Windows Malware

Security threats have constantly changed to adapt to each new generation of operating system. In the past several years, the prevalence of malware (a broad term that encompasses viruses, worms, Trojan horses, and rootkits, as well as spyware and other potentially unwanted software) has soared.

Microsoft uses the term spyware and potentially unwanted software to refer to software that is unwanted but not unambiguously harmful. In this book, the definition of malware includes both clearly malicious viruses and worms and the more ambiguous spyware and potentially unwanted software.

Viruses, worms, and Trojan horses can spread from computer to computer by exploiting software vulnerabilities, guessing user credentials, or tricking users with social engineering techniques. Spyware and potentially unwanted software spread via these techniques and also by legitimate installations initiated by users. Users can install an application, unaware of the undesired functionality of the program or of a program that is bundled with the application. Because of the challenges in identifying malware, it might be impossible to eliminate the threat completely. However, Windows Vista and Windows 7 have many new security features to help protect computers from malware.

Many malware infections can be prevented by installing updates on a mobile computer or by adjusting the security configuration. Group Policy, Windows Server Update Services
(WSUS), and other management technologies have greatly simplified the task of rapidly distributing updates and security changes. However, these changes take effect only when client computers connect to the internal network. When users travel, mobile computers might go days, weeks, or months without connecting to the internal network. DirectAccess, a new technology introduced with Windows 7 and Windows Server 2008 R2, automatically connects computers to the internal network any time they have an Internet connection. Therefore, DirectAccess can keep Windows 7 mobile client computers up to date more regularly than earlier versions of Windows, giving IT the control they need to mitigate newly discovered vulnerabilities by distributing updates or configuration changes.

Originally introduced with Windows Vista, UAC limits the ability of malware to install by enabling IT professionals to deploy users as standard users rather than as administrators. This helps prevent users from making potentially dangerous changes to their computers without limiting their ability to control other aspects on their computers, such as time zone or power settings. For anyone who does log on as an administrator, UAC makes it more difficult for malware to have a computer-wide impact. Windows 7 includes improvements to UAC by reducing the number of prompts that users experience. Additionally, administrators can adjust consent prompt behavior. By making UAC more usable, Windows 7 reduces the cost of deploying Windows using a protected desktop environment. Similarly, the Protected Mode of Internet Explorer runs it without the necessary privileges to install software (or even write files outside of the Temporary Internet Files directory), thereby reducing the risk that Internet Explorer can be abused to install malware without the user’s consent.

Windows Defender detects many types of spyware and other potentially unwanted software and prompts the user before applications can make potentially malicious changes. In Windows 7, Windows Defender includes significantly improved performance for real-time monitoring. By reducing the performance penalty of real-time monitoring, more IT departments can leave real-time monitoring enabled, thus realizing the security benefits. Additionally, Windows Defender uses the Action Center to notify users of potential problems. Windows Service Hardening limits the damage attackers can do in the event that they are able to successfully compromise a service, thereby reducing the risk of attackers making permanent changes to the operating system or attacking other computers on the network. Although Windows 7 cannot eliminate malware, these new technologies can significantly reduce the impact of malware.

Windows 7 is designed to block many types of common malware installation techniques.
The sections that follow describe how Windows Vista and Windows 7 protect against malware that attempts to install without the user’s knowledge through bundling and social engineering, browser exploits, and network worms.

Source of Information : Windows 7 Resource Kit 2009 Microsoft Press

Using Windows 7 Network Explorer

In previous versions of Windows, the Network link was prominently displayed right in the Start menu, providing you with a quick way to access resources on your home network. In Windows 7, Network does not appear on the Start menu by default. You can enable it via Taskbar and Start Menu Properties if you think you’re going to use it a lot (as we do), or you can simply enter network in Start Menu Search and choose the Network entry from the search results list that appears.

Either way, when you do so you’ll see the Network Explorer. Compared to the My Network Places view in Windows XP, the Network Explorer is quite an improvement. (It’s very similar to Network Explorer in Windows Vista, however.)


From the Network Explorer, you gain access to the following:

• Discovered computers: These are computers on the local network that offer folder and printer shares. You should be able to connect to any PCs on a Home or Work network, but only the local PC on a Public network. If you double-click on a discovered computer, you’ll see a list of the folder and printer shares available on that system, assuming you have the correct access privileges.

• Media devices: This includes digital media–oriented hardware devices, such as Xbox 360 video game consoles, Media Center Extenders, and other digital media receivers, as well as any shared media libraries on Windows-based PCs. Each of these items behaves a bit differently. For example, if you click a shared media library, Windows Media Player 11 will load and display the shared library. Doubleclick a Media Center Extender and Windows Media Center will launch, enabling you to configure connectivity between the two. And if you double-click an Xbox 360 or other digital media receiver, Windows Media Player will launch and present its Media Sharing interface so you can configure sharing with that device.

• Network infrastructure: Your broadband router will show up here as long as it’s compatible with modern networking technologies such as Universal Plug and Play (UPnP). Double-clicking this icon usually loads the device’s Web-based management console, which varies from manufacturer to manufacturer.

• Other devices: When Network Explorer detects other network devices but can’t correctly identify them, it places them in the Other Devices category and provides a generic icon. Windows Home Server causes such an icon to appear, for example. Double-clicking one of these icons triggers a UPnP event which, in the case of Windows Home Server, launches IE and displays the server’s Webbased welcome page.

Source of Information : Wiley Windows 7 Secrets

Introducing the Home Server

In late 2007, Microsoft’s PC maker and hardware partners began shipping specially designed home server products based around a new operating system called Windows Home Server. Code-named “Q” (and previously code-named “Quattro”), Windows Home Server is just what its name suggests, a home server product. It provides a central place to store and share documents, along with other useful services for the connected home. Windows Home Server is designed to be almost diabolically simple, and after 2½ years of active development, Microsoft decided that it had achieved an interface that was both simple enough for the most inexperienced user and powerful enough for even the most demanding power user.

Okay, maybe that’s a bit of a stretch; but given what it does—bring the power of Microsoft’s server operating system software into the home—Windows Home Server is pretty darned impressive. And if you’re in the Windows Home Server target market—that is, you have broadband Internet access and a home network with two or more PCs—this might just be the product for you. In many ways, it’s the ultimate add-on for Windows 7. From a mile-high view, Windows Home Server provides four basic services: centralized PC backup and restore, centralized PC and server health monitoring, document and media sharing, and remote access.

Truth be told, Windows power users don’t have to buy a prebuilt home server to get Windows Home Server, though we’ve both had excellent results doing so ourselves. Instead, if you’d like to purchase just the Windows Home Server software and install it on your own PC-based server, you can do so. Just visit an online electronics retailer such as Newegg.com and search for Windows Home Server. The software typically costs less than $100 in the United States.


Windows Home Server Evolution
The initial Windows Home Server generation, which is still current at the time of this writing, is based on Windows Server 2003, a previous generation version of Microsoft’s enterprise-class server OS. In addition to the initial release, Windows Home Server has also seen two major updates, Power Pack 1 (PP1) and Power Pack 2 (PP2). The first version of Windows Home Server provided all of the basics, which are still present in today’s product: PC backup and restore functionality, PC and server health monitoring, document and media sharing, remote access, and, as crucially, an extensibility model that enables developers to create add-ins, small software updates that enhance Windows Home Server’s capabilities in fun and interesting ways.

Windows Home Server PP1 was released in mid-2008. This update includes compatibility for 64-bit (x64) versions of Windows Vista (and Windows 7), server backup capabilities, improvements to remote access, and a number of other changes. Key among these is a fix for a data corruption bug that affected almost no users but was widely reported by the press.

Windows Home Server PP2 debuted in April 2009 and included features that made this product more interesting to the hardware makers that sell Home Servers. It adds support for the Italian language (in addition to the currently supported Chinese, English, French, German, Japanese, and Spanish languages), improves the SDK for developers, and vastly simplifies the “day one” experience (what used to be called OOBE, or out of box experience), reducing the number of steps a new user has to complete from 23 to 13. PP2 also includes a simplified and improved remote access experience, and enhanced media sharing, especially for Media Center users. Of course, Microsoft is also working on a next-generation Windows Home Server codenamed Veil, which will ship after Windows 7. Windows Home Server v2 will be based on the Windows Server 2008 R2 generation of server products that appeared alongside Windows 7 and will no doubt interact seamlessly with Windows 7 features like HomeGroups. Sadly, that product wasn’t ready for testing at the time of this writing.


In addition to Microsoft’s work on Windows Home Server, some key hardware partners have been working over the years to steadily improve their Windows Home Server machines with innovative hardware designs and interesting software solutions that extend core functionality through high-quality add-ins. Key among these is HP, whose MediaSmart Server line has proven to be the customer favorite in the United States, and for good reason: these machines consistently provide an even better experience than the stock Windows Home Server experience documented here. And yes, both Paul and Rafael rely on HP MediaSmart Servers in their own homes. These are excellent servers. HP currently markets two different MediaSmart families of servers. The high-end MediaSmart EX series is the mainstream Home Server and supports multiple internal hard drives. It’s shown in Figure 10-1. The HP MediaSmart Server LX series, meanwhile, is a one-hard-drive option that is aimed at the low end of the market, these servers can be expanded externally.

Source of Information : Wiley Windows 7 Secrets

Using Network Explorer in Windows 7

In previous versions of Windows, the Network link was prominently displayed right in the Start menu, providing you with a quick way to access resources on your home network. In Windows 7, Network does not appear on the Start menu by default. You can enable it via Taskbar and Start Menu Properties if you think you’re going to use it a lot (as we do), or you can simply enter network in Start Menu Search and choose the Network entry from the search results list that appears.

Either way, when you do so you’ll see the Network Explorer. Compared to the My Network Places view in Windows XP, the Network Explorer is quite an improvement. (It’s very similar to Network Explorer in Windows Vista, however.)


From the Network Explorer, you gain access to the following:
• Discovered computers: These are computers on the local network that offer folder and printer shares. You should be able to connect to any PCs on a Home or Work network, but only the local PC on a Public network. If you double-click on a discovered computer, you’ll see a list of the folder and printer shares available on that system, assuming you have the correct access privileges.

• Media devices: This includes digital media–oriented hardware devices, such as Xbox 360 video game consoles, Media Center Extenders, and other digital media receivers, as well as any shared media libraries on Windows-based PCs. Each of these items behaves a bit differently. For example, if you click a shared media library, Windows Media Player 11 will load and display the shared library. Doubleclick a Media Center Extender and Windows Media Center will launch, enabling you to configure connectivity between the two. And if you double-click an Xbox 360 or other digital media receiver, Windows Media Player will launch and present its Media Sharing interface so you can configure sharing with that device.

• Network infrastructure: Your broadband router will show up here as long as it’s compatible with modern networking technologies such as Universal Plug and Play (UPnP). Double-clicking this icon usually loads the device’s Web-based management console, which varies from manufacturer to manufacturer.

• Other devices: When Network Explorer detects other network devices but can’t correctly identify them, it places them in the Other Devices category and provides a generic icon. Windows Home Server causes such an icon to appear, for example. Double-clicking one of these icons triggers a UPnP event which, in the case of Windows Home Server, launches IE and displays the server’s Webbased welcome page.

Source of Information : Wiley Windows 7 Secrets

Windows 7 - XPS Print Output

Windows 7 includes support for a newer document file type called XPS, which stands for XML Paper Specification. This is a file format that represents printed output electronically. The idea is that you can view an XPS file on any computer that has an XPS viewer program, without having to have a copy of the application that created the document. For example, you can view the XPS version of a Microsoft Word document without having to have a copy of Word. If this sounds suspiciously like Adobe’s PDF file format, you’re right. XPS is Microsoft’s attempt to create a universal electronic document format. XPS has some advantages, but PDF is so widely used and understood that we suspect XPS doesn’t stand a chance. In any case, Windows 7 does come with built-in support for XPS. You can generate XPS documents simply by following these steps:

1. Edit and format a document in one of your applications. Be sure to save the document in the application’s native format, so that you can come back and change it later. You can’t edit an XPS file.

2. Use the application’s Print function. Most applications display the standard Windows print dialog. Select the Microsoft XPS Document Writer printer. Click Print.

3. When the Save the File As dialog box appears, select a location and name for the XPS document.

You can now distribute the XPS document to others to view and print as desired. Windows 7 and Vista have built-in XPS document viewers. On Windows 7 or Vista, just double-click an XPS file to open and view it.

Microsoft has created tools for viewing and creating XPS files on Windows XP, which you can get from www.microsoft.com; just search for “Get the XPS Viewer”. This tool requires the .NET Framework, so you may need to download and install that program as well. On other operating systems, you will need to download an XPS viewer program from some other source.

Source of Information : QUE Microsoft Windows in Depth

Windows 7 - Advanced Printer Management

Windows 7 comes with a printer management tool that’s part of the Windows Management Console system. It’s intended primarily for network administrators who sometimes have to manage dozens of printers spread around an office. I won’t go into great detail on this tool here because it’s fairly self-explanatory, but I’ll show you how it works.

To run the tool, click Start, Control Panel, System and Security, Administrative Tools. Then, doubleclick Print Management. You might need to confirm the User Account Control prompt or enter an Administrator password, because this tool requires elevated privileges.

The left pane lets you choose views that include lists of all the printers installed on the local computer (or on a domain network), all printers that have documents pending, and so on. You can also create custom “filters” to select only printers with specific attributes.

Under the Print Servers section, the local computer is listed, and you can right-click the “Print Servers” title to add the names of other computers on your network (or named print server devices). You can use this feature to build a single panel that lists all your organization’s printers. Print servers that you add to this list will remain in the list the next time you run the printer management tool.


Source of Information : QUE Microsoft Windows in Depth

Windows 7 - Printing from DOS Applications

If you are still using MS-DOS applications, printing is one of the more problematic areas. Many modern inexpensive inkjet and laser printers don’t support output from DOS programs because they don’t have enough built-in smarts to form the character images by themselves. If you need laser or inkjet output from a DOS application, be sure that any new printer you buy uses a page-description language supported by your application, such as PostScript, HP’s PCL, or one of the Epson text formats.

Furthermore, most DOS applications can print only to LPT ports. If you want to use a printer that is on a USB port or is out there somewhere on a LAN, you must share the printer (even if it’s just attached to your own computer and you’re not using a network), and then issue the command

net use lpt2: \\computername\sharename

from the Command Prompt window, replacing computername with your computer’s name and sharename with the name you used when you shared the printer. Direct your DOS program to use LPT2. (You can use LPT1, LPT2, or LPT3, but you must select an LPT port number that does not have an associated physical LPT port in your computer.)

Source of Information : QUE Microsoft Windows in Depth