[Full-Disclosure] Windows hosts file changing.
eckman at umn.edu
Wed Oct 22 14:50:59 BST 2003
David Gianndrea wrote:
> Kind of sounds like this...
> Kevin Gerry wrote:
>> Does -ANYBODY- know how it occurs?
>> I've had this happen to a couple boxes of mine now...
>> New one:
>> 127.0.0.1 localhost
>> 22.214.171.124 livesexlist.com
>> 126.96.36.199 lanasbigboobs.com
>> 188.8.131.52 thumbnailpost.com
>> 184.108.40.206 adult-series.com
>> 220.127.116.11 www.livesexlist.com
>> 18.104.22.168 www.lanasbigboobs.com
>> 22.214.171.124 www.thumbnailpost.com
>> 126.96.36.199 www.adult-series.com
>> Any idea how the search site is replacing that? =/ It's starting to
>> piss me
>> off =/ I had some custom information in there that's now overwritten (Not
>> backed up)
>> Thanks =/
Actually, I don't think it sounds a damn thing like Qhosts.
Qhosts modifies DHCP-issued DNS server settings in the registry, and
creates a new HOSTS file and tweaks the registry to use that HOSTS file.
It doesn't touch the original HOSTS file.
This post exhibits no Qhosts behavior, and Qhosts doesn't exhibit any
of this behavior. I think Daniel got it right - quit going to porn
sites. Better yet, quit going to porn sites advertised in Spam.
Also, to respond to another comment, the MS03-040 patch might *not*
address this type of attack on a system. Internet Explorer fully patched
with default settings *still* allows silent delivery and install of
executables. POC was sent to this list weeks ago.
OIT Security and Assurance
University of Minnesota
"There are 10 types of people in this world. Those who
understand binary and those who don't."
Full-Disclosure is hosted and sponsored by Secunia.