You have to wonder which Microsoft group is sweating more these days: the people in charge of helping XP users upgrade XP Service Pack 3, or the folks whose job it is to convince PC users to buy Vista. While the latter group has Bill Gates wiggling his tush on their behalf (at the request of Jerry Seinfeld), the SP3 champions in the company appear to be on their own — just like us poor XP users.

It's never easy knowing whom to believe when tech pundits contradict themselves. It's even harder to figure out the best course of action when writers for the same publication appear to be at odds on an important issue.

Since I err on the side of caution, I recommend that XP users wait to upgrade until they have to, or until they can be relatively certain that all (or at least most) of the glitches have been worked out, especially if your PC is running okay.

Now Scott Dunn has provided us with a third perspective on SP3 in this week's Top Story. I'm confident that if you follow Scott's advice on the service pack, you'll do just fine.

Beware of insecure webmail services

Multiple problems plague SP3 adopters

Windows Secrets has been reporting problems with Windows XP's Service Pack 3 almost from the instant the patch collection was first distributed. In fact, so many readers have contacted us with questions or complaints about SP3 — the last major update to Windows XP — that we've synthesized everything you need to know about this update in a single column.

Here are the most glaring SP3-related problems:

• Internet connectivity fails when using black hole routers, which drop packets (see Susan Bradley's May 1 column in our paid content and Microsoft's Knowledge Base article 314825).

• False positives are generated by Norton Internet Security and other security applications (see my May 2 Top Story).

• Device Manager settings go missing, especially in connection with using Norton Antivirus (see Susan Bradley's column in the May 29 newsletter as well as KB 953791).

• Repeated rebooting occurs on machines using an AMD processor (see Susan Bradley's May 22 column and KB 953356).

• You can't install any new updates (see KB 943144).

• Third-party visual styles encounter problems (see the Support Alert Newsletter of June 19).

Making an upgrade decision that works for you

In light of these and other problems, you may wonder whether you ever want SP3 at all, especially given that many of its enhancements focus on networking and IT-level administration. Here's the case for SP3:

Think security: In addition to new features, SP3 — like most service packs — includes numerous security updates that were available individually in the past.

Consider support: If you think you might require Microsoft's assistance to install SP3, you need to add the service pack before April 2009, when the company will end such support. And because overall support for SP2 expires in early 2010, you'll need to have SP3 installed by that date if you want general support for XP.

Be prepared: Before you install SP3, take a few precautions. First and foremost, perform a full system backup. Microsoft has digested all recommended pre-install steps in KB 950717, which also includes troubleshooting information if all does not go well.

How to remove SP3 from your Automatic Updates

If you decide you don't want SP3, Microsoft offers a tool for suppressing the automatic installation of the service pack. The Service Pack Blocker Tool Kit won't prevent you from downloading SP3 manually from the company's site, nor will it stop you from installing the patches from a CD or DVD. All it does is stop the service pack from being installed via Windows' Automatic Updates.

In addition, the Service Pack Blocker postpones the installation for only a year from SP3's release date last April.

Surf over to Microsoft's Service Pack Blocker download page and click the Download button for SPBlockerTools.exe. Click Yes to accept the license agreement and type in the path to the folder where the files will be stored (click the Browse button and navigate to the folder if you want to avoid typing).

Now open the folder containing the extracted files and double-click SPBlockingTool.exe. A command prompt window appears for a few moments and displays the statement "Action successfully completed." Unfortunately, that doesn't tell you very much. The action the message refers to is the addition of a Registry entry instructing Windows Update not to send you SP3. (The same setting on Vista blocks SP1.)

If you want to see the code that is added, do the following:

Step 1. Choose Start, Run. Type regedit and press Enter.

Step 2. In the Registry Editor, navigate in the left pane to this entry:

HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ Windows \ WindowsUpdate

Step 3. With the WindowsUpdate icon selected in the left pane, look in the right pane for a key named DoNotAllowSP.

Even though most of SP3's problems should now be in the past, these precautions can help ensure that you aren't one of the service pack's installation victims.

If you later decide you want Automatic Updates to offer you Service Pack 3, simply select the DoNotAllowSP key and press Delete (or click Edit, Delete).

If you're concerned about editing the Registry (which involves risks of its own), the Service Pack Blocker can also undo the block:

Step 1. Choose Start, Run. Type cmd and press Enter.

Step 2. At the command prompt, either type the path to the SPBlockingTool.exe file, or drag the file into the command prompt window and let Windows do the typing for you.

Step 3. At the end of this command, type a space followed by /U and press Enter.

Once again, you'll see the "Action successfully completed" message and Windows Automatic Update will no longer be blocked from installing the service pack on your system.

The other tool included with the download, SPreg.cmd, is a batch file useful for administrators who want to block the service pack on remote computers; this utility requires that the machine name be specified in the command line.

I'm sure Microsoft made every effort to ensure that the distribution of Windows XP Service Pack 3 would go smoothly. Unfortunately, the company's efforts didn't keep some Windows Secrets readers out of the update muck.

While most XP users who have installed SP3 experience no problems, the risk/reward balance suggests that there's no hurry to apply the patch, at least until Microsoft stops supporting SP2 — many months from now.

Renewal pop-ups tick off antispyware user

Antivirus apps may be malware in disguise

A dangerous new virus is making the rounds in the guise of a legitimate antivirus program. Going by such names as "Antivirus XP 2008" and "XP Antivirus 2009," this malware, as described in a recent Computer Associates advisory, succeeds by looking like a legitimate Windows program.

The Internet security blog Donna's SecurityFlash reports that rogue antivirus programs such as these are being promoted through spam messages that link to an automatic download of a virus installer.

With such aggressive methods afoot to fool security-minded users, how do you know when an antivirus product is legitimate? Use the following guidelines to ensure that the security products you download are legitimate.

Choose your security vendor deliberately

Be careful how you select a security vendor. Just because you see an ad for a vendor or product on a highly reputable site doesn't mean the advertiser is reliable.

Conversely, an ad for a reputable product or service on an unfamiliar site doesn't mean that you can trust the site. Advertisements are often distributed by third parties beyond the editorial control of the hosting site. That's why real propecia you may find ads for untrustworthy products on legitimate sites, and ads for legit products on bogus sites.

Services such as the free McAfee Site Advisor and the Web of Trust add-on for the Firefox browser evaluate beforehand the safety of the site you're about to visit. (Windows Secrets contributing editor Becky Waring reviewed Web of Trust in her July 17 column.)

Because the ratings generated by these tools may be based on out-of-date reports, they aren't perfect. But they serve as a useful line of defense.

Another way to evaluate sites before you visit them is with the free LinkScanner Lite application. Rather than rely on second-hand reports, LinkScanner analyzes the code of a given site to check for stealth downloads and other malicious behavior.

The free version of the program requires that you right-click a link manually to get a risk analysis before you surf to the site. If you want your Google and Yahoo search results to be scanned automatically (in addition to other added features), buy LinkScanner Pro for $20.

Published reviews praise LinkScanner for detecting hacked sites, although the program fares less well when rated for detecting phishing sites. CNET's review gave LinkScanner an overall rating of 7.5 out of 10. PC Magazine's evaluation was similar, awarding the program 3.5 out of 5 stars.

Finally, never visit a shopping site by clicking a link in a spam message. Even if the message claims to be pitching a reputable product, such as one from Symantec or ZoneAlarm, the link may actually take you to a counterfeit site.

Color-coding the good guys and bad guys

One site that has been tracking rogue anti-malware products since 2004 is Spyware Warrior. If you're considering a product whose validity is not certain, your first screening step should be to search Spyware Warrior's blacklist. Although Spyware Warrior focuses on identifying fake antispyware apps, the service's blacklist of suspicious sites and products also includes a lot of rogue antivirus applications.

Additionally, consult a whitelist of products that have been certified by a reliable independent organization. One such organization is ICSA Labs (formerly the International Computer Security Association), an independent research and certification division of Verizon Business. On its site, ICSA maintains a list of antivirus products it has certified according to its criteria.

Once you've validated a product to your satisfaction via these resources, you're probably safe downloading it directly from the vendor. But to be extra cautious, consider going to a reputable download source that scans every item before placing it in its library. Such sites include CNET's Download.com, the Downloads page of PCWorld.com, ZDNet's Downloads page, and Tucows.com's security section.

These days, every PC user needs security software to protect against online threats. But when the security software itself becomes a threat, the solution becomes a problem.

Fortunately, with a little care, you can dramatically reduce your risk when shopping for safe and effective security products.