John C. Dvorak’s latest column is a rant about Microsoft’s security software that includes this amazing paragraph. And by “amazing,” I mean “breathtakingly ill-informed and doesn’t PC Magazine have any technical editors anymore?”

I use a utility called Prevx [link: http://www.prevx.com], a host-intrusion protection system, as well as one or two other antispyware packages to keep the stuff at bay. And it still sneaks in once in a while. Most recently, I forgot to turn off my CUTEftp client and left it running all night. In the morning some system had loaded some weird software called “active skin,” and I had to use SpySubtract to remove 26 Registry entries. Exactly how anything manages to worm in through the open port and place items in the Registry is beyond me, but it happens all the time.

Oh, lordy.

Repeat after me: Leaving an FTP client open does not allow an intruder to install software on your computer. Cannot happen. Science fiction. Even if you were to run an FTP server on your computer, the only thing someone could do would be to upload files to your PC. They couldn’t run the program or edit your registry. And anyway, that’s completely irrelevant in this case, because Dvorak was running an FTP client.

So what about this horrible spyware program that had to be removed? ActiveSkin is a UI development environment from ShapeSoft. It uses an ActiveX control. I can’t find out much about it (and the company that owns it has gone dark), but I know that Symantec calls it “a non-malicious component that may be used by other applications.” I have seen hints that it is used with ICQ, with Ad Hunter, with the SigmaTel audio control panel, and with a number of homebrewed VB6 programs (like this one). Several well-known spyware and Trojan programs use this component, including Insecure Executable Downloader, but it does not appear to be harmful in and of itself.

In fact, given that the spyware scanner John is using is from Trend Micro, it wouldn’t surprise me if it’s a false positive. The ActiveX control (remember, Symantec calls it non-malicious) was probably included with a program that Dvorak installed. It registered itself at installation time (thus adding entries to the registry). It wouldn’t be the first time that Trend Micro had been guilty of identifying a perfectly legitimate program as spyware.

From that false premise, Dvorak then reaches the sweeping conclusion that Microsoft is unwilling and unable to “fix” Windows so that it’s perfectly secure.

Sigh. There ain’t no such thing as a secure operating system. Sensible security precautions can be built in, development processes can be improved, reaction time for fixing security issues can be cut down. But “fixing” Windows does not mean creating a code base that has no more security issues ever.

This is yet another reason why I stopped reading PC Magazine. The trouble is, several hundred thousand people still do, and after reading this column they’ll come away with the mistaken belief that hostile software can attack their computer using a simple FTP client. Who knows what other ridiculous technical errors are in this same issue?

As Dvorak would say, sheesh.