A reader asks why, all of a sudden, Internet Explorer is jumping two pages every time they click in the scroll bar at the right of the window. The answer comes courtesy of Larry Seltzer at eWeek in his story Bugs, Old File Dates in New Microsoft Patches:

“The Cumulative Security Update for Internet Explorer, which addresses numerous security flaws in Internet Explorer 6, introduces bugs involving the scrollbar. After the patch is applied, the page scrolls up or down twice when the user clicks once in the empty areas of the scrollbar. Clicking on the scrollbar arrows or dragging the scrollbar thumb works correctly.”

Larry reports that Microsoft is aware of the problem and is working on a fix.

Meanwhile, do NOT remove this patch to resolve the problem. This is a Critical Update, and removing it exposes you to the risk that your computer will fall victim to any of several serious security problems, including having it taken over by a remote hacker.

Until a revised patch is available, try clicking the “thumb” (the variable-sized bar in the center of the scroll bar) and dragging. Or use your mouse wheel. Or use the up and down arrows at the top and bottom of the scroll bar, respectively.

Budget tight? Computer Associates and Microsoft are offering a free copy of eTrust EZ Armor, including antivirus, firewall, and a 12-month subcription for updates. You have to fill out a form giving them your name, address, e-mail address, and phone number. None of this information is verified, however. As soon as you fill in the form, you can download the software.

CA isn’t my favorite software company, but this is a solid program that will do a fine job at stopping viruses.

Spread the word.

Once upon a time, you could afford to wait a few weeks after a security patch was released – see if it’s safe, bug-free, whatever. No more. The cretins who write hostile software are reacting faster and faster. InfoWorld reported this week about a pair of new attacks that exploit a Microsoft vulnerability for which a patch was issued on November 11. The attack code is only a demonstration at this point, but it’s probably a mere matter of days before this one gets translated into an attack that can do some real damage.

The moral: When a critical security update is released, download it and install it. Turn on your firewall. Don’t be a victim.

If you haven’t visited Windows Update lately, maybe now would be a good time.

Think spam has peaked? Sorry to say, it’s getting worse. As this story at SouthBendTribune.com reports, spammers are branching out into new frontiers. They’re clogging up cell phones, for instance, and polluting the comment areas of blogs like this one. In the past month, I’ve deleted over 100 links to porn, gambling, and other sites. The MSN Group that we set up for readers of Windows XP Inside Out gets subscription requests every day from scam artists whose desire is to post more come-ons to the same crap.

I’m sick of it. Technology can block most of this stuff, but that’s a reactive approach. The fact is that the spam industry is dominated by a handful of people who build the tools and exploit the weaknesses in the Internet. Taking down a few high-profile players in this industry could go a long way towards cleaning up the mess.

Meanwhile, the good ol’ Delete key gets way more use than it was ever built to withstand.

So, Steve Jobs finally unveiled Apple’s iTunes service for Windows. A couple comments:

First, there was obviously a lot of demand for this. I tried to download the software yesterday, when it was first available, and it took several hours, with several timeouts, to get it. Presumably because a few million other people were trying to do the same thing. Maybe next week it will be easier.

I have a problem paying 99 cents a track for tunes that are of lower quality than the artist originally recorded. Oh, Apple says I shouldn’t worry: “… some expert listeners have judged AAC audio files compressed at 128 kbps (stereo) to be virtually indistinguishable from the original uncompressed audio source.” Yeah, right. Can you count the number of qualifiers in that sentence? There are lossless compressed audio formats available. At that price, I want the real thing.

The iTunes player, which is no doubt cooler than cool, uses QuickTime as its underlying engine. I get a shiver down the back of my neck when I even think about QuickTime, because of all the problems it’s caused me through the years.

And then there’s U2’s Bono, who spoke with Jobs at the press conference yesterday and delivered what may have been the most pretentious and overwrought line in the history of software launches: “It’s like the pope of software meeting up with the Dali Lama of integration,” he was quoted as saying in a Reuters story. Sheesh.

I’ll wait.

Hey! Special Edition Using Microsoft Office 2003 is officially available at Amazon.com and other fine booksellers. Microsoft is officially launching the retail version of the software on October 21, but you may be able to find it sooner if you order a new PC or if your corporation has a volume license.

If you use Outlook, this is an absolute must upgrade. And I would expect Microsoft to offer some attractive deals in the next few months. I’ll keep you posted if I find any that are especially attractive.

Just a quick FYI: My latest column for Microsoft’s Expert Zone, CD Burning Secrets, is now available. If you’ve ever been baffled by your burner, you might find some interesting info here.

I spent two hours Monday on the phone with an out-of-state client, cleaning up the mess left by the latest Windows virus, Swen. He had received an infected e-mail that appeared to be from Microsoft and appeared to contain an important security update. So he dutifully ran the attached file. At which point, of course, all hell broke loose.

I was able to walk him through the process of removing the virus, restoring his antivirus software to proper working order, and deleting the 15,000-plus infected messages that had accumulated in his Inbox. Along the way, he asked, several times, “How could I have been so stupid?” Actually, he was taken in by a relatively clever trickster. Here’s the moral of the story:

Don’t trust anything you receive in e-mail. It’s easy to “spoof” the sender field of an e-mail message so that it appears to be from anyone – from Microsoft, or from your best friend, or even from me. Just because you read it in an e-mail, that doesn’t mean it’s true.

Bookmark the security pages for the companies that make the software you use regularly. I’ve got the Microsoft Security and Privacy page in my Favorites folder, along with Symantec’s Security Response page. If you get an e-mail pretending to offer information from either one, don’t ignore it, but don’t assume it’s for real, either. Check it out for yourself before you make any decisions that you might later regret.

If you still can’t figure it out, send me an e-mail. My address isn’t published here (for security reasons), but the Send Me a Note link on this page will let you fill in a Web form that is guaranteed to get to me.

Back in August, 2002, Carl Siechert and I put the finishing touches on Microsoft Windows Security Inside Out for Windows XP and Windows 2000. It’s a big, fat book, encompassing more than 800 pages of fairly technical material aimed at helping ordinary users of Microsoft operating systems break through the haze of misinformation, myth, and technobabble that defines most of the currently available information about Windows security. As it turns out, we may have been a bit ahead of the curve. One year ahead, to be precise.

In the wake of Blaster and Sobig.F, I decided to adapt some of the material from that big security book and publish it as a short, easy-to-follow preventive program. The results are posted at my Web site: Protect Your PC – A Four-Step Program

I hope you find it useful.