| Feedback | Subscribe/Unsubscribe to this Newsletter | Back Issues of this Newsletter | 37211 PC Users Group Home Page

View this page in: | Francais | Deutsch | Italiano | Português | Español



Dave's Diggins 4-26-01

ISSN 1529-1103

Just a few "Golden Nuggets" of info that I've mined from the internet

********************************************************

1) Free software and services
2) Articles
3) Special Security Alert
4) Hardware

----------------------------------------------------------------

1) Free software and services

http://clabs.org/dvorak.htm
http://pcusers.org/pcfree.html
Dvorak Assistant (DVAssist). This is a tray utility that allows you to toggle between QWERTY and Dvorak keyboard layouts. The site also has some Dvorak resources. Dvorak is an alternative keyboard layout that actually increases the speed and ease of typing because the keys are placed so that the the most frequently used letters are logically accessible without a lot of wasted motion. Dvorak is excellent for those who have a disability in either hand. Other features include:

- DVAssist runs on 95, 98, NT 4 & 2000.
- Tray icon displays current layout.
- Double-click tray icon or hotkey to toggle between Dvorak & QWERTY layouts. Great for shared machines.
- Resizeable stay-on-top layout window for both layouts. Dvorak layout includes some color coding to help a beginner Dvorak-er.
- Timeout option to revert layout back to selected default layout after a certain non-typing period.
- Highlight letter in layout window as it's typed.

http://www.zdnet.com/zdhelp/filters/quickstart/guides/0,10606,6013362,00.htm
http://pcusers.org/pcreference.html#resources
ZDNet Virus Prevention Guide.

----------------------------------------------------------------

2) Articles

http://www.pcnineoneone.com/howto/moboid1.html
http://pcusers.org/pctechy.html
A guide on how to identify a motherboard.

http://www.zdnet.com/anchordesk/stories/story/0,10738,2711205,00.html
What makes you think you deserve free Internet anything?

http://www.microsoft.com/windowsme/using/workingefficiently/tips/default.asp
http://pcusers.org/pcreference.html#resources
A whole page full of indexed tips on how to work more efficiently with Windows ME.

----------------------------------------------------------------

3) Special Security Alert

Don't Click on Those E-mail Attachments Until You Read This
By Roger Imai

"A Windows security flaw has been discovered that can disguise potentially destructive executables as harmless TXT files (See the below article). So now we have to be wary of TXT attachments or TXT contents in ZIP files! I downloaded the demo file, and it is indeed a WAV file that looks like a TXT text file. You can see part of the DOS alias in the Properties Sheet. At the DOS prompt, you can see the real long file name. The demo appears in Explorer as TEST.TXT, but its real file name is:

TESTTX~1.{00 35,236 11-08-99 10:43a test.txt.{00020C01-0000-0000-C000-000000000046}

Someone could disguise destructive executables as plain text files, even the icon (although the demo file doesn't attempt to change the default associated program icon.) DCOM (Distributed Component Object Model) which is the core of Windows integration, ActiveX, IE, and Windows Update, all depend on the CLSID keys in the Registry, so this could be a serious situation.

http://www.w2knews.com/index.cfm
This article is from the April 26th, 2001 issue of the Sunbelt W2KnewsT Electronic Newsletter

Another Security Flaw: README.TXT Can Harbor Malignant Code.

You may be aware of Bugnet, they are a supplier of software bug fixes. Well, they exposed a Windows vulnerability that allows nasties to do what ever they like, such as mess with the registry, delete files or even wipe out your hard drive.

The bug was originally demonstrated by security analyst Georgi Guninski (http://www.guninski.com/clsidext.html) and later validated by BugNet engineers. The bug originates in Microsoft's Component Object Model (COM) that is built into all Windows systems since Windows 95. COM objects rely on CLSID to uniquely identify a COM object and instruct the operating system how to execute it. Using the CLSID, dangerous executables and scripts can be disguised as innocent .TXT files.

Double-clicking on an obfuscated file will execute, not as a text file, but in whatever way the original program was written. Ouch! BugNet performed several exploits to ascertain the seriousness of this vulnerability.

"We were able to create an Excel spreadsheet with a built-in startup macro that erases files off of the hard disk," said Eric Bowden, general manager, BugNet. "We created a registry merge file that granted us admin rights on a Windows 2000 domain server. We even selectively destroyed the Windows registry."

"Despite the menacing nature of these files, they each hide innocently behind a harmless file name like README.TXT." BugNet has posted a file which demos the vulnerability (http://www.bugnet.com/lab/ba010419.html).

I went and tried this, and it's true. Until Microsoft creates a patch, the only protection is for the user to vigilantly check files. When browsing files, look at the file icon to make sure that it matches the file type. Beware of any e-mail attachments that reveal the CLSID filename. Don't double-click it until you double-check it."

So right click on those attachments before you double-click and check the properties.

----------------------------------------------------------------

4) Hardware:

http://www.thetechzone.com/display.asp?i=30&p=1
A head to head review of two dual monitor cards, the Matrox G450 Dualhead 32meg AGP video card and the nVidia Geforce2MX 32meg AGP video card. A must read article if you are considering using dual monitors.

http://www.gotapex.com/reviews.php?rev=p4/index.html
A review of the Intel Pentium 4 1.5GHz Processor

http://www.maximumpc.com/content/2001/04/24/12878
A review of the Linksys WAP11 a wireless network router

http://www.systemlogic.net/reviews/hardware/networking/dlink/di711/
A review of the D-Link DI-711 Wireless Home DSL/Cable Router

********************************************************
This newsletter is sponsored by the 37211 PC Users Group. All comments, suggestions or submissions should be sent to david.donoho@pcusers.org. Guidelines for submission of articles are at http://pcusers.org/articlesubmit.html .

The Dave's Diggins newsletter subscription list is not publicly accessible nor is it provided or sold to anyone for any other purpose.

Disclaimer: The tips and other information provided in the Dave's Diggins' newsletter are believed to be accurate, but we cannot and do not guarantee that all the information listed within or linked from, this publication will work on all systems, for all users, at all times. All information herein is offered as-is and without warranty of any kind. Neither the 37211 PC Users Group, nor its officers and contributors are responsible for any loss, injury, or damage, direct or consequential, resulting from application of any information presented here.


Translate this page from  
powered by SYSTRAN Translation Software

Click Here!