SP2 Fights Worms, Has Bugs

[Jeremy]

http://www.washingtonpost.com/wp-dyn/artic...-2004Sep11.html

[tak]

Ugh, registration.

Google News --> Same link, bypass registration (maybe)

And for the lazy:

After a rough couple of years of embarrassing and serious hacker attacks hitting the Windows-using world, Microsoft Corp. struck back in August with the security-minded upgrade it dubbed Service Pack 2.

The release is widely regarded by tech pundits as a major milestone for the operating system. With SP2 in place, Windows XP should be more effective at stopping viruses, worms and browser hijackings by including security features that people previously had to install or figure out on their own.  The added security comes at a price, though; the lockdown on certain features of Windows XP means that Service Pack 2 doesn't work well with all software. At Microsoft's Web site, the company lists about 40 software programs that may be hampered when Service Pack 2 is installed and 50 that don't seem to be compatible at all. These aren't obscure titles, either -- programs that are "known to experience a loss of functionality" include such mainstream products as Encyclopedia Britannica 2000 Deluxe and America Online's Toolbar program.

To take a typical example of why some software isn't compatible with Service Pack 2, Jon Murchinson, a product manager for Windows, brought up ActiveX, software designed to let Web pages run programs inside browser windows. Cool feature, but hackers have figured out how to use that code as a doorway into people's computers to muck around with their machines.

That's why Service Pack 2 turns ActiveX off, though without it, Yahoo Instant Messenger -- a popular program used by millions of people -- doesn't work. Users who want to use such programs can turn ActiveX back on again; folks who don't have ActiveX-using programs won't miss it.

Despite the compatibility problems, computer security types who are generally happy to point out Microsoft's failings generally give the upgrade a thumbs up. "Service Pack 2 sews up a whole stack of vulnerabilities," said David Perry, global director of education at Antivirus firm Trend Micro Inc. -- despite the fact that the upgrade seems to have made his home computer unable to access his company's network. "It's definitely a step in the right direction."

Software conflicts are not the only issue causing some users heartburn. Many people have downloaded or installed the update without a hitch, but others have not been so lucky.

Rockville resident Ilya Talev, for example, helped a friend of his install the update; today, that computer is certainly safer from Web-borne attacks, if only because his modem stopped working and he can no longer reach the Internet. Talev said the problem seems to be that the update conflicts with the design of the modem.

Washington resident Bill Elcome lost a day wrestling with SP2 on one of his machines, and ended up having to reinstall his entire operating system. Elcome took consolation in the fact that he has set up his computers with programs that keep all his data backed up.

"I haven't a clue how the average person is going to keep up with any of this, unless they have a geek angel," said Elcome, who is retired from IBM and spends his time helping his friends and family keep their computer systems running.

Like many local computer consultants, Elcome has advised his friends, family and clients to put off installing Service Pack 2 for another month to make sure any big problems with SP2 come to light first.

Some who got the upgrade installed without a problem are finding that their computers are a little less useful than they used to be. Phillip Rodokanakis found that one tool he had installed to save Web pages for offline browsing, called SurfSaver by askSam Systems Inc., won't run anymore.

Rodokanakis said in an e-mail that he's "not very thrilled with all the warnings I now get in IE every time something tries to execute [a task]. When Microsoft gets security-conscious it usually goes overboard."