April 6 2007 COOLSITES newsletter by Mark Donaldson

luem42 · Joined: Aug 02, 2003 Posts: 260

I have published the April 6 2007 COOLSITES newsletter by Mark Donaldson.

The following is an excerpt from this weeks newsletter. To see the full newsletter with all of the COOLSITES links please go to my website at: http://luem42.com Thank you. Mark.

April 6 2007 COOLSITES by Mark Donaldson Issue 107

Collect them. Trade them. Wrap fish with them. But for your sake read them.

Wherever you go if you see the user name LUEM42 that's me

COOLSITES is a list of safe, fun, useful, informative and just plain cool websites and programs that are FREE, FREE and FREE. All of the programs and websites I list are free. If I list anything that is so good but isn't free I will list the price with it.

--------------------------------------------------------------------------------

Pirillo's Picks for February 13 2007

"And if you think that's a lot of links, you should see how many http://luem42.com/ collects every day. It's enough to make you wanna never leave the house again as long as you live" Yours Digitally, Chris Pirillo http://chris.pirillo.com/

--------------------------------------------------------------------------------

Clif Notes Newsletter, Feb 2007 http://freewarewiki.com/ClifNotes

"The COOLSITES Newsletter - find the coolest links here. This fella named Mark Donaldson has been sending out his lists of cool sites since 2003. I'd never heard of him before last week. One day I was Googling myself to see who was posting links to my newsletter, and I found his website. I guess he's mentioned my newsletter at least 3 times. I like the COOLSITES website too, but I think it could use some reformatting to make it a bit easier to read. What I really like is the content there. Mark must really read a lot of stuff on the web and he takes the best links then tells you about them ." http://freewarewiki.com/CoolSitesNewsletter

Welcome to Clif Notes Newsletter April 1, 2007 ClifNotesNewsletter070401: http://freewarewiki.com/ClifNotesNewsletter070401

"Thanks for reading my newsletter. Each week, I will have freeware reviews, tips, tricks, news, and lots of cool websites for you to check out.

I hope you enjoy this week's letter. Be sure to write me for advice or yell at me for messing up.

# REVIEWS
1. Ditto - clipboard extender from SourceForge
2. The File Research Center - another good source to keep your PC lean
3. PCTools Firewall Plus - a free firewall, is it right for you?
4. Play DVD - freeware DVD player
5. OETool - an Outlook Express addon
6. Universal Extractor - don't want to install it, then extract it
7. Abiword - forget WordPad, use a Portable App
8. Old Newsletter

# TIPS AND FEEDBACK
1. How to burn ISO files
2. Impossible Feat - Remove a cork from inside a wine bottle?
3. Yahoo Mail - no more storage limits
4. Windows One Care fails to live up to it's name
5. Comments last week

# COOL WEBSITES
1. CoolSites Newsletter this week
2. ChampsGames.com - play free games on your pages
3. Websites I've visited recently"

--------------------------------------------------------------------------------

Security News: All about the new ANI exploit

"Websense Security Labsâ„¢ is actively tracking more than 100 websites that are spreading the ANI "zero-day" exploit. Proof-of-concept (POC) attack code is also now available, and we expect additional attacks to surface. Currently the majority of the attacks appear to be downloading and installing generic password stealing code. Also, as represented in the below graphs, most sites are hosted in China. Interestingly the most popular domain space being used is .com. Due to the fact that POC code is now downloadable on the web, there is no patch from Microsoft, and the fact that some of the attackers we are tracking have infected hundreds of sites on the web, we believe that exploits will continue to surface and the numbers will get larger. Reports out of China also indicate that a worm is now propagating using the exploit code: http://www.cisrt.org/enblog/read.php?68. We are scanning the web and providing pre-emptive blocking for all security customers of Websense and recommend that customers block all uncategorized websites with the .exe filter extension due to the fact that most exploits simply download a .exe from the same site the exploit is being served from. Graphs available within full alert. For additional details and information on how to detect and prevent this type of attack: " http://www.websensesecuritylabs.com/alerts/alert.php?AlertID=763

After posting to this page:

Serious Vulnerability Affects All Recent Windows Versions - usrbingeek-s musings: http://www.lockergnome.com/nexus/usrbingeek/2007/03/30/serious-vulnera...ity-aff

I have found conflicting info that the ANI exploit does affect all versions of Windows. At this time I do not know whether it affects 98/ME even though Websence, USCERT and Microsoft don't mention 98/ME as if no one is supposed to be still using those versions. The zert.isotf.org has info that it does, a patch and a test page to see if your system is vulnerable. http://zert.isotf.org/advisories/zert-2007-01.htm however the test page says that even if it tests OK you may still be vulnerable. Mark.

Malicious Windows animated cursor temporary patch: http://research.eeye.com/html/alerts/zeroday/20070328.html

Microsoft Corp. will patch the Windows animated cursor vulnerability Tuesday, 4-3-7, a week early: http://www.computerworld.com/action/article.do?command=viewArticleBasi...mp;arti but if you use 98/ME Windows Update will not apply this update for you. Just another example of Microsoft's OS discrimination against 70 million 98/ME users worldwide. Maybe we should start a class action lawsuit. Mark.

"Websense Security Labs(TM) has discovered a large email spam run that includes links to sites that are hosting ANI exploit code. Users receive an email with the subject line "Hot Pictures of Britiney Speers" that is written in HTML and has anti-spam avoidance text within the HTML comments. Users who click on the links are redirected to one of several websites that we are tracking. The sites contain obfuscated JavaScript. The decoded JavaScript sends all users to the same website, which is hosting the exploit code. When users connect, a file is downloaded and installed without any end-user interaction. The file is called 200.exe with the MD5 of b017cae51e4498c309690b8936f2fa79. The binary file appears to be a new variant of a file infector with operating system hooks and spamming capabilities. A more complete analysis will soon appear on our blog. The main server that hosts the exploit code is hosted in Russia and has been used by groups that have installed rootkits, password stealing Trojans, and other nefarious code in the past. For additional details and information on how to detect and prevent this type of attack:" http://www.websensesecuritylabs.com/alerts/alert.php?AlertID=764

Microsoft Security Bulletin MS07-017- Vulnerabilities in GDI Could Allow Remote Code Execution (925902): http://www.microsoft.com/technet/security/bulletin/ms07-017.mspx

ANI Exploit. Firefox also vulnerable to Windows cursor exploit, says bug's finder: http://www.computerworld.com/action/article.do?command=viewArticleBasi...mp;arti It uses the same flawed component to process .ani files as IE

--------------------------------------------------------------------------------

Security Links

ANI Exploit. Firefox also vulnerable to Windows cursor exploit, says bug's finder: http://www.computerworld.com/action/article.do?command=viewArticleBasi...mp;arti

Enigma for Consumers- What Mystery Shopping Jobs. FTC Charges Defendants Misrepresented Available Jobs, Potential Income: http://www.ftc.gov/opa/2007/03/mysteryshop.htm

Keep your kids safe online: http://ct.cnet-ssa.cnet.com/clicks?t=36446599-be56918137808c8d29d61779...633af-b

Malicious Windows animated cursor temporary patch: http://research.eeye.com/html/alerts/zeroday/20070328.html

Microsoft Corp. will patch the increasingly dangerous Windows animated cursor vulnerability tomorrow, 4-3-7, a week early: http://www.computerworld.com/action/article.do?command=viewArticleBasi...mp;arti

Microsoft Security Bulletin MS07-017- Vulnerabilities in GDI Could Allow Remote Code Execution (925902): http://www.microsoft.com/technet/security/bulletin/ms07-017.mspx

New. Anti Keylogger Shield is a powerful, easy to use anti-spy software tool that prohibits operation of any keylogger: http://www.amictools.com/v-anti_keylogger_shield.html

Norman Malware Cleaner is a Norman program utility that may be used to detect and remove specific malicious software: http://www.norman.com/Virus/Virus_removal_tools/en

PhishGuard Anti-Phishing System: http://www.phishguard.com/

Update. Comodo AntiVirus 2.0.11.43 Beta Free AntiVirus Download for Virus Scan with Comodo AntiVirusâ„¢ Software: http://www.antivirus.comodo.com/

Update. CryptoExpert 2007 Lite 7.0.0 Free on the fly hard drives encryption software with Password authentication.: http://www.secureaction.com/cryptoexpert/lite/

Update. FileASSASSIN 1.05 by Malwarebytes.org: http://www.malwarebytes.org/fileassassin.php

Update. RemoveIT Pro v4 - SE 4.4.2007 Antivirus Software - Remove Spyware and Adware with RemoveIT Pro: http://incodesolutions.com/

Update. Spyware Terminator 1.8.5.986 Spyware & Adware Real-Time Protection: http://www.spywareterminator.com/

Updated 03-19-07 Blocking Unwanted Parasites with a Hosts File: http://www.mvps.org/winhelp2002/hosts.htm

ZERT2007-01 Advisory ANI exploit all versions of Windows: http://zert.isotf.org/advisories/zert-2007-01.htm

--------------------------------------------------------------------------------

It's convenient

Google's gmail is the best webmail service I have ever used. Gmail has limits to prevent abuse and for several weeks now I have been using a trick to violate those limits when sending out my newsletter. No longer. I have opened another Gmail account. Some of you will receive my newsletter from the old address luem42 at gmail dot com and some will receive it from the new address luem42coolsites at gmail dot com. There are other ways I could send out the newsletter but this is the most convenient right now. Mark.

--------------------------------------------------------------------------------

COOLSITES 123 cool links

I harvest what I believe to be the best links from the best sources that are safe, fun, informative, useful and just plain cool. I categorize them and edit their descriptions for clarity.

To see the full newsletter with all of the COOLSITES links please go to my website at: http://luem42.com Thank you. Mark.