News Blog

Microsoft today released its March 2008 security bulletin, which includes four bulletins, all deemed critical by Microsoft.

The most serious of these affects Microsoft Excel, which alone has six specific "Common Vulnerablities and Exposures" vulnerabilities noted, one of which has been exploited in the wild. The next most serious affects Microsoft Outlook. In that one, a vulnerability in how the software parses "mailto" URIs could lead to remote code execution. A third bulletin affects how various Microsoft Office apps open maliciously crafted files. The final bulletin concerns how Office interfaces with the Web and includes one vulnerability that has been known but unpatched since September 2006. All Microsoft security patches for both Windows and Office software are available via Microsoft Update or via the individual bulletins detailed below.

MS08-014: Critical

Entitled "Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (949029)," this bulletin is critical for users of Microsoft Excel 2000 Service Pack 3, and important for users of Excel 2002 Service Pack 3, Excel 2003 Service Pack 2, Excel 2007, Microsoft Office Excel Viewer 2003, Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats, Microsoft Office 2004 for Mac, and Microsoft Office 2008 for Mac. Not affected are Microsoft Works 8, 8.5, and 9, or Works suite 2005 and Works suite 2006. The update addresses vulnerabilities detailed in CVE-2008-0111, CVE-2008-0112, CVE-2008-0114, CVE-2008-0115, CVE-2008-0116, CVE-2008-0117, and CVE-2008-0081. Microsoft says, "an attacker who successfully exploited these vulnerabilities could take complete control of an affected system and could then install programs; view, change, or delete data; or create new accounts with full user rights."

MS08-015: Critical

Entitled "Vulnerability in Microsoft Outlook Could Allow Remote Code Execution (949031)," this bulletin affects users of Microsoft Outlook 2000 Service Pack 3, Outlook 2002 Service Pack 3, Outlook 2003 Service Pack 2, Outlook 2003 Service Pack 3, and Outlook 2007. Not affected are users of Outlook 2007 Service Pack 1. The update addresses the vulnerability detailed in CVE-2008-0110. Microsoft says this vulnerability "could allow remote code execution if Outlook is passed a specially crafted mailto URI. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. This vulnerability is not exploitable by simply viewing an e-mail through the Outlook preview pane."

MS08-016: Critical

Entitled "Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (949030)," this bulletin affects users of Microsoft Office 2000 Service Pack 3, Microsoft Office XP Service Pack 3, Microsoft Office 2003 Service Pack 2, Microsoft Office Excel Viewer 2003, Microsoft Office Excel Viewer 2003 Service Pack 3, and Microsoft Office 2004 for Mac. Not affected are users of Microsoft Office 2003 Service Pack 3, Microsoft PowerPoint Viewer 2003, Microsoft Visio 2002 Service Pack 2, Microsoft Visio 2003 Viewer, Microsoft Word Viewer 2003, Microsoft Project 2000 Service Pack 1, Microsoft Project 2002 Service Pack 2, 2007 Microsoft Office System, 2007 Microsoft Office System Service Pack 1, and Microsoft Office 2008 for Mac. The update addresses the vulnerability detailed in CVE-2008-0113 and CVE-2008-0118. Microsoft says, "an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights."

MS08-017: Critical

Entitled "Vulnerabilities in Microsoft Office Web Components Could Allow Remote Code Execution (933103)," this bulletin affects users of Microsoft Office 2000 Service Pack 3, Microsoft Office XP Service Pack 3, Visual Studio .NET 2002 Service Pack 1, Visual Studio .NET 2003 Service Pack 1, Microsoft BizTalk Server 2000, Microsoft BizTalk Server 2002, Microsoft Commerce Server 2000, and Internet Security and Acceleration Server 2000 Service Pack 2. Not affected are users of Microsoft Works 8, Microsoft Works 9, Microsoft Works Suite 2005, Microsoft Works Suite 2006, Microsoft Office 2003 Service Pack 2, Microsoft Office 2003 Service Pack 3, 2007 Microsoft Office System, 2007 Microsoft Office System Service Pack 1, Microsoft BizTalk Server 2004, Microsoft BizTalk Server 2006, Microsoft Commerce Server 2000 Service Pack 1, Microsoft Commerce Server 2000 Service Pack 2, and Microsoft Commerce Server 2000 Service Pack 3, Microsoft Commerce Server 2002, Microsoft Commerce Server 2007, Internet Security and Acceleration Server 2004, and Internet Security and Acceleration Server 2006. This update addresses the vulnerability detailed in CVE-2006-4695 and CVE-2007-1201. Microsoft says, "these vulnerabilities could allow remote code execution if a user viewed a specially crafted Web page. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights."

Recently an associate whose PC lacked Adobe Acrobat sent me a Word file via e-mail, asking if I could convert it to PDF and e-mail it back to her. Since the process took all of about 30 seconds, I was delighted to help. Then the next day she sent two more files in need of conversion to PDF, and a couple of days after than another. After her fourth request of the week I felt compelled to tell her about two ways she could have converted the files herself for free: Adobe's own Create Adobe PDF Online free trial, and Arco Software's great CutePDF Writer freebie.

If you use Office 2007 you can download Microsoft's free Save as PDF or XPS utility, which adds the ability to convert files to PDF or Microsoft's competing XML Paper Specification to all eight applications in the suite. The great thing about CutePDF Writer is that it works with programs other than Office 2007. See below for more.

Slow and limited, but readily available: Create Adobe PDF Online
I've used Adobe's free PDF-conversion service for years, and while the $10-a-month service ($100 for one year) used to allow you to create 10 PDF files for free, that number has been reduced to five free conversions, which is sufficient for people who rarely have the need to make a PDF. (If you need more than five files converted, sign up for a new free e-mail account and re-register with that address.)

The downside to Adobe's free trial is that you have to register, and you have to wait for your PDF to be delivered. Otherwise using the service is straightforward. After you sign up, click Convert a file (you can also choose Convert a Web page), enter the path to the file/page you want to convert, or click Browse and navigate to the file.

Enter the path to the file you want to convert to PDF, and click Continue.

Click Continue to open the Conversion Settings window. Here you select the type of output you want to optimize the file for (Web, Print, etc.), password-protect and otherwise limit use of the file, and select a delivery method.

Optimize your PDF for print or viewing on the Web via these options.

The default delivery method is to have a link to the PDF e-mailed to you, but you can also choose to have the file sent to you as an e-mail attachment, wait for the file to open in your browser, or download the file from your account's Conversion History page.

Choose the delivery method for your PDF file: e-mail link, e-mail attachment, open in browser, or download from server.

After you click the Create PDF button, you receive a confirmation of the conversion that tells you how long you'll have to wait for the file to be available. When I tested the service, I had to wait a little less than 25 minutes for the file to be delivered, which seems like a long time to me. You're also informed that you have 72 hours to retrieve the file.

The confirmation screen lets you know how long you'll have to wait for your PDF file.

Fast and full-featured: CutePDF Writer
If you have more than the occasional need to convert a file to PDF, downloading and installing CutePDF Writer is a faster and simpler approach. The program installs in just a few seconds, though it requires a second program, which it downloads automatically--after you grant it permission--as part of the installation process. Once it's in place, simply open the file you need to convert in the application of your choice, choose File > Print, and select CutePDF Writer in the drop-down list of available printers. The utility opens a Save As dialog box, where you can rename the file and choose where to store it. What could be simpler?

Which makes me wonder why anybody would choose Adobe's clunky and limited online PDF-conversion service over a free utility such as CutePDF Writer. Perhaps they have an aversion to downloads, though this one lacks ads, spyware, or other unwanted companions. Or they may be using a PC other than their own and need a one-time conversion that doesn't entail a download. Still, downloading, installing, and using CutePDF Writer is faster and simpler than using Adobe's service even after you've completed the initial sign-up. I guess this is one of those computing areas where the online version can't match the desktop approach.

Monday: disk management and optimization made simple.

The only reason I've opened Microsoft Outlook or any other desktop e-mail program in the last year is to test tips. Since I added my ISP account to my Gmail in-box, and moved my Outlook appointments to Google Calendar, I get all the information I need in my browser.

Now I'm getting ready to boot Word, Excel, and PowerPoint for their Web alternatives, but before I bail on Office entirely, I stuck a toe in the Web-apps water by using the free ThinkFree Online service irregularly over the past few weeks. So far, I haven't missed Word, Excel, or PowerPoint one bit. In fact, I appreciate the comparative simplicity of their Web counterparts, which have worked without a hitch--so far, at least.

ThinkFree Online is a Java-based service that provides 1GB of storage for your files, though individual files can't be larger than 10MB. You can upload .doc, .xls, and .ppt files to the site (it works with Office 2007's XML formats as well), work on them in an environment much like their native Office apps (though in a smaller window with text ads along the right margin), and return them to your desktop, where they open in the Office equivalent with all changes in place. There's also a limited-function, Ajax-based Quick Edit app for making fast, simple changes to files.

You can choose to keep your files private, or share them, either with a select group, or the world. In fact, easy collaboration is one of the great features of the service for workgroups. You can tag files for easy retrieval, but ThinkFree's search feature located the files I was looking for without having to attach tags to them.

The first time you open a file in the service, it loads some information in your Java Virtual Machine, but subsequently files load at near-desktop speed. You have to make some concessions, such as the text ads, and your selection of fonts is limited. You can't be certain your macros, functions, and other Office customizations will work in the online apps. (I haven't needed any.) Also, a browser can't match the resolution of your desktop apps, but generally the transition from Office to ThinkFree is seamless.

Work on Office documents in the free ThinkFree Online service much like you do in their native apps.

(Credit: ThinkFree)

From the My Office page you get a snapshot of your files, as well as controls for creating, uploading, downloading, and syncing documents, spreadsheets, and presentations. Click the "Go to the file list" button near the bottom of the window to get a more detailed view of your files, as well as to share them, tag them, rename them, or perform other operations.

The ThinkFree Online Webtop lets you upload, download, and otherwise manage your files.

(Credit: ThinkFree)

If you need to work on your files while offline, you can upgrade to the Premium Edition of the service, which is free during the beta period (no indication of when that period may end). The Premium version also lets you sync files automatically in the background, and load files larger than 10MB, though you can't open these larger files in the online version. There's also the $50 ThinkFree Desktop version, though I use the free OpenOffice.org on my Ubuntu system, which provides all the Office compatibility I need.

Even though ThinkFree offers the ThinkFree Server version for enterprises, I can understand why large organizations would hesitate to abandon Office. First there's the support costs, since their help-desk staff is trained in Office apps. Then there are the many customizations large organizations have applied to the programs. But the biggest reason enterprises will likely stick with Office is the greater amount of control it gives them over file management. I'm sure it makes a lot of IT managers nervous to think about their organization's important documents residing outside of the Office system. (Just suggesting that people save their Outlook e-mail outside of the program raised some IT hackles.)

Google's online apps loom as another Office threat
Even with my reliance on Gmail and Google Calendar, I haven't been tempted to use Google Docs full time, in part because I'm happy with ThinkFree Online. On those occasions when I have tested Google's online apps, I've been pleased with their performance. But ThinkFree comes closer to matching the Office work environment, even with those darn ads. Still, with the expected arrival of online applications using the Google Gears API for offline access, it's difficult to ignore the potential Google's services could have for current Office users. Another factor that might change my mind is whether Google Apps become more tightly integrated with other services from the company. Right now there's not much tying them together besides a log-on ID.

Tomorrow: Customize the Open and Save dialog boxes in Vista and XP.

One of the most notable additions to Microsoft's 2007 Office System was the Trust Center, which centralizes the security options in Word, Excel, Outlook, PowerPoint, and the other applications in the suite. Of course, this being Office, it figures that many of the most important security features--including the new Document Inspector--also reside elsewhere.

To open the Trust Center in the 2007 versions of Word, Excel, PowerPoint, and Access, click the Office button, select the Options button at the bottom-right of the window, choose Trust Center in the left pane, and click the Trust Center Settings button in the right pane. In Outlook 2007 and Publisher 2007, click Tools > Trust Center.

The Trust Center in Microsoft Office 2007 apps centralizes most of security options in the programs.

The security options presented in the Trust Center vary from program to program, but you'll likely want to start by clicking the Privacy Options button. The third and fifth options under Privacy Settings in the right window are checked by default: Download a file periodically that helps determine system problems; and Check Microsoft Office documents that are from or link to suspicious Web sites (this last option is missing in Outlook 2007).

The 2007 versions of Word, Excel, PowerPoint, and Publisher list an option to remove personal information from file properties on save (this may be grayed out), as well as a Document Inspector button, which searches the file for comments, revisions, and hidden metadata. You can also access the Document Inspector in Word 2007, Excel 2007, and PowerPoint 2007 by clicking the Office button and choosing Prepare > Inspect Document.

Listed under the Trusted Publishers tab are the companies and organizations whose macros and add-ins have an approved digital signature. With Office 2007's default security settings selected, you see a warning in the Message Bar at the top of the file window whenever a macro or add-in from an entity not on this list tries to run. Click the Options button on the bar to open the Security Options dialog box, which provides information on the blocked content. Here you can choose to let the add-in run, trust all files from the publisher, or block it (the default setting). You can also click Show Signature Details to view more information.

You can also choose to allow all files from specific folders or other locations to open with no security warnings. Just click the Add new location button in the Trusted Locations window and enter the folder or network path, if you check "Allow Trusted Locations on my network (not recommended)" at the bottom of the window. Microsoft warns against enabling this option for a reason: It provides malicious VBA scripts entering via this location unfettered access to your applications, where they can wreak all sorts of havoc.

Add folder or network paths to your Trusted Locations list in Office 2007 to avoid the security warning when files they contain open.

The other Trust Center Settings tabs let you disable all add-ins, or adjust your macro and ActiveX settings. The default settings meet the needs of most users: "Prompt me before enabling all controls with minimal restrictions" for ActiveX, and "Disable all macros with notification" ("Warnings for signed macros; all unsigned macros are disabled" in Outlook 2007).

Outlook 2007 adds the E-mail Security dialog box, where you can choose to encrypt outgoing messages and attachments, and to read your incoming mail as plain text rather than as HTML. This option helps prevent malicious content in a message from running automatically (see yesterday's post), and you can view the HTML version of messages from people you trust by clicking the warning at the top of the of the window and choosing Display as HTML.

Many of the permission-restricting options in Office 2007 apps require Microsoft's Information Rights Management/Windows Rights Management Services, but you can limit who can read and work on your files without these services in Word 2007 by clicking Review > Protect Document > Restrict Formatting and Editing. In Excel 2007, click Review and choose one of the "Protect" options in the Changes area of the ribbon. You can restrict the Word styles that can be used, or password-protect the file, though the user-authentication options once again require IRM/WRMS. You can also assign a password to a file in Word, Excel, and PowerPoint by clicking the Office button, choosing Save As, clicking Tools at the bottom of the Save As dialog box, choosing General Options in the drop-down menu, entering the password, and clicking OK.

Add a password to a file in Word, Excel, or PowerPoint via the Tools button in the Save As dialog box.

Tomorrow: keep your passwords in order, with or without a password manager.

You trust Microsoft Office with your most important documents, spreadsheets, e-mail, and presentations. Unfortunately, many of the default security settings in Office applications may not provide a sufficient level of protection for your data, your system, and your reputation. Follow these steps to fine-tune the security settings in Office 2003; tomorrow I'll cover the new security options in Office 2007's Trust Center and elsewhere.

Office 2003 lets you encrypt files so that you need a password to read or edit them. In Word 2003, open the document and click Tools > Protect Document. To restrict the styles that can be applied to the file, check Limit formatting to a selection of styles, and click Settings. Uncheck the styles you don't want to allow, or choose one of the other style-restriction options, and click OK. To make the document read-only, check Allow only this type of editing in the document, and select one of the options in the drop-down menu: Tracked changes, Comments, Filling in forms, or No changes (Read only).

Choose an option in Word 2003's Protect Document dialog box to restrict access to the document.

You can also designate the people who can access the file by clicking More users, entering their user names or e-mail addresses, and clicking OK. When you're done, click Yes, Start Enforcing Protection. In the resulting dialog box, choose either Password and enter the password twice that will decrypt the file, or select User authentication, which allows the people you designate to remove the file's protection.

The User authentication option requires Microsoft's Information Rights management, which requires the Windows Rights Management client. This in turn requires a .NET Passport account, and your agreement to the "free trial," though there's no indication if or when the trial will end. Microsoft promises to maintain the privacy of your files, and to make them available for three months after the trial ends, if you maintain the .NET Passport account. There may be a good reason to go this route, but to keep things simple, I stick with the password option. To remove these settings, click Tools > Unprotect document, and enter the password (if you chose this method of protection).

Choose Password and enter the password that will open the file, or select User authentication to allow the people you designate to read, edit, and/or comment on the document.

To protect a worksheet or file in Excel 2003, click Tools > Protection, and choose your preferred protection method: Protect Sheet, Allow Users to Edit Ranges, Protect Workbook, or Protect and Share Workbook. If you choose the first option, you're prompted to enter a password to unlock the sheet, and you can limit the actions people can take when working on the sheet. The second selection opens a dialog box in which you can specify the ranges that will be unlocked by a password by clicking New and entering the ranges. You can allow specific people to edit, or list the users who can't edit the range without a password by clicking Permissions and entering their user or group names. The third and fourth options are similar to the first, but apply to the entire workbook rather than a specific worksheet.

In PowerPoint 2003, click Tools > Options > Security, enter a password that will let the presentation be opened or modified, and click the Advanced button to select an encryption type. This dialog box also lets you remove hidden data from the file, and adjust your macro security settings (the default allows only signed macros from trusted sources, though this is of questionable value since "trusted sources" is pretty meaningless).

Outlook 2003's security options let you encrypt outgoing attachments, restrict the sites that can send you scripts and active content (the same list that's in your Internet Options), and limit the receipt of images and file downloads. But two of the most important things you can do to protect yourself from malware in Outlook are to turn off the Reading Pane (aka Preview Pane), and to view your mail as plain text. To deactivate the Reading Pane, click View > Reading Pane > Off. And to switch from HTML mail to the safer plain text, click Tools > Options > E-mail Options, check Read all standard mail in plain text, and click OK. When you want to view a message in its original HTML format, click the beige message bar across the top of the message window and select Display as HTML.

Protect yourself from malicious messages in Outlook 2003 by selecting "Read all standard mail in plain text" in the program's E-mail Options.

Protect your reputation with the Remove Hidden Data tool: Maybe you're one of the many Office users who have suffered the embarrassment of sending someone (or a lot of someones) a file that hadn't had its revisions and comments deleted. To minimize the chances of the public seeing more of your files than you intend, download Microsoft's free Remove Hidden Data tool. (I described this program and four other great Office freebies in an earlier post.)

Tomorrow: get more out of the new security options in Office 2007.

Whenever you move data from Microsoft Excel to its Office mate Word, it seems there's always a compromise involved: If the formatting makes the transition intact, then changing the data either causes problems or simply can't be done. If you can alter the data, either the formatting is a mess, or the resulting Word document is huge. Here are the advantages and disadvantages of the various ways to add Excel data to a Word document, starting with the simplest.

Copy the cells and paste them as a Word table: If your Excel worksheet is formatted simply, and you won't need any of its formulas or functions to be active in the Word file, simply select the cells, press Ctrl-C, open the Word document, and press Ctrl-V to paste it as a Word table. While this is the simplest and most common way to move data between the two apps, it frequently requires that you reformat some cells, rows, or columns to reproduce the worksheet's appearance in Excel. Also, if you want to perform Excel functions in the Word version, you'll have to make the changes in the Excel version and then reinsert the data as a new Word table.

Paste the worksheet as an image: Just as with the method above, you start by selecting the cells you want to add to Word, pressing Ctrl-C to copy them, and opening the target Word file. But instead of pressing Ctrl-V to paste the cells, click the place in the Word document that you want the worksheet to appear, and in Word 2003 click Edit > Paste Special, or in Word 2007 click the Paste button under the Home tab, and choose Paste Special. In both versions, select Picture (Windows Metafile), and click OK. The worksheet appears just as it looked in Excel, but you can't make any changes to the data, though you can move, resize, and otherwise alter the resulting image just as you would any other image in Word.

Choose Paste Special > Picture (Windows Metafile) to place an image of your worksheet in a Word document.

Embed the worksheet in the Word file: At first, this approach would appear to make the most sense, since the result is a fully functioning worksheet in the Word document. Unfortunately, the Word file will be huge and preserving the original formatting can be a problem.

To embed the worksheet, copy it in Excel as described above, click in the Word file where you want the worksheet to appear, and choose Insert > Object > Microsoft Office Excel Worksheet in Word 2003, or click the Insert tab in Word 2007's ribbon, and choose Object > Object > Microsoft Office Excel Worksheet. A blank worksheet will be added to the document, and the Excel toolbar will be visible at the top of the Word window. Press Ctrl-V, click a cell, and press Enter to paste the data into the worksheet. (You'll likely have to resize the columns.)

Click outside the worksheet to view it as a Word table (though without the ability to edit cells). Now you can click inside it once to resize it just as you would any Word object, or double-click anywhere inside the worksheet to reopen it as a worksheet, complete with all formulas and functions operational.

Choose Microsoft Office Excel Worksheet in the Object dialog box in Word 2007 to embed a worksheet in the document.

You can also create an Excel worksheet in Word 2003 by choosing the Insert Microsoft Excel Worksheet button on the standard toolbar in Word 2003, and selecting any number of rows and columns in the small window that pops up (you're limited to four and five, respectively, but more will be added as needed when you paste).

Embed a link to the worksheet: In many ways this is the most elegant option because you edit the worksheet in Excel and have the changes appear in the Word file automatically, and the file-size increase is minimal. The only requirement is that to ensure the data is available, the Excel file must be sent along with the Word document, and the destination PC has to have Excel installed; you can't access the data directly from the Word file.

Copy the worksheet data as described above, and then click inside the target Word document where you want the worksheet to appear. Choose Edit > Paste Special in Word 2003, or click Paste > Paste Special under the Home tab in Word 2007. In both versions, click the Paste link button, choose Microsoft Office Excel Worksheet Object, and click OK. Whenever you change the worksheet in Excel, you can have the modifications added to the Word version by selecting the worksheet in the Word document (after you've saved the Excel version), and pressing F9. You can also alter the worksheet from within Word by double-clicking it, which opens it in Excel. The worksheet will also be updated automatically in Word whenever you open or print the file, and any other time the program updates fields.

You may not be able to tell just by looking that the table is a link rather than embedded. To verify the link in Word 2003, click Edit > Links; in Word 2007, click the Office button, and choose Prepare > Edit Links to Files.

Tomorrow: more speedup tips for Windows XP and Vista.

When you save a file in an Office application, the program opens the Save As dialog box with My Documents (in Office 2003) or Documents (in Office 2007) as the default folder to store it in. If you're saving an image, Windows wants to put it in My Pictures, and it wants to put audio files in My Music and videos in My Videos. (Vista uses the same folder nomenclature, minus the "My".)

You can stick with these if you wish, but I prefer to store my personal files on a USB thumb drive with folders organized by project rather than by file type. That way all the files for a project--regardless of type--are stored in the same place. It's easy to change the default save-as locations in Office and other Windows apps.

Microsoft Word: In Word 2003 and previous versions to 97, click Tools > Options > File Locations, highlight Documents (it may be chosen by default), and click Modify. Navigate to the folder of your choice, and click OK twice. In Word 2007, click the Office button, choose Word Options at the bottom of the window, click Save in the left pane, select Browse to the right of Default file location, browse to the folder of your choice, and click OK twice.

Reset the default file save-as location in Microsoft Word 2007.

Microsoft Excel: For all versions of Excel, start by opening Windows Explorer and navigating to the folder you want to store your worksheets in. Copy the folder path in the Address bar, open Excel, and in Excel 2003, click Tools > Options > General. In Excel 2007, click the Office button, choose Excel Options at the bottom of the window, and select Save in the left pane. In both versions, paste the folder path into the text box to the right of Default file location, and click OK.

Microsoft PowerPoint: As with Excel, start by opening Windows Explorer, selecting the folder you want to store your presentations in, and copying the path in the Address bar. Then open PowerPoint (2003 and earlier versions), click Tools > Options > Save, paste the folder path in the text field below Default file location, and click OK. In PowerPoint 2007, click the Office button, choose PowerPoint Options at the bottom of the window, select Save in the left pane, paste the folder path in the text field to the right of Default file location, and click OK.

I was hoping to find a way to change the default save folder for Microsoft Paint, but I haven't yet found the right Registry key to edit. I'll keep looking and let you know if I find it.

Tomorrow: a utility that lets you uninstall programs that Add/Remove Programs can't get rid of.

Step 1 of Microsoft Excel's Lookup Wizard shows the cell range it will search.

Microsoft Excel can handle data tables with hundreds or even thousands of rows and columns. That's great, unless you're trying to find a specific cell's value, which could have you scrolling up and down, left and right looking for that needle of data in a haystack of cells. If your table is formatted correctly, you can use Excel's Lookup Wizard to display the data in a cell automatically.

To see if you have the Lookup Wizard installed in Excel 2003, click Tools and look for a Lookup option, probably at the bottom of the menu. In Excel 2007, click the Formulas tab and look to the far right for a Lookup option in the Solutions section of the ribbon. If the wizard isn't there, load it in Excel 2003 by clicking Tools > Add-Ins > Lookup Wizard > OK > Yes, or in Excel 2007 by selecting the Office button, and clicking Excel Options > Add-Ins > Lookup Wizard > Go > Lookup Wizard > OK > Yes. You may be asked to insert your Office install CD to complete the installation. When the dialog box closes, you should have a Lookup option on your Tools menu in Excel 2003, or a Lookup button in the Solutions section at the far right under Excel 2007's Formulas tab.

Note that your table can't have any empty cells, and it must have headings. (Additionally, if you use the wizard to find a range of values, the rows must be sorted; see below for more on searching for value ranges.)

Select the column containing the cell data you're looking for in step 2 of the Lookup Wizard.

Choose Copy just the formula to a single cell, and click Next.

To find a cell's data, select the cell range you want to search, including the table headers, and click Tools > Lookup in Excel 2003, or click the aforementioned Lookup button in the Solutions area under the Formulas tab in Excel 2007. In step 1 of the 4-step wizard, verify that the range is correct, and click Next.

Choose the column containing the value you seek in the drop-down menu at the top of the wizard's second step, and note the value in the row field at the bottom of the dialog box, but don't change it. Click Next to move on to step 3. Choose Copy just the formula to a single cell, and click Next to open the fourth and last step of the wizard. Now click inside the empty text field of the last dialog box, then click the cell in the worksheet you want the data you're searching for to appear in, and choose Finish.

Click in the cell you want the data you're searching for to appear, and choose Finish.

Back in your worksheet, select the cell containing the new formula, and change the formula value you noted in step 3 to the row containing the data you're looking for. To display the value of another row in that column, simply change the value again. In my music library example, I first searched for the value "Bessie" to show the number of songs recorded by Bessie Smith, and then I changed that value to "Emmylou" to display the number of songs in my library recorded by Emmylou Harris.

You now have a mini-worksheet search engine, but there's more you can do with the wizard, such as using it to find a range of cell values, or to display the values of two cells that are related in some way (by selecting the Copy the formula and lookup values option in step 3 of the wizard). I'll describe other lookup tricks in a future post.

Tomorrow: super productivity-enhancing Firefox extensions.

Microsoft Office is so jam-packed with features that an entire industry has been created to help people find the ones they need. (An example is Addintools' $30 Classic Menu for Office 2007.) Why would anyone suggest that you add even more functions to Office apps? Because the best free Office add-ins can save you considerable time and trouble, without costing you a red cent. Here are five of my favorite Office helpers.

Poll attendees to find the best time for a meeting
Everybody's busy, as anyone who has ever tried to schedule a meeting with more than two attendees quickly learns. TimeBridge Personal Scheduling Manager is an Outlook add-in that lets you send e-mails to the attendees with as many as five proposed meeting times. They select the times they're available or not, and they can even mark one of the times as "best." Once all the people respond, the program sends you and the attendees an e-mail suggesting the best time, which it adds to your Outlook calendar. The program places a toolbar in Outlook 2003 and 2007, from which you can create a new meeting, view your scheduled meetings, and edit your account settings.

Propose as many as five different meeting times and let TimeBridge Personal Scheduling Manager poll attendees find the best one.

You have to register (name, e-mail address, and time zone) to send meeting invitations, but attendees need not sign up, though they can invite others, and add the meeting to their Outlook or Google Calendar. You can also network your calendars to see who's available when prior to scheduling the meeting.

View the responses of meeting attendees by clicking a link in the TimeBridge Outlook toolbar.

Keep people from viewing the data hidden in Office docs
You may be sharing more information than you intend to when you send someone a Word document, Excel worksheet, or PowerPoint presentation. If two or more people have worked on the file, there's a good chance that anyone who opens the file subsequently can view insertions and--more importantly--deletions made by each person, as well as any comments they may have made, and other personal information relating to the file's creator. Microsoft's Remove Hidden Data program for Office 2003 and XP will remove such data in a file before you share it. (See below for a description of Office 2007's built-in Document Inspector, which functions similarly.)

After you download and install the program (and after Microsoft "validates" your copy of Office), you'll find a Remove Hidden Data option on the File menu of your Office apps. You can also remove the hidden information from several files at once by running the program separately. Among the information the program removes are comments, revision marks, deleted text, user names, and macros.

Office 2007 adds the Document Inspector that cleanses Word 2007, Excel 2007, and PowerPoint 2007 of revisions, versions, presentation notes, hidden rows and columns, and other metadata, including personally identifiable information. To activate this feature, click the Office button and choose Prepare>Inspect Document>Inspect. After it runs, select Remove All as necessary.

Keep your secrets by running Office 2007's Document Inspector before sharing your files.

Teach Excel some new tricks with ExTools
If you could create your own Excel toolbar, it would probably include a list of your favorite worksheets, a super-clipboard for storing text you reuse frequently, and the ability to save and back up a worksheet with one click. It may also let you switch a vertical range to horizontal (and vice versa) with a single click, reverse the order of a row of cells just as quickly, and save a selection as an Excel, text, HTML, or comma-delimited (CSV) file. You get all these features and more with ExTools, and its partner for Office 2007, ExTools RX.

I counted 67 different features, though more are being added all the time. While technically free, ExTools is officially donationware; the developer requests a donation of $5 or more, so if you find it useful, drop a few dollars in the e-hat to help ensure that the features keep on coming.

YouTube comes to PowerPoint
No matter how many fancy transitions, jumping graphics, animated lines of text, or "borrowed" comic strips you add to your PowerPoint slides, your audience will be sawing logs unless you provide them with content that matters. Shyam Pillai's YouTube Video Wizard lets you insert a YouTube video in any version of PowerPoint from 97 to 2007 with just a few clicks. After you download and install the program, just click Insert>YouTube video, insert the video's URL, choose to play it once or loop it, set the size and placement of the playback window in the slide, and then run your presentation. The video will be embedded in a slide, complete with Flash control. You must have a working Internet connection to run the video, and there's not much you can do to embellish the slides they appear on, but now you can let lonelygirl15 help you get your message across.

Send text messages from Outlook
If you use Outlook 2003 or 2007 and you're having a hard time keeping track of your text messages, why not let the program manage your SMS correspondence for you? The Microsoft Office SMS Add-in lets you treat each message like an e-mail: save drafts, view all sent items, forward them as e-mail or SMS, even spell-check messages before you send them. There are some restrictions, however: you can send messages to any phone on a GSM network, but you can't retrieve messages from the phone, and the program does not support Flash SMS or the Multimedia Messaging Service (MMS).

Tomorrow: For bullet-fast app launches, skip the menu and go straight to the command prompt.