Linux.com

Feature: Security

Replace and disable Internet Explorer now

By Jem Matzan on July 02, 2004 (8:00:00 AM)

Share    Print    Comments   

You've probably heard about a particularly nasty Trojan horse attack recently which exploited several vulnerabilities in Microsoft Internet Explorer and Internet Information Services. While viruses and Trojans have been around for years, this particular attack was new because it used several vulnerabilities at once, and it didn't require the user download or install any programs or visit any malicious Web sites. It's time to say goodbye to Internet Explorer and its security flaws forever. Here's how to do it.

Before you go removing your only Web browser, you need to have something to replace it with. There are two primary alternatives to Internet Explorer: Mozilla and Opera.

Mozilla is actually a suite of programs; it's a Web browser, email client, address book, and calendar all rolled into the same basic framework, but we're talking about the browser only now. Mozilla has two derivatives: Netscape, which is a proprietary version of the Mozilla suite, and Firefox, which is a stripped-down version of Mozilla. Those with slow machines may have a better experience with Firefox, since it is only the bare browser component of Mozilla with some modifications. If you're looking for the most IE-like Web browser (in terms of interface), Firefox is your best bet.

All Mozilla derivatives offer pop-up ad blocking, tabbed browsing (which allows you to have several Web pages open in one single window, as opposed to opening them all in separate instances of the program), and superior security and stability. Firefox and Mozilla are both free software, meaning you are not restricted in how you use, modify, or distribute them.

Opera is a proprietary Web browser with lots of excellent features. Like Mozilla, Opera has pop-up ad blocking and tabbed browsing capabilities, and it also has a built-in email client and address book. Despite having many of the same key features, Opera has a different look and feel from Mozilla and Mozilla-based Web browsers, and it's drastically different from Internet Explorer. Some may enjoy that, others will find it irritating. Opera also has built-in ads that display near the top of its browser window; if you want them to go away you have to pay almost $40.

All of these programs can automatically import your IE Favorites from the folder called Favorites in your user's Documents and Settings directory.

There is no harm in installing more than one of these programs. Try them all, if you like, before making a decision, and be sure to give yourself at least a week's time to adjust to each program's different features and interface.

No matter which you choose to install, the new program will at some point ask you if you'd like to make it your default browser. You should say yes, although if you're installing multiple browsers each one will want to check if it's the default every time you start it unless you tell it to stop asking. As long as IE is no longer the default and you have a different program to browse the Web, your mission has basically been accomplished. At this point you can safely remove IE from your computer -- mostly.

Extend and exploit: why IE is a security disaster

There's only so much you can do with HTML and cascading style sheets (CSS). You can do more with high-level Web languages like PHP, ASP, Perl, and Python, but you still need HTML to display Web programs. A more powerful solution is to create an applet -- a separate program that is downloaded and run through your Web browser upon request. Sun Microsystems created the Java language for this purpose, and Microsoft responded by introducing the ActiveX control subsystem. The difference is, Sun designed Java with security in mind, and Microsoft didn't. Microsoft's idea of ActiveX security is to require that publishers digitally sign their programs and to require that end-users assent to the installation of ActiveX applets. There is no way to know what an ActiveX applet will do until you've run it, at which point it is too late to stop any damage it has done. Digital signatures do nothing to stop malicious code.

No matter how many security patches Microsoft releases, ActiveX can still destroy your system or steal your data. The only way to prevent it from potentially harming you is to disable ActiveX, thereby limiting IE's functionality.

The second disastrous extension that Microsoft added to IE is the Browser Helper Object, a file that loads with Internet Explorer and has unrestricted freedom to download, run, and install programs or applets without your permission or knowledge. The security risk here is obvious and self-explanatory; coincidentally this is one of the tools used in the above-mentioned recent Trojan horse attack.

BHO exploits cannot be detected or stopped by antivirus software. Some kinds of spyware detection programs can detect these kinds of attacks, and some can't. Rather than downloading and installing more software to fix problems in IE, it's best to just use a different browser.

As a program, IE simply was not designed to be secure. SecurityTracker.com keeps a list of IE's security alerts -- see for yourself how serious the threats are to Internet Explorer and how often they occur. Compare that list with the list for Mozilla. Which one would you rather use?

How to remove IE

Once you've decided to get rid of IE, you can use the following process, provided you have Internet Explorer version 6 or later installed. Ironically, the easiest way to remove Internet Explorer versions earlier than version 6.0 is to first upgrade to 6.0 -- a process best done through Windows Update. If you're using Windows 95 and want to remove IE, Microsoft has instructions here.

In Windows NT 4.0, 98, 98SE, ME, 2000, and Advanced Server Limited Edition, open up your Control Panel, which is found in the Start Menu under Settings. Then double-click on Add/Remove Programs; a new window will appear with this same title. Select Add/Remove Windows Components from the left-hand icon column and then uncheck the box next to Internet Explorer. Click Next and IE will disappear from your system; click Finish to complete the process. All IE icons will be removed from your quick launch, desktop, and Start menu.

Depending on which operating system you're using and how it has been updated and configured, the option for removing Internet Explorer may alternately be in the Add/Remove Installed Programs section instead of the Add/Remove Windows Components section, but the basic process remains the same.

In Windows XP the process is exactly the same, except you have some further options to limit Internet Explorer. In the same Add or Remove Programs window, Windows XP has an additional option for those with Administrator rights: Set Program Access and Defaults, which is the last icon down on the left-hand icon bar. Click on it and you'll see some different profiles to choose from. Click on Custom; this will list some program defaults and access controls that you can change manually. The first group in the list is for your Web browser. Uncheck the box labeled "Enable access to this program" next to Internet Explorer. You'll notice there is a button for the system default -- you'll want to click the dot next to your new browser to make it the default if it isn't already set.

Internet Explorer is, unfortunately, built into Windows in all versions after 98 and can't be fully removed. No matter what you do, IE will still be available in a limited capacity for the purpose of running Windows Update, which requires Internet Explorer to run. It will not be generally available to users, however, and since you set your default browser to whatever you installed earlier, IE will never open on its own when you click a link offline. This is the best you can do; Windows security is all about reducing risk, rather than eliminating it. If you start Windows Update, an IE window will open and you can use it for browsing sites other than Windows Update despite the fact that it's been "removed" and "disabled." This is one of the main problems with Windows -- there are always loopholes like this one that compromise your system's security. A more effective long-term answer to such security concerns might be to switch to GNU/Linux.

Jem Matzan is the author of three books, a freelance journalist and the editor-in-chief of The Jem Report.

Share    Print    Comments   

Comments

on Replace and disable Internet Explorer now

Note: Comments are owned by the poster. We are not responsible for their content.

Other (Forced) Uses for IE

Posted by: Charles Tryon on July 02, 2004 09:08 PM
In addition to Windows Update, I've noticed another place where Brother Bill tries to force you to use IE, even if you have another browser installed: Hotmail. I have MS Messenger installed on my system (just use it to talk to ONE other person), and occassionally I have to log into hotmail so they don't deactivate my account. I notice that when I launch from MSM, it always uses IE. I don't even know if I can log in with another browser...

#

Re:Other (Forced) Uses for IE

Posted by: Anonymous Coward on July 02, 2004 09:24 PM
Hotmail works just fine on every browser I've ever tried.

I don't ever use the web interface though--It's horribly slow. I just have one of my IMAP accounts fetch the messages for me, so I can use a real client.<nobr> <wbr></nobr>:D

#

Re:Other (Forced) Uses for IE

Posted by: DFJA on July 02, 2004 10:22 PM
Hotmail works just fine on every browser I've ever tried


I couldn't get it to work on Lynx or Links. I got the login screen and entered my details, but beyond that it didn't seem to be willing to work at all.

#

No, just laziness

Posted by: Anonymous Coward on July 02, 2004 09:34 PM
It's easier for programmers who aren't very familiar with windows to do something like

Run("C:\Program Files\Internet Explorer\iexplore.exe", "http://hotmail.com");

than it is for them to go to the registry to get the location of the default browser and run<nobr> <wbr></nobr>/it/. This is just an instance where Microsoft QA failed to notice that a program didn't respect the default browser setting in Windows.

Of course, it's possible that this was intentional, as Microsoft might have the idea that their Hotmail interface has some REALLY NEAT features only available in IE that users MUST HAVE and would want even if they CHANGED their default browser, but let's not ascribe to malice what can

#

Re:Other (Forced) Uses for IE

Posted by: Anonymous Coward on July 02, 2004 09:39 PM
> I don't even know if I can log in with another browser...

Yes, you can log to Hotmail with another browser.

I've seen it some 15 days ago. Look for a program or plugin to do it in Freshmeat, as I don't remember where I've seen it.

I didn't care much because I have no intention to use an M$-owned service. Though I understand some people got their Hotmail addresses before the M$ era.

BTW, I've tried to see a video from MSN and it displayed a "Operating System not supported" because I'm using Linux. While I thank them for the blunt sincerity, I thought it would take them some time to play these games again after the recent lawsuits.

#

wrong - you can

Posted by: Anonymous Coward on July 02, 2004 09:44 PM
I can easily log into hotmail using Galeon under Mandrake. What you cannot do, however, is sign up for the expanded (and paying service) with something else beside IE. But what would you want to do that anyway?!

#

Re:Other (Forced) Uses for IE

Posted by: Anonymous Coward on July 02, 2004 09:51 PM
The company I work in has several in-house "web services" that work only with IE (like for
filling working hour reports). Yes, I and many others have been complaining for years, but "IE is the standard" has been the most common reply. It's supposedly too difficult to support other browsers...


Maybe, just maybe these IE security disasters finally make those blockheads realize that making IE-only web pages even for in-house use is a really bad idea.

#

Re:Other (Forced) Uses for IE

Posted by: ccchips on July 02, 2004 10:22 PM
Microsoft has a toolchain that's geared toward encouraging behavior that helps their felonious monopoly practices. If people like that toolchain, and think it's easier to work with than abiding by standards that make the Internet suitable for use by everyone, then that's what they will do.

Due to the nature of my personal situation, I'm pretty-much trapped into working for a shop like that, and have little or no power to change anything here.

However, in a customer-service training session I attended yesterday, which was about discounting your customers, I described my experience of being "discounted" by 3 ISP's because I use Linux rather than Windows or the Mac. I said that I blew off 2 of them, and managed to get the third one (SBC) to put me in touch with staff who helped me set the service up the way I wanted to. I made sure that everyone in my class heard every word, too, and that I was finally successful in getting an ISP on which I could confidently use Linux, rather than Windows. This in a shop where "Windows religion" is the prevailing behavior.

It's the best I can do, but every little bit helps.

#

Re:Other (Forced) Uses for IE

Posted by: Anonymous Coward on July 02, 2004 10:18 PM
Open your other browser first, then click on the "go to inbox" link on MSN Messenger. It should use that browser instead of IE (it does on my XP box, running Opera)

#

What you want is "Hotmail Popper". See here:

Posted by: Anonymous Coward on July 03, 2004 03:13 AM
Read this article, it will point you in the right direction (See step four):

http://www.ofb.biz/modules.php?name=News&file=art<nobr>i<wbr></nobr> cle&sid=313

#

Re:Other (Forced) Uses for IE

Posted by: Anonymous Coward on July 03, 2004 01:50 PM
several points 1 if you fully remove ie the help stuf gets broken. word outlook and evin 3rd party programs whom have followed microsofts orders on how to make the help section the<nobr> <wbr></nobr>.chm files are read by ie only. when you go to find somthing out about your program it starts ie in the background..

2 there are programs to TOTALY remove ie from windows.
one that comes to mind is litepc? primarly for win98 but also works for later releases.

3 i would wonder how forcing users to use ie to update their os is leagle. last i checked ie and the os were suposed to be seperate.

#

Bork!

Posted by: Anonymous Coward on July 06, 2004 03:15 PM
For those who remember, you know what I'm talking about.

For those who don't, do a search for the terms "Opera", "MSN" and "Bork".

#

Re:Other (Forced) Uses for IE

Posted by: Anonymous Coward on August 04, 2004 11:52 PM
Anybody got a fix for the MSN messenger launching IE for hotmail?

#

Re:Other (Forced) Uses for IE

Posted by: Anonymous Coward on August 05, 2004 07:35 AM
I followed the instructions but find that every time I click on a URL link, e.g., in an email message, it opens up IE and not Firefox, which I selected as my default browser. What's up with that and how do I fix it? Using XP.

#

the problem is *not* IE

Posted by: Anonymous Coward on July 02, 2004 09:53 PM
the problems is ALL MS PRODUCTS: Outlook, Word, IIS, etc. I fail to see the point of telling MS users that by getting rid of IE they will somehow improve their situation. The fact is they will not. There is only *one* way for them to meaningfully secure their stations: the go the GNU/Linux way. Even Macs do often depend of MS software (Word, IE, etc.). The MAC OS X's architecture is not nearly as flawed as anything produced in Redmond but the but the recent security flaws found in OS X shows that OSX is not really secure either [besides, why would anyone in his right might install OSX on overpriced hardware when *free* (as in 'beer' and 'speech') software is available and can run on plenty of architectures?!]

Securing MS platforms is tantamount to trying to create a cardboard main battle tank: it ain't happening.

#

Re:the problem is *not* IE

Posted by: dukeinlondon on July 02, 2004 11:19 PM
There is very strong cardboard these days you know ? Ok I shut up

#

Re:the problem is *not* IE

Posted by: Anonymous Coward on July 02, 2004 11:46 PM
not strong enough to stop or deflect a shell fired from a smoothbore 125 gun<nobr> <wbr></nobr>:-) not even close.

#

Re:the problem is *not* IE

Posted by: Preston St. Pierre on July 03, 2004 12:27 AM
Right, well, if someone wants into your system badly enough, they are going to get in. I don't care if you are running Windows or Linux, I can almost guarantee that there is a hole left open.

Point being is that switching from IE/Outlook to Firefox/Sylpheed-claws increases security by a hundred times.

#

anyone listening ? hardly

Posted by: dukeinlondon on July 02, 2004 11:13 PM
The problem is that if you post that on a Windows site, some people there will make charcoal of you and the others will read "get read of your legs since walking and running are hazardous activities". They consider IE as THE browser. When I recommended firefox to a colleague, he asked "is it compatible ?". He meant with the net !

Most people I know consider the core applications coming with Windows as the only such applications and Windows the only OS. Now, that's impressive marketing. The planted the seed of fear (that what these crashes and performance loss are for) and now are reaping the benefit of the doubt. Even seasoned Unix engineers (I know a few) won't even take Linux for a spin.

#

that's because they are boneheads

Posted by: Anonymous Coward on July 02, 2004 11:55 PM
When I recommended firefox to a colleague, he asked "is it compatible ?". He meant with the net

yeah, I also was once asked if "Linux" could browse the net. That tells you plenty of how fucking totally unbelievably stupid and ignorant Windows users typically are. Frankly, I think they *deserve* every once of pain they get from their computers. Let these lemmings drown in the sea of their own mediocrity.

PS: from some rumors I hear that the next IE will include such "amazing and revolutionary" features as multiple tabs and pop-up blocking. I can already see the MS boneheads having fits of total bliss about how "totally awesome" this new version IE is. If one of them comes and starts rapturously tell me about that it will be really hard for me not to bash my fist into his/hers stupidly grinning face....

#

Re:that's because they are boneheads

Posted by: Preston St. Pierre on July 03, 2004 12:30 AM
So don't stop yourself.

Personally, I refuse to help anyone with computer problems unless they have (or are willing to let me install) Firefox + Sylpheed-claws (or pretty much any other OSS combo). It just isn't worth it.

#

Re:that's because they are boneheads

Posted by: Anonymous Coward on July 03, 2004 02:53 PM
Frankly, I think they *deserve* every once of pain they get from their computers. Let these lemmings drown in the sea of their own mediocrity.


But they are not alone in the net. They affect other users and systems, too. High traffic, spam, etc.

#

Re:that's because they are boneheads

Posted by: Anonymous Coward on July 04, 2004 07:18 AM
true. but all that pain generates more and more interest for GNU/Linux. In my LUG there are regularly people who come in shaking with fury about how Windoze has screwed them yelling "I can't take this any more - what's this Linux thing everybody talks about?!".

Essentially viruses, crashes, costs, licenses, etc are all one big marketing campaign for free software.

Thanks Bill!

#

quit writng ie only sites

Posted by: Anonymous Coward on July 03, 2004 02:30 AM
anyone who writes web sites for ie only should be fired on the spot no questions asked -

#

how about some sophistication here?

Posted by: Anonymous Coward on July 04, 2004 07:20 AM
I totally disagree with this primitive statement!

They should be slowly dismembered, roasted over a small fire, skinned alive, de-clawed, have their teeth pulled, etc.

and only *then* shot with BB guns!<nobr> <wbr></nobr>;-)

#

Re:quit writng ie only sites

Posted by: Anonymous Coward on July 06, 2004 03:04 PM
Actually, they should write sites following standards, so it will work with ANY browser.

And, of course, TEST it with several browsers to see their design really works.

(That being said, I won't shed a tear if IE, in some beautiful, magical way, stops being used by the majority of people or - even better - just magically disappears... )

#

the two ends of the spectrum

Posted by: Anonymous Coward on July 03, 2004 03:42 AM
on one end, no less than the Herald Tribune find the courage to make a truly daring (if obvious) suggestion:

http://www.iht.com/bin/print.php?file=527677.html

on the other hand, the champion of MS prostitute reporters is a certain Jason Lopez who, quoting another hooker called John Pescatore wrote this opus:

http://www.newsfactor.com/story.xhtml?story_title<nobr>=<wbr></nobr> Few-IE-Alternatives-for-Enterprises&story_id=2570<nobr>9<wbr></nobr>

[remove any possible blank spaces in URL to view]

#

IE does not use separate instances

Posted by: Anonymous Coward on July 04, 2004 08:13 AM
"tabbed browsing (which allows you to have several Web pages open in one single window, as opposed to opening them all in separate instances of the program)"

This is a commonly held (mis)understanding of how IE (and other MS apps) open documents in more than one window. Although tabbed browsing reduces the clutter & crowding on the Taskbar, it works the same as IE with regard to multiple instances of the program.

Even when IE is used to open several websites in multiple windows, only one instance of the executable is loaded into memory to render all of those pages. The same is true of Word and Excel, when viewing multiple documents or spreadsheets.

#

Easier Way To Remove IE in Win 9x ME 2000sp1/XP

Posted by: Anonymous Coward on July 05, 2004 08:41 AM
Go to litepc.com http://www.litepc.com/,click on 98lite. Scroll down to get the small app named IEradicator. It is free and removes IE completely.
When you unzip the downloaded file, there will be two executables named the same except for an "a" at the end of one of them.Unless you want to get rid of the "view as a web page"(most will want to keep this) use the one without the "a" in it.
There are also a few other apps at this site for helping you gain control of your windows 9x thru XP installations.The free trial versions of 98lite and XPlite function fully without time limits. XP lite trial is limited to single user installs however.

#

Firefox is noticably faster using IEradicator

Posted by: Anonymous Coward on July 05, 2004 09:09 AM
Just used IEradicator on an old 300mhz laptop with win98se on it. After using IEradicator to remove Internet explorer,the Firefox browser is a bunch quicker surfing. It even starts up faster.Haven't tried Mozilla yet. Go figure!

It's faster to use the (free software) link on the left hand side of the litepc.com webpage to get IEradicator.

#

BHO, exploits?

Posted by: Anonymous Coward on July 05, 2004 10:58 AM
BHO exploits cannot be detected or stopped by antivirus software. Some kinds of spyware detection programs can detect these kinds of attacks, and some can't.


Why are BHOs referred to as "exploits"? BHOs are extension mechanisms designed for IE 5.5 and up. BHOs are installed only if the user chooses to install them, so they behave like EXE files. They also run with local user privileges when installed, just like EXEs but that doesn't make them exploits or "kinds of attacks".

#

freeing HD space on WindowsME

Posted by: Anonymous Coward on July 05, 2004 09:05 PM
Hi,

I have finally convinced my dad and installed FireFox instead of IE on his laptop, but he complains it is slow. Problem is, his whole system is slow. The C-drive is near to full (90MB or so left), but I cannot seem to determine what takes up so much space. Last time I used a trial version of some program called "WebWasher" to do it, and that cleaned up about 80 (or even more, cannot remember) MB, but of course now it's expired.

Anybody know how I might determine what takes all this disk space, and how to gain more of it? I'd like to install Thunderbird as well, but I don't want to add stuff before I free some more HD space.

#

Re:freeing HD space on WindowsME

Posted by: Sam Leathers on July 06, 2004 04:21 AM
steps to cleaning a system (the basic version):

1) delete everything in c:\windows\temp\

2) delete everything in c:\windows\Temporary Internet Files\

3) delete everything in c:\windows\cookies\

4) start->settings->control panel->add remove programs - delete any programs you don't need from there, if you use cleansweep or something similar use that program to remove unused programs instead

5) if you still need space, without getting into expert clean-up operations, your options are back, reformat re-install, or buy a new hard drive.

note: steps 1 - 3 will be different if you use an alternate browser from ie. I use firefox, and have an extension called x, i click the x, click ok, and everythings cleaned up

#

thanks!

Posted by: Anonymous Coward on July 06, 2004 02:43 PM
Thanks!

Doesn't seem to be like a lot of steps, but it's good to know where to start. Well, I dunno, maybe I'll be surprised about the space I can recover with this.

For my own PC I've got a 80GB Hard Disk, so I'm kind of spoiled in that aspect<nobr> <wbr></nobr>;)

#

This story has been archived. Comments can no longer be posted.



 
Tableless layout Validate XHTML 1.0 Strict Validate CSS Powered by Xaraya