Don’t get burned by driver-update scams

Get the most out of your subscription

By Brian Livingston

Since the merger of the Support Alert Newsletter and the Windows Secrets Newsletter on July 24, we’ve received a lot of great feedback from our readers.

To give you as much value as we can, we’ve put together today’s special “news update,” although Windows Secrets doesn’t normally publish a newsletter on the 5th Thursday of the month.

Take advantage of our reviews and library

We’re doing everything we can to give you easy access to the latest software reviews by writers for both Windows Secrets and Support Alert.

The image at right illustrates our new “software sidebar,” which is now available to you on most pages of WindowsSecrets.com. As soon as possible, we plan to highlight the very newest reviews — just the past four weeks, for example — to make them easy for you to find. (The links in this example image aren’t clickable; instead, clicking the image leads to a WindowsSecrets.com reviews page, where a working sidebar resides.)

The reader response to our new review format has been incredibly positive. The following e-mail from Fernando Assis, a paying subscriber to the old Support Alert Newsletter, is typical of the messages we’ve received:

• “The new way you present links for the best freeware in this new site is just superb. I’ve never seen it any easier in any other place. Congratulations! And thanks a lot.”

We’re updating the reviews in every software category as fast as we can. That’s why we’re bringing you not just one, but three new reviews in today’s news update:

1. Associate editor Scott Dunn rates driver-update solutions;
2. Senior editor Gizmo Richards reveals how you can get the best free firewall (and test it); and
3. Contributing editor Scott Spanbauer reviews free e-mail programs.

Starting on Aug. 7, Gizmo and Scott S. will alternate writing reviews each week in the Best Software column. They’ll each publish two columns a month, which will be available in our paid content. Our other writers will periodically kick in new reviews, too.

In addition to our software reviews, we’re working to make every article in past issues of Support Alert, the LangaList, and Windows Secrets as accessible to you as possible.

If you haven’t already tried it, check out our links to the past 10 years of articles from all three titles. Start at the top level of the Windows Secrets library.

If you can’t find the article you want by browsing for it, try a search query. You can search everything ever published in Support Alert, the LangaList, and Windows Secrets — and if that fails, use our special Google API tool — on our search page.

For more tips about how to use all of our new options, read our July 24 article.

No paid content in news updates; see you Aug. 7

As I mentioned before, we usually skip publishing in any week that has a 5th Thursday. This lets our contributors take a break.

No rest for them this week, though! In celebration of our merger with Support Alert, we wanted to bring you extra content in today’s news update. We always want to overdeliver for you when we can.

Our news updates have no paid content, so all of our articles today are free and available to all. Every subscriber receives the same columns.

Our next regular weekly newsletter will be published on Thurs., Aug. 7. Thanks for your support!

Brian Livingston is editorial director of WindowsSecrets.com and the co-author of Windows Vista Secrets and 10 other books.

Don't get burned by driver-update scams

By Scott Dunn Although you can find free tools to help keep Windows and your other software up-to-date, you’ll have to pay to get the best tool for scanning your system’s drivers and downloading the updates you need. I found some good driver updaters but also one full-on scam — Prosoft3D’s Driver Update 5 — that simply points you to Windows’ Device Manager and tells you to do the job yourself.

Driver Update 5 is a joke masquerading as software

Most driver-update products let you scan your computer for free before expecting you to pay. Prosoft3D’s Driver Update 5 is an exception, requiring a full purchase before you get to install or use it at all.

Once you pay, the reason becomes evident: The product has only two features: It (1) opens Windows’ Device Manager for you and (2) displays a short message box with basic instructions on using Device Manager to update a specific driver. In other words, you pay U.S. $20 (or more) for a product that does what Windows Help itself does — and a whole lot less.

There is no scanning to tell you what drivers are out of date. You have to know that yourself and correct it more-or-less manually using Windows’ own tools.

The program’s installer prompts you to accept a folder where the product will be installed but doesn’t store anything in the folder or even create it to begin with.

Prosoft3D claims to offer a money-back guarantee and responded quickly to my request for a refund. Perhaps the company hopes to make money from people who don’t know about Device Manager or who can’t be troubled to ask for a refund.

The best updaters charge to freshen your drivers

The keystone of my PC-maintenance philosophy is to avoid fixing anything that ain’t broke. But then there’s that gray, twilight-zone area where your computer isn’t failing but is behaving strangely or experiencing the occasional mystery crash.

This may be a sign that one of your system drivers — the under-the-hood code that runs your monitor, your hard drive, your printer, and other peripherals — is out of whack.

From QuickTime to Java to Acrobat, many of the most common PC applications have their own methods of keeping themselves up-to-date. When it comes to device drivers, however, it’s not easy to determine whether you’ve got the versions your system needs.

Fortunately, there are a number of easy-to-use products that scan your PC, notify you if they find out-of-date drivers, and make it easy to download and install the updates. The downside is that the best driver-update products cost from $20 to $30.

What a program tells you about your driver is more important than the drivers it finds. For example, just telling users that a newer version is available says nothing about whether you should bother installing it.

I tested five of these programs in a quest to find which one provided the easiest and most effective way to update drivers. I used each of the five to scan a PC running Windows XP Pro SP2 in a virtual machine, and another system using Windows Vista SP1.

As you might expect, several of the programs found the same drivers to be out of date. But there were significant differences in their results.

I omitted VersionTracker Pro from this review because of the preponderance of lousy customer reviews it’s received in online forums.

I didn’t test the programs’ ability to install functioning drivers because this operation is separate from the initial system scan and identification of available driver updates.

#1: DRIVERAGENT DRIVER UPDATES

Browser-based updater is clear and cautious

DriverAgent and its Driver Updates Web site ($30 membership fee) get the highest marks for providing clear information and taking a measured approach to updating drivers.

Unlike other products I tested, DriverAgent can be run from the Driver Updates site (and thereafter from a desktop icon); the program asks that you pay a membership fee rather than buy a product license.

Setup varies slightly from browser to browser. Be sure to follow the four-step instructions on the product’s Download page to avoid any problems.

Like those generated by Driver Detective, DriverAgent’s scans present you with a list of the drivers it found along with icons (and a helpful icon legend) providing information for each driver.

The program helpfully explains that even if a driver update is available for download, that doesn’t mean you need to install it. You have the option of downloading the update for backup purposes, if you desire.

In addition to the “good” (no update needed) and “bad” (time to update) categories, DriverAgent may signify a driver as questionable. That is, DriverAgent was not able to determine whether the file is out of date. In this case, the program advises you not to update unless you think you are experiencing a problem — a cautious approach I appreciate.

On my Vista test system, DriverAgent failed to detect the out-of date Intel PCI Bridge chipset driver that was found by Driver Detective, and RadarSync. But as Driver Detective’s help file points out, unlike other hardware, chipset drivers do not install any software drivers. Consequently, their up-to-date status may not be reported accurately by these kinds of products.

On my XP test PC, DriverAgent marked several drivers as “good but with download available” that DriverDetective had marked as “out of date.” Since my computer appeared to be running just fine, I consider DriverAgent’s a more reasonable label.

DriverAgent had no problems downloading the few sample driver files I requested as a test.

#2: DRIVERSHQ DRIVER DETECTIVE

Clear update info, but too many flagged drivers

Driver Detective is the best standalone driver updater I looked at, but the program has one flaw: It may push more updates than your system actually needs.

In part because it installs Microsoft’s .NET Framework 2.0 (if you don’t already have it on your PC), Driver Detective’s installation and startup of Driver Detective ($40, but sometimes offered at $30) is one of the slower products to get going. But after the initial installation, the program’s scanning proceeds at a pace comparable to that of other products.

Driver Detective’s interface is straightforward: You begin by clicking the big Scan button to analyze your system. The result is a list of system drivers, which you can filter — for example, to show only out-of-date drivers.

Icons indicate the status of listed items. If a driver needs attention, additional icons may appear to the right of its entry. A helpful icon legend to the right of the list clarifies the meaning of each symbol. You can hide this list once you become familiar with it.

Like the other updaters I looked at, Driver Detective includes an option to download a selected driver. The program may or may not be able to launch the driver (it varies with the driver). For drivers the app can’t launch itself, the entry’s “Open” button shows you the driver’s location in Explorer so you can run its installer from there.

Another useful feature is the program’s ability to store a history of drivers you downloaded. But unlike DriverAgent, Driver Detective doesn’t provide download access to drivers that aren’t out of date.

Driver Detective is a very good product, but the program flags every driver for which an update is available with scary red icons, which strikes me as overzealous. In one case, the out-of-date driver was only two months older than the newer one.

Despite the program’s proclivity to push more updates than you may need, Driver Detective is the best updater for people who need a product that doesn’t run in a browser.

#3: RADARSYNC 2008 FREE EDITION

The one free updater comes with sneaky installer

RadarSync 2008 Free Edition is the only product I tested that won’t cost you a dime. It also claims to update not just drivers but applications as well.

The installer is conventional, but it tries to install a browser toolbar and a separate free-trial product, so be sure to uncheck those options if you don’t want them.

In my tests, RadarSync found only one outdated driver on the Vista PC (which uses the aforementioned PCI chipset). The program fared better on my XP system, producing results comparable to those of the more conservative DriverAgent.

In addition, RadarSync also found some out-of-date software (not just drivers). If this is useful to you, it won’t cost you anything to use RadarSync either in place of or in addition to a related product.

RadarSync also gets points for providing useful information when you click Details for chipset drivers. The program pointed out several issues that the newer drivers will not correct.

The RadarSync site says that the $30 paid version includes tech support, omits advertising, and lets you schedule automatic updates. For my money, I’d stick to the free version.

Scott Dunn is associate editor of the Windows Secrets Newsletter. He has been a contributing editor of PC World since 1992 and currently writes for the Here’s How section of that magazine.

Get the best firewall, then scan your PC — free

By Ian “Gizmo” Richards Firewalls play a vital role in defending your computer from attack and form an essential part of your computer’s security setup. But is your firewall actually doing its job? Are you sure it’s effective?

Monitor the information leaving your machine

These are not idle questions. More than half of the firewall setups I’ve checked over the last few months have been inadequate for one reason or another.

In this article, I’ll look at the most common firewall problems and give some suggestions for overcoming them. But first, let’s look at what your firewall should be doing.

Firewalls have two main functions: inbound and outbound protection.

Inbound protection means safeguarding your PC from hackers who are trying to break into it via open ports. Ports are the doorways through which information enters or leaves your system. There can be up to 65,536 of these ports on your machine, every one of which is a potential gateway that hackers can use to enter it.

The bad guys are out there in strength looking for these open ports. Within minutes of connecting a PC to the Internet, it is likely to be probed by a hacker.

Port probing is very similar to a car thief walking along the street testing the door handles on parked cars to see whether they are locked. Sooner or later, the thief finds an unlocked door and makes that vehicle the focus of attack.

Now, a thief may not be able to steal your car even if it is unlocked. Similarly, a hacker may find an open port on your PC but still be unable to take control of the machine. Even so, open ports certainly set you up as a target.

One of the main jobs of a firewall is to “lock the doors” on your PC. That’s what inbound protection is about.

Outbound firewall protection is different. It’s there to warn you that a possibly unauthorized program on your PC, such as a Trojan, is trying to contact the Internet. This is roughly analogous to an alarm that alerts you to someone trying to steal your car.

An outbound firewall “sounds the alarm” by flashing a warning message, typically asking something like:

Program x wants to connect to the Internet. Approve or Deny.

Just like car alarms, outbound firewalls are prone to false alarms. These bogus alerts are very annoying; most of the time, the program trying to connect to the Internet is not a Trojan “phoning home” but a legitimate and perfectly harmless application, such as your e-mail client trying to send a message.

Despite its annoying character, outbound protection is a useful adjunct to your PC’s defenses. Without outbound protection, a malware program that has insinuated itself onto your PC could be using the Internet to transmit all your vital and confidential information to some remote hacker without you ever knowing about it.

OK, that’s a quick look at what your firewall is supposed to do. Now let’s dig into the potential problem areas.

Problem 1: No outbound protection

If your only firewall is the one built into your network router, then you have no outbound protection.

If your only firewall is the one that comes with Windows, then for all practical purposes you have no outbound protection.

To get outbound protection, you need a good personal firewall. Thankfully, there are some outstanding free firewalls that are as good as commercial software firewalls. (See below for links to several of these freebies.)

Problem 2: Inadequate outbound protection

The outbound protection of several well-known firewalls — including the popular freeware version of ZoneAlarm — is poor. To see how your firewall’s outbound protection rates, check out the “leak test” results at these two sites:

• Matousec Firewall Challenge
• Test My PC Security

These two sets of results are not in exact alignment. Furthermore, the results are based on leak tests that in themselves are only part of the outbound-protection equation. However, the tests are useful guides. Certainly, if your firewall is down the bottom of both lists, you may want to consider changing it or augmenting your defenses with another security product.

Upgrading your firewall may sound like an easy option, but unfortunately, the top-performing products in these tests — including the popular free Comodo and Online Armor firewalls — are quite demanding on you, the end user. Maybe too demanding.

For some users, there are better options than using a high-performing outbound firewall. One alternative is to add a standalone host intrusion prevention system (HIPS) such as PCTools’ ThreatFire (available in free and $30 Pro versions). Another is to use a policy-based security program such as SoftSphere Technologies’ $30 DefenseWall (30-day free trial available) or a sandbox program such as Ronen Tzur’s free SandBoxie.

I can’t properly address this complex issue in this column, but I will dedicate a whole article to the subject in a future issue. In the interim, you may want to try Comodo. It’s free and has a basic operating option that puts less demand on users, though this low-maintenance mode reduces outbound protection.

Problem 3: User failure

Outbound protection is effective only if the user responds appropriately to the warning messages thrown up by the firewall. The problem is that many users don’t have the knowledge required to provide the appropriate responses.

This weakness is compounded by the fact that many firewalls are most unhelpful in providing the user with guidance on how to respond to the programs’ security alerts. For example, no average user could be expected to respond appropriately to a message that reads something like this:

Program lsass.exe wants to connect to the Internet. Approve or Deny?

When regularly faced with this kind of nonsense, many users will simply answer “Approve” to everything, totally negating the effectiveness of outbound protection.

There is no point in blaming the user here. They’re just ordinary folks, not technical experts.

The problem is that the model is flawed; you cannot rely on the user’s response for security decisions.

Some firewall vendors have made progress in reducing the burden on users by applying smart techniques to reduce the number of warnings and also by providing more information to help users make an informed decision. However, while the problem can be lessened, it cannot be eliminated.

Because of these poor interfaces, firewalls that top the leak-test charts may in practice offer average users no better outbound protection than poorer-performing firewalls.

So, what can be done?

As I mentioned above, you can augment your protection using other less-demanding security options, such as a sandbox.

Another approach is to select a firewall that balances technical protection with realistic user demands. A product such as the free Sunbelt Personal Firewall (formerly Kerio) sure won’t win any prizes in the leak-test contests, but for many people it is one of the best choices. And Sunbelt is the hands-down winner over the Windows Defender firewall that most home users rely on.

It’s a simple case of the “right” firewall being a better choice than the “best” firewall for the average PC user.

Problem 4: Open ports

Most modern firewalls do a pretty good job at inbound protection and can effectively stealth your PC’s ports. That is, they can hide the existence of the ports from hackers’ probes.

However, when I test people’s PCs, I commonly find some unstealthed ports. This can be a firewall problem, but more commonly it’s the result of ports being opened by programs that were installed by the user, or it’s due to a deliberate action by the user.

Figure 1. Steve Gibson’s Shields UP! identifies your PC’s open ports.

Sometimes this is unavoidable, but just as often it is unintentional.

I suggest that you use one of these Web services to run a free port scan of your PC.

• Steve Gibson’s ShieldsUP!
• PC Flank’s Stealth Test

Be aware that Windows Secrets’ 400,000 subscribers will probably overload these services. If so, simply try again later.

If you do have open ports, the port-scanning services will provide information that will help you pin down the cause. This is a task within the capabilities of experienced users, but many average folks will definitely need some assistance. The firewall forum at Wilders Security Forums is a good place to start.

Do check your ports. It only takes a few minutes and you may be surprised by what you find.

Ian “Gizmo” Richards is senior editor of the Windows Secrets Newsletter. He was formerly editor of the Support Alert Newsletter, which merged with Windows Secrets in July 2008. Gizmo alternates the Best Software column each week with contributing editor Scott Spanbauer.

Best alternatives to Microsoft Outlook, part I

By Scott Spanbauer If you’re longing to leave Outlook, alternative e-mail and calendar programs could lighten the load on your wallet — and on your PC. At least one free personal information manager replicates most of Outlook’s features and adds some handy tricks users of Microsoft’s PIM can only dream of.

Is your Outlook starting to look bleak?

When Microsoft Outlook debuted just over ten years ago, e-mail was still just one of those applications that we used occasionally throughout the day. Kind of like that newfangled Web thing. Today, e-mail is most PC users’ #1 application.

Outlook was one of the first programs to integrate mail with a calendar, contacts, to-do lists, and notes into a personal information manager. Microsoft’s approach to the art of the PIM is now so finely tuned that many of us would gasp like fish stranded at high tide were it suddenly taken away.

For that very reason, I gave up using Outlook as my daily PIM last year. For one thing, I didn’t want my mail, calendar, and contacts trapped in a proprietary data file (the notoriously huge .pst file). For another, I wanted the always-available online storage that Gmail provides and the ability to see my mail, calendar, and contacts on any network-connected PC.

Dropping Outlook was actually quite painless. While it’s not always easy to get your data in and out of the program, Outlook supports standard mail-server protocols and calendaring systems. This allows you to use it with Gmail and other e-mail and Web-hosted services.

In this column and a forthcoming follow-up, I’ll look at several Outlook alternatives, starting with Mozilla Messaging’s well-known Thunderbird 2, and MemeCode Software’s less-well-known InScribe and its free sibling i.Scribe. You may not opt to leave Outlook entirely, but you might find that an alternative program serves your needs well at home and on any other PC you use.

Many e-mail readers and PIMs replicate some of Outlook’s features, but none can truly replace Outlook in every situation. Although Outlook and its competitors all support the Post Office Protocol (POP3) and Internet Message Access Procotol (IMAP) for sending mail through and retrieving messages from Internet-hosted servers, Outlook also functions as a client to Microsoft’s Exchange and Sharepoint servers. If your company relies on Exchange or Sharepoint, Outlook is the only practical solution on the client end.

Nevertheless, if you or your firm don’t rely on those Microsoft servers, nothing prevents you from switching to a different mail client. Like Outlook, competing mail clients offer such advanced features as message filtering to act on incoming messages based on addressing, content, and other criteria. They also let you sort, delete, or otherwise process messages. Most also filter spam, provide stationery, and download messages from mutiple e-mail server accounts.

#1: MOZILLA THUNDERBIRD 2

The best free e-mail and calendar program

Just because Mozilla makes the best Web browser, that doesn’t necessarily mean that its mail program is automatically top-notch. However, Thunderbird’s community-driven design philosophy has resulted in a mail reader that outpaces Outlook in many ways.

The most recent version 2.0.0.16 (and counting) includes a bevy of features that make it a worthy competitor to Outlook. Thunderbird checks multiple POP3 and IMAP servers for new messages, filters out junk mail using Bayesian logic, sorts incoming messages using rules, and spellchecks your outgoing missives.

You can also subscribe to RSS feeds (which are not supported in Outlook prior to the most recent Outlook 2007) and newsgroups (which are not supported in any version of Outlook).

On first installing Thunderbird, potential Outlook switchers may immediately wonder, “Where’s the calendar?” Although it will not be fully integrated into Thunderbird until version 3 arrives later this year, the Lightning calendar add-in is fully functional, allowing you to view and create multiple calendars either locally, or on the Web using the iCalendar and CalDAV protocols (see Figure 1).

Figure 1. Mozilla’s Lightning calendar app integrates with the Thunderbird e-mail client.

Another Thunderbird add-on, the Provider for Google Calendar, lets you view your Google Calendar within Lightning, and even cache a copy locally. For me, this means that wherever I go, whether or not I’m connected to the Internet, I have my appointments handy.

This extensibility via an online library of free add-ins — a concept pioneered in the Firefox browser — is precisely what makes Thunderbird unbeatable as an all-purpose PIM. Even if you don’t need the extensions that let you connect to Gmail or Google Calendar, others let you customize Thunderbird’s user interface, synchronize contacts, block ads, spell-check in foreign languages, and perform many other tasks.

#2: MEMECODE I.SCRIBE/INSCRIBE

A small, feature-rich replacement for Outlook

I have an older notebook PC (like, ten years old) running Windows XP and maxed out with a whole 192MB of memory. As you can imagine, it’s not the fastest computer around, and launching a memory-hungry application causes a noticeable performance hit. I need a mail program that’s small, but still includes key 21st century e-mail capabilities.

MemeCode’s i.Scribe fits that description nearly perfectly. The program includes a calendar and supports POP3 and IMAP e-mail protocols, mail sorting rules, and Bayesian spam filtering. The few plugins available through the company’s Web site include a spell-checker and LDAP directory support.

The program is less than a megabyte to download and doesn’t require installation into the Windows Registry, so you can just copy its folder to a removeable drive when it’s time to migrate to another PC. Best of all, on my ancient notebook i.Scribe consumes only about 11MB of memory while running. Compare this to the 60MB Thunderbird consumes. (Outlook 2003 uses almost as much memory as Thunderbird does.)

Unfortunately, i.Scribe comes with a few limitations that could make it a no-go for you: The program lets you create only one e-mail server account and only five mail-sorting filters. The U.S. $20 version of i.Scribe, called InScribe, supports an unlimited number of send and receive accounts and message filters and adds shared calendars and other groupware features.

Part II of this review will appear on Aug. 14, 2008. See you then!

Scott Spanbauer writes frequently for PC World, Business 2.0, CIO, Forbes ASAP, and Fortune Small Business. He has contributed to several books and was technical reviewer of Jim Aspinwall’s PC Hacks. Scott alternates the Best Software column each week with senior editor Ian “Gizmo” Richards.

There's always gotta be a way out!

By Katy Chenoweth Have you ever gotten yourself stuck in a tight spot? Never fear! As this hilarious commercial illustrates, if you look hard enough, you’re bound to find a backdoor! This fly gives us all an inspirational (if a bit irregular) look at the proverbial “light at the end of the tunnel.” Be forewarned: some folks may consider the conclusion of this video to be rude and crass, while others will find it a hoot. Nevertheless, it demonstrates the importance of having an exit strategy. Play the video