Ask DACS
February 2013

Moderated and reported by Jim Scheef

AskDACS is a Question and Answer session before the main presentation at the monthly General Meeting. We solicit questions from the floor and then answers from other audience members. My role as moderator is to try to guide the discussion to a likely solution to the problem. The answers below include my own post-meeting research.

Q – Rather than a first question from the audience, I did a short demonstration about Windows Update and how to pick and choose which optional updates to apply. See the sidebar for some basic information about Windows Update.

D – When you see the message that updates are available, how many people just blindly apply everything, including the optional/recommended updates? Following is my philosophy on applying updates from Microsoft:

• The important/critical updates should be applied immediately. Some patches close vulnerabilities in Windows that will be exploited as soon as the patch can be reverse-engineered and code can be written. Others close vulnerabilities that have been known for some time and exploits that are already in use. Either way, any delay leaves your machine open to these attacks.
• Optional patches should be inspected to see if they apply to your situation. You should apply only those patches that make sense for your computer. To inspect an update: highlight the patch in Windows Update and click the “More information” link in the right-hand panel. Your browser will open to display the Knowledgebase article for that update. In a few seconds you can determine if it applies to your computer. If you want to pass up an update, right-click on the update and select “Hide update” from the context menu. The update will not reappear when you next use Windows Update unless you explicitly “unhide” sometime in the future.

To demonstrate all this at the meeting, I showed patches that updated Windows 7 in three ways: (1) update the game ratings system, (2) improve the rendering of Arabic text, and (3) add South Sudan to the list of countries. I cannot express here in family-friendly print how little I care about these updates. So why apply them to my computers and take the risk, however small, that one could cause a problem? Many optional updates are not so seemingly inconsequential and the description may even state that the update should be applied only if the problem exists on the computer. Some updates can be applied to servers, but in reality are needed only on workstations and vice-versa. I believe that applying optional updates that were not needed is how the legend of problems in Windows Updates originated. Some people continue the practice of waiting a week or two to see if any patches are reported as causing problems. Yes, occasionally Microsoft issues a critical update that requires a patch to correct the patch, but this has become exceedingly rare. This risk is now far smaller than the exposure of continuing to use an unpatched machine on the Internet.
Remember, all of this is my personal philosophy, so don’t blame DACS if it blows up in my face.

Q – What is the .NET Framework and do I need it?
A – The dotNET Framework is part of the current software development environment from Microsoft. The various versions of the Framework are needed on your computer only when you have installed an application written using that version of the Framework.

Q – When my computer boots, Windows shows a warning that disk problems have been found and the check disk program runs automatically. This happens nearly every day. The report that shows briefly shows no bad sectors but does show a small number of unused index entries that varies with each boot. Why is this happening?
A – Windows automatically runs the check disk program (same as the command line program, chkdsk.exe) when a file system has been marked as ‘dirty’, indicating trouble in the Master File Table (the file directories and indexes used to keep track of what files are stored on which sectors). I ran a test on an XP machine and got the log shown in the box. I suspect this is what the questioner is seeing, although I forced check disk to run using the command “chkdsk c: /f” in a CMD window. My machine found much higher numbers of unused index entries.
 Good information on Check Disk seems to be non-existent. Even the normally good Wikipedia article (wikipedia.org/wiki/Check_disk) is missing information like how to find the log file when check disk runs during boot-up. At the meeting, several people were correct, that the log can be found in the Application log in Event Viewer under the Source of Winlogon – at least in XP. Under Win7 I was able to find the log by filtering for the source of Chkdsk, but this was from when I had manually run chkdsk.exe in a CMD window. The source might be different when check disk runs automatically. In any case, it’s not hard to find if you look immediately after it runs and Windows reboots to the desktop. The event source may be different depending on how Check Disk is run (boot up, command line, etc.).

Discussion at the meeting then turned to why check disk was repeatedly running automatically with speculation pointing to a failing hard drive. One member suggested purchasing a program called SpinRite (grc.com/sr/spinrite.htm) from Steve Gibson, a longtime computer curmudgeon (all of Steve’s programs are written in pure assembler). To understand SpinRite, watch the video on his website of Steve explaining “bit rot”. SpinRite casts $90, so a new hard drive is the cheaper alternative. After watching the video, this situation sounds like exactly the situation that SpinRite was written to “cure”. SpinRite does more to recover data than “chkdsk.exe /r” which looks for bad sectors and relocates readable data to another sector, where SpinRite will try to recover data by forcing the controller to read at the bit level. Running “chkdsk <drive ltr>: /r” from the command line is the same as running “Error checking” on the Tools tab of a hard drive’s properties and checking the option to “Scan for errors and attempt recovery of bad sectors”.
(Click here for a plain text file of the chhkdsk)

Q – I’m trying to recover a machine running XP from a malware infection. The only backup was from many years ago, but I restored the C-drive from that backup and then started to apply updates. Windows Update first tried to apply Service Pack 3. This update failed with the system hung and this repeated after a reboot. Is there another way to get Service Pack 3?
A – SP3 is available as a download from Microsoft, both as an executable and as an ISO to burn to a CD.

Q – What is Windows Blue?
A – The questioner then answered his own question by saying it is the rumored code name for the next version of Windows. Readers are encouraged to use a favored search engine and read whatever looks interesting.

Q – I have read that VLC Player (videolan.org/vlc) has a facility to record events as they happen on the desktop. Has anyone done this?
A – After we cleared up what VLC player is, no one had experience doing this. The resulting video could be used to demonstrate or teach how to accomplish a task on a computer. The process is demonstrated in a YouTube video recorded on a Mac. VLC Player is cross-platform but the questioner said that the menus are not the same on the Windows version. The website lists many sources of video input but we were unable to answer the question. Further research is encouraged.

Questions for the upcoming meeting can be emailed to askdacs@dacs.org.

Disclaimer: Ask DACS questions come from members by email or from the audience attending the general meeting. Answers are suggestions offered by meeting attendees and represent a consensus of those responding. DACS offers no warranty as to the correctness of the answers and anyone following these suggestions or answers does so at their own risk. In other words, we could be totally wrong!