Internet Explorer:
Security Breach and the Fix

It was a slow news week on the computer front until an obscure "consultant" earned his 15 minutes of fame by trumpeting an otherwise equally obscure "hole" in Internet Explorer, Microsoft's generally excellent web browser. The breach he "discovered" makes it possible for an unscrupulous webmaster to log on to your PC and manipulate its files. ¹

The design flaw only affects Windows 95 and Windows NT users of Internet Explorer. Windows 3.xx users can stop fidgeting and read on just for curiosity. Windows 95 and NT users are at risk because they connect to the Internet through a protocol called dial-up networking in which their PC becomes, effectively, a station on the giant Internet network. Since, dial-up networking is literally the same protocol used to connect remote users to Local Area Networks (LANs) where two-way communication is the norm, it is the job of the web browser to regulate Internet traffic, allowing users to use and servers to serve and never the twain to do both. Needless to say, Internet Explorer may be a good scout in other respects, but it never earned a merit badge in traffic flow.

Microsoft has announced two "fixes" that patch the hole in Internet Explorer.² One is for IE 3.0 and the other for IE 3.01. There is no fix for earlier versions. Users with versions prior to 3.0 -- or with the beta release of 3.0 -- are encouraged to go to our Downloads page and upgrade to 3.01 immediately. IE 3.0 and 3.01 users can download the appropriate fix -- and read more about the problem -- directly from Microsoft's website.

Since it often becomes difficult to access the Microsoft site when new software or software fixes are first announced, Installations Plus+ is making the IE 3.0 fix and the IE 3.01 fix available until the end of March as a courtesy to our clients. These are self-executing files, each about 750 kB in size that will transfer in about 10 minutes at 28.8 kBaud on a good connection. Download to a suitable, empty directory, like C:\TEMP, and double-click on the file-name in Windows Explorer (or File Manager) to execute the fix. Let us know if you experience any difficulties.

Windows Error Messages

It's a quiet Tuesday afternoon. You've just finished composing a letter in WordPerfect and you elect to spell-check it before saving and printing. You're expecting some gentle reminders about your awful spelling. Instead, Windows presents you with one of its mulitfarious bad news error messages. You are told in summary fashion that you don't have enough memory to complete the task at hand, that you should save your work, close the application, close other open applications (that might be hogging your memory) and try again. As they say in the comics, "Duh?" In fact: Windows freezes and won't let you save your work (CRaaaaSH!); WordPerfect is the only open application; you have 32 mB of RAM (about 4 times the needed memory); and if by memory it means storage capacity on your hard drive, well, you have a 2.6 gB hard drive which is 85% empty. Like, man , what gives?

What gives might be that

• your colleague, in his/her zeal to purge unnecessary files and directories from the hard drive, removed the temporary directory (usually C:\TEMP or C:\WINDOWS\TEMP) which WordPefect uses to temporarily store a working copy of the document it's spell-checking; or
• a cherished family member recently changed the display resolution of your video card -- to make that hockey game really zing -- with the result that the video card has appropriated the section of active memory (RAM) which WordPerfect normally uses to run its specialized spell-check software; or
• the spell-check software was corrupted last week when the PC was shut down by mistake while a spell-check was running; or
• the list goes on, and on, and on...

The point of the list is to make it obvious that a Windows error message is not a specific, factual "message" but a generic flag or warning. While the message should be taken seriously -- there was, after all, something wrong at the time it was generated -- it should not be taken literally. The problem it reports ("insufficient memory") and the actions it suggests ("close all other applications") may both be just plain wrong.

Religious and philosophical PC users may well inquire: "What is the meaning of error messages?" The simple and straight answer is that most error messages occur because the computer tried to access a resource that was not available at the time. The resource might be memory (RAM), disk space, a modem, a printer, a video card or a sound card. What made the resource unavailable? Perhaps it was off, full, defective, or most likely, in use by another application, or simply unable to "understand" the instruction. The problem is Windows error messages, like the "idiot" lights on the dashboard of your car, are pretty good about telling you "something's wrong", not so good about identifying the resource causing the problem, and very rarely of any value in telling you what to do about the problem.

With that bit of arcana assimilated, the practical question comes to the fore. What's a girl to do when she's mugged by a Windows error message? Our first suggestion involves what you should do before the error message assault. Two things are helpful. The first is boring as hell, but practiced by most experienced PC users: Keep a log of changes made to your PC, hardware, software, configuration, etc. If your log showed that the resolution of the video card had been changed last week, it might occur to you to undo that change and see if WordPerfect's spell-check responds positively. The second thing is simpler: Use the timed-saving feature in any software that supports it. (Timed saving, usually set from a preferences menu in productivity software like word processors, spreadsheets, etc., saves your work to disk every n minutes so that in the event of a problem you don't lose more than n minutes of work.) Timed saving won't prevent or cure error messages, but it sure makes the data loss that often accompanies them easier to bear.

At the time of the error message, the thing to do is to exit the problem application by selecting Close, if that's an option, or by using CTRL+ALT+DELETE. ³ Once you close the application, close Windows (which clears the active memory), and literally shut off the PC (which resets locked up hardware like modems and drives). Restart your PC and try peforming the task which generated the error message. In most cases, you'll be able to get back to work with no further problem.

If rebooting your PC from a cold start doesn't make your problem go away, run your virus protection software, then run the "thorough" form of Scandisk (with surface scan) to correct file or disk errors, and try the application again. If the problem persists, disable any fancy screen savers (After Dark is notorious for interfering with other software), any memory-resident virus protection, any cute pop-up memo pads, activated icons, personal information managers (SideKick is another known source of problems), and any new toys, like answering machine or webcam software. Try the application again in this "plain vanilla" environment.

Still have problems? Uninstall that new software (if it came with an uninstall icon -- otherwise don't remove it unless you have software designed to remove Windows applications) and undo the last hardware changes you made (uninstall the Zip drive, for example).

Still have problems? Try re-installing the problem software from its distribution disks, but first make backups of your work and be prepared to reinstate your preferences, macros, color schemes, etc., as some applications will not preserve them.

Still have problems? Follow the advice of the comic doctor: if it hurts when you laugh, don't laugh. You'd be surprised how easy it is not to run the WordPerfect spell-check if that's the only application on your PC that persistently generates error messages. If you can't follow that doctor's advice, see ours at the PC Clinic.

1. Why the consultant was looking for breaches; why anyone, with or without scruples, would want to fuss with the files on your PC; and why you would be surfing the section of the web populated by malicious webmasters are questions we leave for you to deal with in your own fashion.

Back to text

2. Actually, by week's end, three separate flaws had been recognized. The fixes described here correct all three flaws in one downloadable patch.

Back to text

3. On Windows 95 machines and Windows 3.xx set up by Installations Plus+, CTRL+ALT+DELETE will bring up a menu that will allow you to close the stricken application gracefully, without crashing Windows entirely. You can add this functionality to your own Windows 3.xx PC by adding the following line to the [386 Enh] section of your System.Ini file: DebugLocalReboot=True.

Back to text

• The November, 1996 PC Tips on Laser Printers
• The December, 1996 PC Tips on Buying a Personal Computer
• The January, 1997 PC Tips on Computer Viruses
• The February, 1997 PC Tips on Deleting Files and DLL Problems
• "Highway Robbery," Nathaniel Wice's TIME Digital Magazine undercover investigation of sleazy computer "salesmanship", which appeared in the November, 1996 issue
• "Does Not Compute," Michael Maren's New York Magazine article on selecting a PC repair shop, which appeared in the November, 1996 issue

Back to top