked the “Disable Windows Sidebar and Gadgets” link. Downloaded and ran MicrosoftFixit50906.msi; rebooted. No problems. Copied the fixit file to my husband’s laptop, also Win 7 Pro. It appeared to install okay, but the system couldn’t reboot. It got as far as displaying the desktop background and a nonfunctional task bar, but couldn’t populate the desktop with anything. I’m thinking that it might be that his machine was running the Clock gadget, whereas my machine wasn’t running any gadgets. Had to go into Safe Mode and do a restore.

Reply | Quote

I get an error message2639 or something which is Windows isn’t configured correctly. I am running Vista Ultimate 64bit

Reply | Quote

Uninstalled no problem on Win 7 Home Premium 64bit . Clicked left box –
Disable Windows Sidebar and Gadgets Microsoft Fix it 50906

Still have sound but I sure do miss my Google gadget that told me I had mail and calendar events. Downloaded what I thought was something similar (but not a gadget) but it doesn’t work (it’s old and probably hasn’t been updated to accommodate changes to google calendar).
~Annie

Reply | Quote

What is sadly disappointing is that customer’s like ourselves pay for a product only to find ourselves being cheated, little by little.

Every time i see “Vista Extra’s”, i get teed off because it is a reminder of uselessness and garbage / clutter. If i recall, whatever “extras” anyone got, was a one time deal at the very beginning. But now its nothing more than a nagging reminder.

What is also sad is that “Gadgets” may prove to be a detrimental feature. But if it is, then what will Microsoft give us in return for removing the marketed feature? I mean they sold Vista in part by this feature and if they now want to take it away for safety purposes, then Microsoft should……..

I allowed the above to trail off because everyone has an opinion of what Microsoft should or should not do.

I recall all the hype behind Vista. However, Vista ( a bloated behemoth ) ultimately proved to be a pain for everyone, ie customers and hardware manufacturer. It was an uncompleted experiment and I wont make the same mistake with W8.

Reply | Quote

All I can say is that when I blindly followed the instructions and clicked Run on my Windows 7 Ultimate machine, all hell broke loose! It asked me to reboot the system which I did while I still had MS Outlook and IE 9 open. When the system rebooted (NOT) all I had was a black screen with a large (480X640 ?) Start on the screen. After 10 or more minutes, I shut the system down by killing the power. When it re-started, I got the “System failed to start …” message and for another 10 or more minutes waited for it to find a solution! NOT! Again, I turned off the system power and restarted in Safe Mode. Whew, thank God, my files were all still there but all of my Restore Points were erased! And, my clock had been reset to Standard Time!? I did some cleaning of Temp files, etc, and then did another power down. Finally, when I applied power, the system came up normal, albeit all Restore Points were still gone and the clock was on Standard time!!! I have not checked all my apps but at least Outlook, Excel and Word are okay.

Never again will I do something as foolish as this without waiting for a full week or more to see who else might have probllems! I even saved the MSI file to a flash drive with the intent of doing the same thing on my wife’s hp laptop running Windows 7 Home. I can hear the screams now! Ha Ha

Reply | Quote

Let’s see. I’ve been using my gadgets for a few years now without any problem, mostly the same ones, mostly through Microsloth. I don’t see any way shape or form that they can run without sidebar running; you kill the sidebar process and the gadgets go away. Now I know that for some reason Microsloth doesn’t want people to run gadgets anymore; hmm – oh yes, they want you to go to the MUTRO idiots and Windows stupidphone interface they want to force on Windoze users. Now we’re told that we have to clear them out by Thursday – or else. Or else what? We’re told to use a ‘fixit’ that managed to ‘FIX’ someone’s audio to not work anymore.

Wow, this reminds me of the web page one of my kids had the other day, claiming to be MSE and that there was a virus on my system, Click OK to remove. Except that it was a fake, it wasn’t MSE, it was a cute web page dolled up to look like MSE. Almost sounds like this article was written by a Microsloth marketing slug, which is what I’ll believe until we get some answers.

Reply | Quote

Tried twice on my system (Win 7 Ultimate), but couldn’t instal downloaded .msi file – got an error message (think it was 2378 or 2738). No apparent ill effects so far.

Allan

Yes I get the same and its 2738.What does it mean? What do i do?

Reply | Quote

Vista is something like five years old; Windows 7 has been around for at least three years. As far as I know, in all that time there has been no major security issue involving gadgets. Do you mean to tell us that in five years not one of the bad guys out there has discovered the vulnerability that the people at Black Hat are going to tell us about at the upcoming convention? Further, given Black Hat’s approach, don’t the involved software developers normally hear about a vulnerability before Black Hat broadcasts it to the world – so that the developer(s) can have a fix in place before someone tries to exploit whatever flaw they then tell us about?

Reply | Quote

Further, given Black Hat’s approach, don’t the involved software developers normally hear about a vulnerability before Black Hat broadcasts it to the world – so that the developer(s) can have a fix in place before someone tries to exploit whatever flaw they then tell us about?

That has undoubtedly happened here;

Acknowledgements

Microsoft thanks the following for working with us to help protect customers:

[*]Mickey Shkatov and Toby Kohlenberg for working with us on Gadget vulnerabilities.

Microsoft Security Advisory (2719662) Vulnerabilities in Gadgets Could Allow Remote Code Execution

But Microsoft have chosen to advise users to disable gadgets altogether instead of trying to fix the problem.

Bruce

Reply | Quote

I mean no disrespect [to Woody] but how many years or Windows versions will it take before we read about how METRO APPS must be replaced immediately with feature X in the upcoming new release of WINDOWS because feature X is finally that tech we’ve been waiting for, the secure and easy to use tech that will make all our dreams come true and keep us safe and secure forever?

I’m not being critical of the whole software upgrade cycle nor am I implying that Gadgets are unsafe or that Windows Metro APPs aren’t safe. What I am saying is that each time a new upgrade comes along the sales pitch used for feature X in said upgrade is that it is the tech that we’ve been waiting on since the dawn of the PC/software. Unlike everything before it, feature X tech is safe, secure and easy to use [unlike its predecessors].

It would be far more honest and less insulting if the vendor were more honest about whole thing and sold feature X as the more secure and or better solution currently and not as that magically thing we’ve been waiting on all our lives. I do understand why the software vendor (Microsoft in this case) pushes it this way but I don’t understand why so many outside critics seem to go along with repeating the marketing sales pitch.

Reply | Quote

I applied the fixit MicrosoftFixit50906.msi that removes gadgets. Since then an instance of SQL Server which would not start automatically on reboot, started every time. However, the system now doesn’t recover from Sleep mode. It comes up as not having shut down properly and asks if I want to start in safe mode or normally. So I applied fixit MicrosoftFixit50907.msi to restore gadgets. Now the computer recovers properly from sleep mode, but SQL Server again doesn’t start automatically. Aaugh! There’s more to gadgets than meets the eye.

Reply | Quote

Gadgets, IMHO, are not the problem. Microsoft and this rather strange fixit are. And whatever sort of bug or ‘feature’ sits out there undocumented. Consider this. Some months ago I put a new, larger, higher res monitor on a PC. Set the new resolution. Each time I logged in, Windows set the resolution back to the old setting. Turned out to be an undocumented feature of Live Mesh. Fixing it meant uninstalling Mesh, changing the resolution to the correct setting, and then reinstalling Mesh if desired. MS does not document this but is well aware of it. In regards to your SQL Server problem, check the MS docs to see if they detail what the fixit does; maybe you need to do a piece of it manually (carefully).

Reply | Quote

Does this apply to all gadgets (calendar, clock, system info – for eg., cpu temp) or only those that offer push data (stock tickers, etc).
I expect that the former use only locally-generated data; why would they be vulnerable?

I use Norton Internet Security 2012 which places a gadget (titled “Secure”) on my desktop. Indeed, hovering over it brings up a “Drag gadget”
ability. Is this one also vulnerable?

Thanks

Reply | Quote

Good point. I understand that there can be vulnerabilities in any code, but I mainly see this being an issue if you’re using widgets such as a stock ticker or a news pane that constantly updates. I myself am going to keep the few widgets I have Calendar, Clock and Resource meter.

Does this apply to all gadgets (calendar, clock, system info – for eg., cpu temp) or only those that offer push data (stock tickers, etc).
I expect that the former use only locally-generated data; why would they be vulnerable?

I use Norton Internet Security 2012 which places a gadget (titled “Secure”) on my desktop. Indeed, hovering over it brings up a “Drag gadget”
ability. Is this one also vulnerable?

Thanks

Reply | Quote

I forgot, NIS gives a gadget, HP has a print gadget. Then there’s weatherbug, coretemp, and lots of others that have been around for several years, mostly with great reviews.

Reply | Quote

I did the “digging” suggested by Eike and no luck — the numbering is still confusing. However when I installed 50906, it made the appropriate registry entries to disable the sidebar as described in the workaround section of MS KB 2719662. So pick that one.:rolleyes:

Reply | Quote

I’ve used the clock, calendar, and local area temperature widgets for several years now. Surely these default widgets can be made secure. Sad that hackers just want to make lives miserable for folk. Hopefully M$ get’s off their arse and patches this issue pronto since I bet 90% of folk using either Vista or Win7 use at least the clock.

Reply | Quote

If one is not using any Windows 7 gadgets, does this fix need to be applied? Thanks.

Reply | Quote

After much confusion at the MS site about which disabled and which enabled (solved it by trial and error) I have removed gadgets from my WIN 7. I miss my gadgets. So useful. Now that Google has abandoned its gadgets too, how about finishing the article with suggestions for a replacement gadgets program.

Reply | Quote

This is hysterical! When I go to the FixIt link, the title for the Enable is Disable; and the title for the Disable is Enable. Very confusing. Way to go, Microsoft

Reply | Quote

After reading Woody’s article on gadgets, it made sense to me but to what level of alarm? Here’s some food for thought… Symantec’s Internet Security Suite and 360 software have a Desktop gadget to show the security status of your computer. Here’s one of the top security organizations putting out a gadget that could possibly be a crack in the dyke?? Now I don’t know what to believe but I decided that I can look up on the wall for the time, the weather in the newspaper in the a.m. and the only thing I will miss is that little gadget that shows movement when there is activity. Hate to do it but I think I will follow Woody!

Reply | Quote

So you don’t like gadgets, but you’ll happily run a .MSI file just because it comes from an MS site (and, as we have seen above, is not error free). Personally, even if I was going to not use gadgets, I’d just stop sidebar.exe from running at startup and leave it at that.

[rant]I must admit to getting fed up with MS reducing the functionality of my PC over the years. They add features I don’t want and take away ones I do. [/rant]

Reply | Quote

I appreciate being notified about this issue. Too bad Microsoft didn’t feel the need to mention it in Windows Update with a patch for its workaround. At a very minimum, they should have notified every one of its registered users by email instead of placing a bulletin on its website and an entry in Mr. Fix It.

I could care less about sidebar and gadgets, as they are just desktop candy anyway. I deployed the workaround and can safely say I have one less thing to be concerned about when it comes to hackers and like scum who take a sick and perverse pleasure in creating harm to others. . .

Thanks Woody!

Reply | Quote

After reading the article I am not at all certain if I should run the Fix It to enable the sidebars or just run the one to disable it and leave it go at that. I do not use sidebars so I am guess I only have to run the one to disable it.

Reply | Quote

I would imagine Windows installs Gadgets and sidebar as a default and then you would just need to start it from Programs or from desktop properties. Nevertheless, I would just run the disabler and let it determine if it needs to disable anything. Good luck. It was painless and quick for me. . .

Reply | Quote

As a fan of “local” gadgets such as date, time, and drives, I am anxious to hear the author’s response to leaving such gadgets active. I have been using them since W7 came out with no troubles at all. Gadgets such as “Weather Bug” that communicate to the web are obvious potential problems; however, I hope non-communicative gadgets are still OK.

Also, how about Google “Gadgets” that run in the browser. Are they “sandboxed” in Chrome or do they also leave you open to attack?

Reply | Quote

What about sidebars that may be running in Windows XP? I used to use the sidebar available at this website: http://www.desktopsidebar.com/. Currently I have it uninstalled but am thinking maybe of reinstalling it and using it.

Reply | Quote

Well, I ran the fixit and no problems.
But I noticed when you go to Control Panel you no longer can open the Gadget option..

I agree with some of the others here.
MS should have put it out in their weekly patches….

Reply | Quote

Man, am I ever glad I have read this thread all the way through. I was going to do a fix but the more I think about it I do not think I have them on my computer. Or at least I don’t see them. Having a 7 64 bit system I was wondering about any problems but things seem to be ok.

Heck, the only reason I went to this thread was to inform the crowd that in the article it says “MS Support article 2719962” and it is really seems to be “Microsoft Security Advisory (2719662)”. But then maybe I’m wrong about that as well but I do not see anything mentioning 2719962. There are two hyperlinks leading to 2719662 in the article but the one under “What you need to do before next Thursday” is configured properly but labelled 2719962. But then again I did get to the right spot anyway so no real problem.

Reply | Quote

Well Deleter, I may be wrong but I think it’s the whole sidebar issue not whether you have any gadgets installed….

I believe if you look in Task Manager you will see the Sidebar running…

Reply | Quote

I am pretty sure Windows 7 does not include sidebar because that OS will allow placement of gadgets anywhere on the desktop. Prior to running Mr Fix it I checked running processes and loaded modules and nowhere was sidebar*.* listed. Additionally, it’s not even shown in the list of windows features from within Control Panel’s Programs and Features. The only thing shown there is “Windows Gadget Platform” and the box was checked. After running the workaround, the “Windows Gadget Platform” remained checked, but I was unable to start Gadgets.

What is not clear to me if the fix just disables the gadget feature or if it removes it entirely from the OS. Additionally, I don’t know if we should manually uncheck the “Windows Gadget Platform” box in Windows Features or just be statisfied that the fix has done a complete and thorough job. MS’s support site is down so can’t ask any questions to them in this regard right now. Oh well. . .

Reply | Quote

Well, I am running W7 and I had sidebar running when I used gadgets..

Here’s a screen shot..

Reply | Quote

You are correct. Windows 7 did include sidebar; however, it performs differently than Vista’s and therefore is hidden from normal view. Sidebar only starts if you are using Gadgets. If gadgets are not being used, then sidebar.exe is not started nor is it loaded as a process or module. See MS doc http://msdn.microsoft.com/en-us/library/windows/desktop/dd370867(v=vs.85).aspx

Here are some excerpts:

‘Good Bye Sidebar

Gone is the concept of the Sidebar as a container. Instead, gadgets are now hosted and displayed on the desktop. A Gadgets item on the Desktop context menu provides access to the Gadgets Gallery so that you can choose, install, and use gadgets. This change simplifies gadget management, streamlines and unifies the overall desktop UI, and eliminates the need for special Sidebar settings. Note that all gadgets are still owned by the sidebar.exe process.’

‘The Sidebar Process

Another performance improvement for Windows 7 is management of the sidebar.exe process. In Windows Vista, the Sidebar starts multiple instances of the sidebar.exe process. In Windows 7, only one instance of the sidebar.exe process starts. This single instance does not start until a gadget is added to the desktop, the Gadget Picker starts, or a new user session starts with existing gadgets on the desktop. If the Gadget Picker is closed with no gadgets added to the desktop, or the last gadget is deleted from the desktop, the sidebar.exe process stops automatically.’

‘Because there is no Sidebar associated with the Gadget Platform in Windows 7, there are no dock and undock events. However, to maintain backward compatibility, the same code can be used for a similar effect. First, define a dock or undock event handler. When the mouse pointer hovers over the gadget or the gadget receives focus, an additional icon is displayed. Click this icon to raise the dock event (Smaller size) or undock event (Larger size). The gadget performs the visual transition.’

—–

So, for someone who isn’t running gadgets on Win 7, they would find no evidence of sidebar.exe on their system, unless doing an administrative search. That search would show the sidebar app located at C:Program FilesWindows Sidebar.

So, it is my understanding that after applying the Mr. Fix it disabler for gadgets, sidebar would never be able to run without first re-enabling gadgets. This was a long convoluted way to get an answer to my question and I don’t know why MS didn’t make it clearer at the outset.

Take care. . .

Reply | Quote

Several points can to be made more clear.

(1) If the Fixit doesn’t work, there are manual methods which all have one effect: Disable the Windows Gadget Platform (Windows 8) or the Sidebar Feature (Windows 7 and Vista). In Pro or Ultimate Editions which have the Group Policy Editor Snap-In, this is simple to do. In other editions, it isn’t as simple if the Fixit doesn’t work. And there is a risk of collateral damage to other Windows features — like sound, the Taskbar, the Notification Area, etc. — as noted throughout this thread.

(2) The Fixit does not run in Windows 8. In the Release Preview, the Windows Gadget Platform needs to be unchecked under the Control Panel Heading of “Turn Windows Features On or Off”. In future Win 8 editions, there won’t be an issue, as this Platform will (probably) go away.

(3) Personally, I have never trusted Widgets from Yahoo or Google. They spy on users and display ads in some cases.

(4) All true Gadgets are equally vulnerable. And the Platform itself is riddled with security holes. The Black Hat pre-announcement (and Microsoft’s first responses) make this look likely. I have a utility called Battery Bar from Osiris Software which looks like a gadget, but is in fact not a gadget. I’d like to see more of this kind of “floating window” utility.

(5) Microsoft is not interested in propping up this dying Platform. They will never patch it. Instead, those with Automatic Updates may wake up one morning to find their Gadgets gone or their Windows Desktops messed up badly.

(6) I just spent a long time getting rid of the Babylon Toolbar which piggybacked along with a third-party Gadget which was perfectly malware-free just two weeks ago. Let this be a warning — things are already getting nasty out there. (I know, Babylon is not always classified as malware, but that does not make it any easier to remove once it’s been installed. I ended up rolling back using a System Image, just to save time.) This was in Wndows 8 RP.

I have been very fond of Sidebar Gadgets for system monitoring. Nothing I’ve found since this story broke has satisfied me in terms of visual clarity, amount of data graphically presented, or compactness without cluttering up the Tray Notification Area, the way the Gadgets could do. I may be in a small minority, but I will truly miss Gadgets and Widgets.

But insecure platforms have got to be replaced. Let’s hope Apps don’t turn out to be as controversial (and insecure) in the Metro Microsoft Store as they have been on Smartphones and Tablets from other companies.

And no, the death of gadgets will not drive me to embrace the Metro Desktop. Nor to abandon my plans to dual-boot Windows 7 alongside Windows 8 if I choose to use Win 8 at all.

-- rc primak

Reply | Quote

Bob, I use InfoBar which is good and very configurable to show things you want like system stats, uptime, hard drive etc…

I believe you can get it at Sourceforge…

Reply | Quote

Bob, I use InfoBar which is good and very configurable to show things you want like system stats, uptime, hard drive etc…

I believe you can get it at Sourceforge…

Can you supply a screenshot or two of Infobar? It looks like documentation at Sourceforge is very thin. And future support of this project seems doubtful right now.

To All Skeptics —

This is not a conspiracy, and not a false alarm. The security issues are there, whether you choose to accept or ignore them. And like Active-X, local gadgets are not isolated rom remote attack possibilities. Think before you place your computers in jeopardy.

-- rc primak

Reply | Quote

Sidebar.exe does not run on my system and I have no gadgets. Even if it was, it would need to be starting up automatically, and it can simply be removed through msconfig, or using AutoRuns or WhatInStartup. I won’t be applying this Fixit.

Reply | Quote

I love my Gadgets. In particular, I love the set I run that monitors various aspects of my system such as CPU utilization and temperature, network activity, disk activity and utilization, and GPU utilization and temperature plus some other temperatures and fan speeds. Most are from addgadget.com and it is my hope that these are safe as I intend to use them until I hear an explanation regarding exactly what the risk is.
All of these allow me to keep tabs on the health of my system. Any deviation from normal operation is readily apparent and these Gadgets allow alarms and automatic programmed responses to dangerous deviations from ‘normal’. Sure, they eat up some resources but I have way more resources than needed in most circumstances. Without them, it is like flying an aircraft without an instrument panel.
Is there any reasonable monitoring utility or utilities that can be run continuously to provide this information?

Reply | Quote

So…isn’t it better to simply uninstall the Gadget Platform, or does the FixIt block other vulnerabilities?

Uninstalling the Gadget Platform also removes the Gadget options from the desktop context menu and the control panel. To uninstall, open the Control Panel, click Programs and Features. In the upper-left corner click Turn Windows features on or off. In the Windows Features list, scroll down and uncheck Windows Gadget Platform, then click OK. This will require a reboot.

Personally, I’d like to hear that “local” gadgets are safe. I had a clock gadget and CPU temp gadget that I rather liked. However, if the platform is inherently unsafe, then I will not think twice about having removed them from my PCs.

Ken

Reply | Quote

Drink, if you hover your mouse over each one you will see one has ENABLE and the other has DISABLE in the tool tip description..

Reply | Quote

Sure Bob, here it is…

Actually, it originated on a website called ‘Night Iquana’ but I think it’s not active anymore.

In the screen shot here I only have a few of the modules turned on but there are more that can be used like network traffic etc.

You can PM me with any questions…

Reply | Quote

Well Ivphil, I for one disabled it….

It’s true, you can walk down the middle of a highway and not get hit by a car but sooner or later someone is gonna hit you…

So, if you like, keep on walking the middle of the highway…I for one, am walking on the shoulder where it’s safer..

Reply | Quote

Well Ivphil, I for one disabled it….

It’s true, you can walk down the middle of a highway and not get hit by a car but sooner or later someone is gonna hit you…

So, if you like, keep on walking the middle of the highway…I for one, am walking on the shoulder where it’s safer..

Thumbs up to that advice!

I disabled the entire gadgets platform in Windows 8 because the Mr. Fixit won’t run on that OS version. Having seen that Mr. Fixit doesn’t actually get rid of the context-menu (right-click) on the Windows 7 desktop, I also went in to Turn Windows Features On or Off and disabled the entire gadgets platform there as well.

Better safe than sorry, I can tell you. Rebuilding a damaged Windows installation (I recently did this for both Windows XP and Windows 8 RP, for other reasons) is no fun at all. And trying to get rid of unwanted Windows code alterations (malware or not) is also no fun at all, often resulting in reformatting and reinstalling Windows just to save time and headaches. Simply rolling back to a clean System Image may not be the best alternative when faced with deeply-embedded unwanted code alterations.

The attack vectors have been around since the gadgets platform was introduced. What’s new is that the Black Hat folks are publishing a how-to for organized exploits based on these security holes. HTML and scripting languages are notoriously difficult to secure against these kinds of issues. For Microsoft, with Metro Apps taking the place of desktop gadgets anyway, the effort obviously seemed more trouble than the platform was worth to them.

-- rc primak

Reply | Quote

I think it’s MS Fix it, not Mr. (Although the bib-and-brace overalls do make to a bit difficult to tell.)

Reply | Quote

Well Bob, I learned my lesson a long time ago and when I hear about something, like this gadget crap, I just follow the advice given..

Better safe then sorry…No reason to risk my system for some stupid calendar…

Reply | Quote

Actually Bruce, it’s just called ‘FIXIT’…
Microsoft is ‘gender neutral’…. Ha…

Reply | Quote

pbug, so does what you say mean you’re gonna be the first in line to get it ?

Reply | Quote

OK… here we go!

“Enable” appears over the left hand Fixit, because it enables the disabling of the gadget platform. “Disable” appears over the right hand Fixit, because it disables the disabling, thus re-enabling the platform.

That should be clear now!

Having said that, thanks to @bobprimak. I agree with absolutely everything in his post. I also found the fixit doesn’t work on Win8 RP. I have loved my gadgets for control (shutdown, restart etc.), CPU and Network traffic. I’ve shut them down, but I miss them!

Original article suggests Win8 will have a “similar experience tied to a better platform” (or words to that effect). I bet the “experience” won’t be on the desktop, and I don’t plan on using the tiles! Talk about a waste of space! But that a story for a different thread!

Reply | Quote

If you don’t use the tiles, there’s not much anything else. A nearly useless ‘shell’ of the old desktop but without the cascading menus, etc. Badly dumbed down.

OK… here we go!

“Enable” appears over the left hand Fixit, because it enables the disabling of the gadget platform. “Disable” appears over the right hand Fixit, because it disables the disabling, thus re-enabling the platform.

That should be clear now!

Having said that, thanks to @bobprimak. I agree with absolutely everything in his post. I also found the fixit doesn’t work on Win8 RP. I have loved my gadgets for control (shutdown, restart etc.), CPU and Network traffic. I’ve shut them down, but I miss them!

Original article suggests Win8 will have a “similar experience tied to a better platform” (or words to that effect). I bet the “experience” won’t be on the desktop, and I don’t plan on using the tiles! Talk about a waste of space! But that a story for a different thread!

Reply | Quote

If you don’t use the tiles, there’s not much anything else. A nearly useless ‘shell’ of the old desktop but without the cascading menus, etc. Badly dumbed down.

Quite agree! I don’t plan to use it for anything else – except maybe to replace WHS2011 since I read it (Win8) can make a nice server platform, with storage pools better than Drive Extender! (Sorry – irrelevant to this thread again!)

Reply | Quote

Quite agree! I don’t plan to use it for anything else – except maybe to replace WHS2011 since I read it (Win8) can make a nice server platform, with storage pools better than Drive Extender! (Sorry – irrelevant to this thread again!)

For this, there will be a real Server Edition sometime in the future. But WHS may be a dying platform, as you say. Not entirely irrelevant, because Pbug may want to be looking for alternatives to Metro just as we are doing by mentioning WHS, Server Editions and other “outside of the box” possibilities.

How sad that, even before the product release, folks are already getting creative in looking for alternatives! Did this happen to this extent with Vista?

-- rc primak

Reply | Quote

I’ve been working with computers for about 40 years. I like my mouse and keyboard and none of my desktops or laptops have touch screens. Other then on phones, I very seldom use touch screens. They have their use, just not on equipment most people use for daily computing. Mind you, if my 81 or so year old mother finally gave in and would take a computer of some sort, we’d probably make it a pad, maybe with an external keyboard so she could type emails. For her, Win 8 would be fine.

My problem with Win 8 is that this is not an available choice. It is MUTRO or pretty much nothing. If that wasn’t the case, THEN I’d probably order the upgrades that MS has announced. But as things stand, other then as beta, I may never use 8, and I’m guessing that most banks and other large firms using lots of PC’s will also never migrate to 8.

Reply | Quote

Folks, I think BruceR had a point back there in Post #60. We should call Microsoft’s inventions by the names MS has given them. A Fixit has no gender. Metro should not be called MUTRO. And Windows should not be called Windoze, Windopes, etc. I like a bit of sarcasm as much as the next person, but someone not familiar with these products and features might be getting confused.

That said, gadgets are dead. Not to be revived. Win 7 SP2 (next year) may do the deed for diehard gadgets users in that platform. And any day now, there could be a MS Updates patch which would do the coup de grace for all of us.

Sorry to report, but without the Gadgets Platform, Infobar (Post #42) is not installing properly and not showing its modules on Windows 7 or Windows 8 on my laptop. (I could have just PMed this info to Banyarola, but I think it’s worth posting as a possible issue in this thread, as long as we may be discussing alternatives to gadgets and not be going off topic. In my own opinion, of course.)

-- rc primak

Reply | Quote

Well Bob, I have ran fixit and my Infobar is working for me on W7 64 bit..

I don’t see what info bar has to do with gadgets…It’s a program…

Reply | Quote

Well Bob, I have ran fixit and my Infobar is working for me on W7 64 bit..

I don’t see what info bar has to do with gadgets…It’s a program…

I didn’t just run the Fixit (couldn’t in Win 8). I totally turned off the entire Gadgets Platform. The Fixit left my Win 7 with the right-click context menu item for Gadgets still showing. This is why I caution others to disable the platform entirely if they are concerned about it, and not rely on the Fixit for security reasons.

Thanks for clarifying that Infobar is a program, not a gadget.

My Infobar issues may have some other cause(s). I have PMed you with a few details. I have no intention of bashing a perfectly good program. Everyone’s computer may be a bit different from anyone else’s. Thank you for trying to help.

-- rc primak

Reply | Quote

Ah, some common sense. You know, I’m sure that the gadget platform has its weaknesses. But ones that have been out for several years are not likely to be a big security risk; and firwalls and AV systems have gotten far better the last few years. The only gadget I use that normally ‘communicates’ to the outside is Weatherbug. Now if they came up with a tiny little desktop app that looked and behaved the same, I’d get it – but last time I checked their app was much bigger and heavier. And really, how dangerous is the clock? Or the gadget that tells me my wifi strength? Or coretemp? Maybe they are dangerous, but you’d think I’d have seen problems already.

I’m convinced that this scare is just part of the sales and marketing plan for Mutro.

Reply | Quote

Pbug..

Sometimes ones incompetence is so great their incompetence doesn’t allow them to be aware of how incompetent they really are…

Reply | Quote

Pbug..

Sometimes ones incompetence is so great their incompetence doesn’t allow them to be aware of how incompetent they really are…

Are you referring to Microsoft (agree totally) or Pbug56 (can’t bash a fellow Lounger on purely personal grounds)?

And besides, I can see Pbug’s points. I actually agree with a lot of them (though not all).

I just don’t want somebody who’s new to The Lounge to see the altered “nicknames” for MS products and services and features, and then try to do a Google Search for these, ending up at some Warez site and getting their PC poisoned, then coming back into The Lounge and complaining to us. It can happen, believe it or not.

This kind of “nicknaming” comes very close (in my personal opinion) to Product or Company bashing, which is frowned upon here in The lounge, last I read the rules.

-- rc primak

Reply | Quote

Ok… with all this danger….. why are we using anti-spyware or Norton’s or Windows Defender and the like

Reply | Quote

Ok… with all this danger….. why are we using anti-spyware or Norton’s or Windows Defender and the like

Generally, we are getting good protections from these security programs. But they can’t always keep up with the very latest threats. Fortunately, very few of us report getting infected with zero-day attacks (although it happens on rare occasions). What we have is definitely better than nothing, I think.

As for why doesn’t an antivirus program keep us protected from the numerous and deeply embedded security issues with an entire insecure platform like the Windows Gadgets (Sidebar) Platform? Well, if I could only show you the thousands of lines of code, or list the dozens of programming technologies which went into making that platform work — anyway, the complexity of patching this platform rivals the problems of keeping .NET Framework secure. Microsoft has decided not to go to the expense and effort to patch, as Metro Apps are supposed to displace gadgets in Windows 8. For Windows 7 and Vista, I guess we will simply be out of luck. As far as I know, there are no plans to bring Apps support to Windows 7 or Vista.

-- rc primak

Reply | Quote

ok, but what’s ticking me is that W7 “just got here” and off we go someplace else.

Reply | Quote

W7 will soon be 3 years old. Compared to XP, it’s very young, but it’s hardly “we just got here”.

Reply | Quote

When I click on the Clock in the Task Bar, it pops up the standard Calendar and Clock… Is there any way at all to simply display that Calendar and Clock on the Desktop all the time?? That would satisfy my need for those items since the Gadgets are gone from my system. I’ve searched for several hours now to find a way to do that. No luck! Does ANYONE have a solution that I can try?
Ben Browder

Reply | Quote

I use this. http://www.desksware.com/desktop-icalendar-lite.htm

This is the link to the lite version.

Reply | Quote

I use this. http://www.desksware.com/desktop-icalendar-lite.htm

This is the link to the lite version.

Hello, and thank you for the reply… I looked at that link earlier this morning and would prefer to simply display the Standard Windows 7 Calendar-clock Applet on the Desktop all the time.. I appreciate your reply, though.
Best to you,
Ben

Reply | Quote

I don’t think that’s possible..
Maybe others here will know if it can be done…

Reply | Quote

So does anyone know of ANY problem that’s actually been caused by the presence of gadgets on a W7 machine?

Reply | Quote

That is the question – and so far I’ve not heard any answer to it at all! I’m more convinced then ever that this is must MS trying to push Win 8 and to do so putting down everything that came before it. But hey, that’s just my personal opinion.

Reply | Quote

Pbug
Maybe this will help you understand it better.. http://www.resolvesolutions.co.uk/article/microsoft-gadget-virus

Reply | Quote

I’ve heard all that already. Absolutely no specifics, no clue if there actually is a virus out there, no clue which gadgets leave you subject to attack. I use a few; a cpu temp, a simple clock, ooh – a Magic 8 Ball, the infamous mini piano keyboard, one that tells me how well my wifi is doing, and one weather gadget. I can seem some as possibly being vulnerable in that they reach outside of my protected network, but they were all from generally clean, reliable sources. Hey – HP and even Norton included gadgets in their installations.

So far, just scare talk.

Reply | Quote

Well, do what ever you feel comfortable with….

I, for one, don’t think having a drive gadget on my desktop is worth taking a chance…

Reply | Quote

From my view, MS has very little credibility when it cries wolf like this without giving any specifics. It created gadgets, it hosted pretty much everyone I still use, and it could fix any vulnerability if it so chose. That’s what the monthly updates are all about.

I’m waiting for them to issue one that says it is no longer safe to use VISTA or 7; that the only fix is to install 8.

Reply | Quote

From my view, MS has very little credibility when it cries wolf like this without giving any specifics. It created gadgets, it hosted pretty much everyone I still use, and it could fix any vulnerability if it so chose. That’s what the monthly updates are all about.

I’m waiting for them to issue one that says it is no longer safe to use VISTA or 7; that the only fix is to install 8.

Conspiracy theories can be entertaining, but they are still conspiracy theories. I also think anyone’s credibility, not just Microsoft’s, is in jeopardy when statements are made without support on facts.
The security vulnerability in question seems to have been found by security researchers external to Microsoft, as several reports in the tech press seem to indicate: here and here and here.

Whether they could fix the gadgets without disabling them, that’s another thing. They probably could.

Also, I don’t see anything wrong with a company pushing to sell it’s most recent product?! Don’t all companies do that? With Windows 8, the upgrade is even rather cheap…

Reply | Quote

I’m happy with MS and I’m the only one that counts to me.

Reply | Quote

As for the clock and calendar, in Windows 8 on the Legacy Desktop, a simple left-click of the date/time area of the taskbar shows the calendar and an analog clock. It stays on only until you click somewhere else on the desktop, but you can get the years, the months and the current month with just one mouse click. Not an even calendar, but does display time and date information. So this may be where Microsoft is heading with this gadget replacement.

-- rc primak

Reply | Quote

I like the clock gadget. And my CPU temp gadget. And my weather gadget, and my wifi signal strength gadget, and my eight ball gadget.

And for the life of me I can’t see any obvious vulnerability in these – and if there is, maybe MS should instead fix the underlying SIDEBAR.EXE to block any known or likely exploits. IE – issue a patch. Instead, it is like they are telling you to remove all browsers because they have huge numbers of potential vulnerabilities.

And to reply to someone else, maybe the reasons Win 8 Pro is so cheap; 1. they save a buck by removing DVD playback, 2. it is such a poor product that they can’t charge more.

Reply | Quote

And to reply to someone else, maybe the reasons Win 8 Pro is so cheap; 1. they save a buck by removing DVD playback, 2. it is such a poor product that they can’t charge more.

It’s always entertaining to read your explanations for the way things are :).

Reply | Quote

CPU Temp core by core is available with CoreTemp, a free utility. There’s an option to make it a Tray Area system of icons. It expands the System Tray a bit, but it’s as good as any gadget I ever used. Windows 8 displays signal strength in bars whenever you slick on the WiFi icon in the Tray Area. No gadget needed. I can also use DriveGleam (look at the Usage link to see the alternative tray icon set which I use) to display logical drive activity, and Glint to display all sorts of other performance parameters. None of these is a gadget, but they all can be useful in Windows 7 and Windows 8.

-- rc primak

Reply | Quote