 |
The U.S. Department of Energy's Computer Incident Advisory Capability office has issued a security bulletin reporting that users of Microsoft Office XP, Internet Explorer (version 5 and later), and Windows XP could send sensitive or private information to Microsoft.
Microsoft Office XP, Internet Explorer (version 5 and later), and Windows XP are configured to request you to send debugging information to Microsoft in the event of a program crash. The debugging information includes a memory dump which may contain all or part of the document being viewed or edited.
Microsoft describes error reporting in Internet Explorer in this Knowledge Base article, which also describes how to switch off error reporting.
When error reporting activates after a crash, it displays a dialog box as shown here that asks you to send debugging information to Microsoft. This information includes a copy of the area of memory where the program was running when it crashed. You aren't made aware of the fact that the contents of the document being viewed may be in that same memory area.
To disable Error Reporting in Office XP, use this registry patch. Once you downloaded it, just double click on it, and answer Yes when asked if you want to add the information to the registry. You can also right-click the file and select Edit, to check it's contents. This is how it should look:
REGEDIT4 [HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\10.0\Common] "DWNeverUpload"=dword:00000001 "DWNoExternalURL"=dword:00000001 "DWNoFileCollection"=dword:00000001 "DWNoSecondLevelCollection"=dword:00000001 [HKEY_USERS\.Default\Software\Policies\Microsoft\Office\10.0\Common] "DWNeverUpload"=dword:00000001 "DWNoExternalURL"=dword:00000001 "DWNoFileCollection"=dword:00000001 "DWNoSecondLevelCollection"=dword:00000001
This disables error reporting for the current user only, and so must be run by each user of a system (new users created after this registry patch is run will have the changes made for them).
Remember, only administrators have access to the registry. If you receive an error when trying to run this registry patch, contact your administrator or local support group.
