Re: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread gregh

- Original Message - 
From: "Kevin Gerry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, October 22, 2003 6:01 PM
Subject: [Full-Disclosure] Windows hosts file changing.


> Does -ANYBODY- know how it occurs?
>
> I've had this happen to a couple boxes of mine now...
>
> New one:
> --
> 127.0.0.1 localhost
> 66.40.16.131 livesexlist.com
> 66.40.16.131 lanasbigboobs.com
> 66.40.16.131 thumbnailpost.com
> 66.40.16.131 adult-series.com
> 66.40.16.131 www.livesexlist.com
> 66.40.16.131 www.lanasbigboobs.com
> 66.40.16.131 www.thumbnailpost.com
> 66.40.16.131 www.adult-series.com
> --
>
> Any idea how the search site is replacing that? =/ It's starting to piss
me
> off =/ I had some custom information in there that's now overwritten (Not
> backed up)
>


Not to answer your question directly but ask another - why don't you just
set your hosts file to what you want and then just lock it so it cant ever
be hijacked again? Easy to do even with Windows.

Regards, Greg.


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread V.O.
spyware... brought in by kazaa or something similar :)

http://www.google.com.au/search?q=66.40.16.131+thumbnailpost.com&ie=UTF-8&oe=UTF-8&hl=en&btnG=Google+Search&meta=

check this - http://miataru.computing.net/security/wwwboard/forum/6491.html

dont download illegal files :)))
and install a virus scanner, or at least AdAware

- Original Message - 
From: "Kevin Gerry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, October 22, 2003 6:01 PM
Subject: [Full-Disclosure] Windows hosts file changing.


> Does -ANYBODY- know how it occurs?
>
> I've had this happen to a couple boxes of mine now...
>
> New one:
> --
> 127.0.0.1 localhost
> 66.40.16.131 livesexlist.com
> 66.40.16.131 lanasbigboobs.com
> 66.40.16.131 thumbnailpost.com
> 66.40.16.131 adult-series.com
> 66.40.16.131 www.livesexlist.com
> 66.40.16.131 www.lanasbigboobs.com
> 66.40.16.131 www.thumbnailpost.com
> 66.40.16.131 www.adult-series.com
> --
>
> Any idea how the search site is replacing that? =/ It's starting to piss
me
> off =/ I had some custom information in there that's now overwritten (Not
> backed up)
>
> Thanks =/
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread Poof
(Sending from the right email addy now)

Anyhow... I just didn't expect it?

And... What the HECK is with these bounces? -_- Can't people subscribe to FD
on email accounts that aren't secured to hell? Gets quite annoying. =/

(Bounce message I just got:)
Your mail to [EMAIL PROTECTED]; was filtered because of the
potential spam or virus keyword  [boobs]

please contact the user by fax or telephone thank you.

For this email filter system and other powerful software visit
http://software.high-pow-er.com

Meh. Doesn't even give me the person it's happening on. Nice software!

> -Original Message-
> From: gregh [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, October 22, 2003 2:44 AM
> To: Kevin Gerry; [EMAIL PROTECTED]
> Subject: Re: [Full-Disclosure] Windows hosts file changing.
> 
> 
> - Original Message -
> From: "Kevin Gerry" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Wednesday, October 22, 2003 6:01 PM
> Subject: [Full-Disclosure] Windows hosts file changing.
> 
> 
> > Does -ANYBODY- know how it occurs?
> >
> > I've had this happen to a couple boxes of mine now...
> >
> > New one:
> > --
> > 127.0.0.1 localhost
> > 66.40.16.131 livesexlist.com
> > 66.40.16.131 lanasbigboobs.com
> > 66.40.16.131 thumbnailpost.com
> > 66.40.16.131 adult-series.com
> > 66.40.16.131 www.livesexlist.com
> > 66.40.16.131 www.lanasbigboobs.com
> > 66.40.16.131 www.thumbnailpost.com
> > 66.40.16.131 www.adult-series.com
> > --
> >
> > Any idea how the search site is replacing that? =/ It's starting to piss
> me
> > off =/ I had some custom information in there that's now overwritten
> (Not
> > backed up)
> >
> 
> 
> Not to answer your question directly but ask another - why don't you just
> set your hosts file to what you want and then just lock it so it cant ever
> be hijacked again? Easy to do even with Windows.
> 
> Regards, Greg.


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread Poof
Hate to say...

But no filesharing software is installed on this computer. And only legal
software is installed.

So... Nice try? =p

Also, AdAware is installed. Along with an up to date virus scanner. Plus all
email is scanned before it enters. (Up to date too).

AdAware was run BEFORE the hosts file changed. Without any spyware found.
And -AFTER- it was changed. Without any mention of any spyware (It was
updated both times)

So... Hrm? =/

> -Original Message-
> From: V.O. [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, October 22, 2003 3:06 AM
> To: Kevin Gerry; [EMAIL PROTECTED]
> Subject: Re: [Full-Disclosure] Windows hosts file changing.
> 
> spyware... brought in by kazaa or something similar :)
> 
> http://www.google.com.au/search?q=66.40.16.131+thumbnailpost.com&ie=UTF-
> 8&oe=UTF-8&hl=en&btnG=Google+Search&meta=
> 
> check this -
> http://miataru.computing.net/security/wwwboard/forum/6491.html
> 
> dont download illegal files :)))
> and install a virus scanner, or at least AdAware
> 
> - Original Message -
> From: "Kevin Gerry" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Wednesday, October 22, 2003 6:01 PM
> Subject: [Full-Disclosure] Windows hosts file changing.
> 
> 
> > Does -ANYBODY- know how it occurs?
> >
> > I've had this happen to a couple boxes of mine now...
> >
> > New one:
> > --
> > 127.0.0.1 localhost
> > 66.40.16.131 livesexlist.com
> > 66.40.16.131 lanasbigboobs.com
> > 66.40.16.131 thumbnailpost.com
> > 66.40.16.131 adult-series.com
> > 66.40.16.131 www.livesexlist.com
> > 66.40.16.131 www.lanasbigboobs.com
> > 66.40.16.131 www.thumbnailpost.com
> > 66.40.16.131 www.adult-series.com
> > --
> >
> > Any idea how the search site is replacing that? =/ It's starting to piss
> me
> > off =/ I had some custom information in there that's now overwritten
> (Not
> > backed up)
> >
> > Thanks =/
> >
> > ___
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.netsys.com/full-disclosure-charter.html
> >
> >

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread Bjørnar Bjørgum Larsen
Install and run Spybot Search & Destroy from http://security.kolla.de/. It's the best 
remover I've seen, with a much broader scope than ad-aware. Spybot locks your hosts 
file if you ask. ;)


:) Bjørnar

-How smart can the user be if he trusts Windows? 

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread V.O.
It's some homegrown filter set up by one

Evanchik, Michael [EMAIL PROTECTED]
High Power Marketing LLC
37 Ranson street
stamford, ct 06902
US
2035709385

on both of his domains - alanpickel.com and high-pow-er.com

Dont tell me you cannot use whois :)

Received: from LAW-MAIN.AlanPickel.com (mail.high-pow-er.com
[205.179.82.194])
 by mail1.tpgi.com.au (8.11.6/8.11.6) with ESMTP id h9MAUX017421
 for <[EMAIL PROTECTED]>; Wed, 22 Oct 2003 20:30:34 +1000
Received: from sir ([192.168.2.103]) by LAW-MAIN.AlanPickel.com with
Microsoft SMTPSVC(6.0.3790.0);
  Wed, 22 Oct 2003 06:36:35 -0400
From: "[EMAIL PROTECTED]" <[EMAIL PROTECTED]>
Subject: Mail undeliverable and filtered


- Original Message - 
From: "Poof" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, October 22, 2003 7:47 PM
Subject: RE: [Full-Disclosure] Windows hosts file changing.


> (Sending from the right email addy now)
>
> Anyhow... I just didn't expect it?
>
> And... What the HECK is with these bounces? -_- Can't people subscribe to
FD
> on email accounts that aren't secured to hell? Gets quite annoying. =/
>
> (Bounce message I just got:)
> Your mail to [EMAIL PROTECTED]; was filtered because of the
> potential spam or virus keyword  [boobs]
>
> please contact the user by fax or telephone thank you.
>
> For this email filter system and other powerful software visit
> http://software.high-pow-er.com
>
> Meh. Doesn't even give me the person it's happening on. Nice software!
>
> > -Original Message-
> > From: gregh [mailto:[EMAIL PROTECTED]
> > Sent: Wednesday, October 22, 2003 2:44 AM
> > To: Kevin Gerry; [EMAIL PROTECTED]
> > Subject: Re: [Full-Disclosure] Windows hosts file changing.
> >
> >
> > - Original Message -
> > From: "Kevin Gerry" <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Sent: Wednesday, October 22, 2003 6:01 PM
> > Subject: [Full-Disclosure] Windows hosts file changing.
> >
> >
> > > Does -ANYBODY- know how it occurs?
> > >
> > > I've had this happen to a couple boxes of mine now...
> > >
> > > New one:
> > > --
> > > 127.0.0.1 localhost
> > > 66.40.16.131 livesexlist.com
> > > 66.40.16.131 lanasbigboobs.com
> > > 66.40.16.131 thumbnailpost.com
> > > 66.40.16.131 adult-series.com
> > > 66.40.16.131 www.livesexlist.com
> > > 66.40.16.131 www.lanasbigboobs.com
> > > 66.40.16.131 www.thumbnailpost.com
> > > 66.40.16.131 www.adult-series.com
> > > --
> > >
> > > Any idea how the search site is replacing that? =/ It's starting to
piss
> > me
> > > off =/ I had some custom information in there that's now overwritten
> > (Not
> > > backed up)
> > >
> >
> >
> > Not to answer your question directly but ask another - why don't you
just
> > set your hosts file to what you want and then just lock it so it cant
ever
> > be hijacked again? Easy to do even with Windows.
> >
> > Regards, Greg.
>
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread Joshua Levitsky
- Original Message - 
From: "Kevin Gerry" <[EMAIL PROTECTED]>
Sent: Wednesday, October 22, 2003 4:01 AM
Subject: [Full-Disclosure] Windows hosts file changing.


> Does -ANYBODY- know how it occurs?
>
> I've had this happen to a couple boxes of mine now...
>
> New one:
> --
> 127.0.0.1 localhost
> 66.40.16.131 livesexlist.com
> 66.40.16.131 lanasbigboobs.com
> 66.40.16.131 thumbnailpost.com

Perhaps a variant of the QHosts virus which just exploits an IE
vulnerability. Perhaps not even a "virus" per say. (It's kind of sketchy
anyways to call Qhosts a virus.) Perhaps a user got an email and clicked on
the URL and it sent them to a site that took advantage of their IE not being
patched.

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html

http://vil.nai.com/vil/content/v_100719.htm

The MS03-040 patch addresses this type of attack on a system.

-Josh

--
Joshua Levitsky, MCSE, CISSP
System Engineer
Time Inc. Information Technology
[5957 F27C 9C71 E9A7 274A 0447 C9B9 75A4 9B41 D4D1]

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread gregh

- Original Message - 
From: "Poof" <[EMAIL PROTECTED]>
To: "'V.O.'" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>
Sent: Wednesday, October 22, 2003 8:10 PM
Subject: RE: [Full-Disclosure] Windows hosts file changing.


> Hate to say...
>
> But no filesharing software is installed on this computer. And only legal
> software is installed.
>
> So... Nice try? =p
>
> Also, AdAware is installed. Along with an up to date virus scanner. Plus
all
> email is scanned before it enters. (Up to date too).
>
> AdAware was run BEFORE the hosts file changed. Without any spyware found.
> And -AFTER- it was changed. Without any mention of any spyware (It was
> updated both times)
>
> So... Hrm? =/
>

Ad-Aware is NOT, unfortunately, successful at getting rid of a lot of things
thought it does identify almost all things. It is also updated more
frequently than Spybot but the best bet is if you identify Registry entries
with Adaware, run Spybot to get rid of them. Adaware WILL get rid of a lot
of them but not all.

Greg.


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread Daniel
> > Does -ANYBODY- know how it occurs?
> >
> > I've had this happen to a couple boxes of mine now...
> >
> > New one:
> > --
> > 127.0.0.1 localhost
> > 66.40.16.131 livesexlist.com
> > 66.40.16.131 lanasbigboobs.com
> > 66.40.16.131 thumbnailpost.com
> > 66.40.16.131 adult-series.com
> > 66.40.16.131 www.livesexlist.com
> > 66.40.16.131 www.lanasbigboobs.com
> > 66.40.16.131 www.thumbnailpost.com
> > 66.40.16.131 www.adult-series.com
> > --


stop looking at pr0n?

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread David Gianndrea
Kind of sounds like this...

http://vil.nai.com/vil/content/v_100719.htm

Kevin Gerry wrote:

Does -ANYBODY- know how it occurs?

I've had this happen to a couple boxes of mine now...

New one:
--
127.0.0.1   localhost
66.40.16.131livesexlist.com
66.40.16.131lanasbigboobs.com
66.40.16.131thumbnailpost.com
66.40.16.131adult-series.com
66.40.16.131www.livesexlist.com
66.40.16.131www.lanasbigboobs.com
66.40.16.131www.thumbnailpost.com
66.40.16.131www.adult-series.com
--
Any idea how the search site is replacing that? =/ It's starting to piss me
off =/ I had some custom information in there that's now overwritten (Not
backed up)
Thanks =/

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
--
David Gianndrea
Senior Network Engineer
Comsquared Systems, Inc.
Email:   [EMAIL PROTECTED]
Web: www.comsquared.com
___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread Mike Tancsa
This sounds like qhosts.

http://vil.nai.com/vil/content/v_100719.htm

---Mike

At 04:01 AM 22/10/2003, Kevin Gerry wrote:
Does -ANYBODY- know how it occurs?

I've had this happen to a couple boxes of mine now...

New one:
--
127.0.0.1   localhost
66.40.16.131livesexlist.com
66.40.16.131lanasbigboobs.com
66.40.16.131thumbnailpost.com
66.40.16.131adult-series.com
66.40.16.131www.livesexlist.com
66.40.16.131www.lanasbigboobs.com
66.40.16.131www.thumbnailpost.com
66.40.16.131www.adult-series.com
--
Any idea how the search site is replacing that? =/ It's starting to piss me
off =/ I had some custom information in there that's now overwritten (Not
backed up)
Thanks =/

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread Austin Ehlers
Why are you browsing the internet on an Administrator account?  The HOSTS
file is only editable by Admin accounts.  Never never never do daily work
from an account with full priveleges, that's what the Power Users' group is
for.  Admin accounts are for maintenance-only (installing and configuring
s/w), not general work.

Austin Ehlers

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Kevin Gerry
> Sent: Wednesday, October 22, 2003 03:01 AM
> To: [EMAIL PROTECTED]
> Subject: [Full-Disclosure] Windows hosts file changing.
>
>
> Does -ANYBODY- know how it occurs?
>
> I've had this happen to a couple boxes of mine now...
>
> New one:
> --
> 127.0.0.1 localhost
> 66.40.16.131  livesexlist.com
> 66.40.16.131  lanasbigboobs.com
> 66.40.16.131  thumbnailpost.com
> 66.40.16.131  adult-series.com
> 66.40.16.131  www.livesexlist.com
> 66.40.16.131  www.lanasbigboobs.com
> 66.40.16.131  www.thumbnailpost.com
> 66.40.16.131  www.adult-series.com
> --
>
> Any idea how the search site is replacing that? =/ It's starting
> to piss me
> off =/ I had some custom information in there that's now overwritten (Not
> backed up)
>
> Thanks =/
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread Brian Eckman


David Gianndrea wrote:
Kind of sounds like this...

http://vil.nai.com/vil/content/v_100719.htm

Kevin Gerry wrote:

Does -ANYBODY- know how it occurs?

I've had this happen to a couple boxes of mine now...

New one:
--
127.0.0.1localhost
66.40.16.131livesexlist.com
66.40.16.131lanasbigboobs.com
66.40.16.131thumbnailpost.com
66.40.16.131adult-series.com
66.40.16.131www.livesexlist.com
66.40.16.131www.lanasbigboobs.com
66.40.16.131www.thumbnailpost.com
66.40.16.131www.adult-series.com
--
Any idea how the search site is replacing that? =/ It's starting to 
piss me
off =/ I had some custom information in there that's now overwritten (Not
backed up)

Thanks =/


Actually, I don't think it sounds a damn thing like Qhosts.

Qhosts modifies DHCP-issued DNS server settings in the registry, and 
creates a new HOSTS file and tweaks the registry to use that HOSTS file. 
It doesn't touch the original HOSTS file.

This post exhibits no Qhosts behavior, and Qhosts doesn't exhibit any
of this behavior. I think Daniel got it right - quit going to porn
sites. Better yet, quit going to porn sites advertised in Spam.
Also, to respond to another comment, the MS03-040 patch might *not* 
address this type of attack on a system. Internet Explorer fully patched 
with default settings *still* allows silent delivery and install of 
executables. POC was sent to this list weeks ago.

Brian
--
Brian Eckman
Security Analyst
OIT Security and Assurance
University of Minnesota
612-626-7737
"There are 10 types of people in this world. Those who
understand binary and those who don't."
___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread Joe Stewart
On Wednesday 22 October 2003 4:01 am, Kevin Gerry wrote:
> Does -ANYBODY- know how it occurs?

This isn't Qhosts. It's a variant of the CoolWebSearch browser hijacker. 
Browsing the contact.htm page on the IP address given quickly reveals 
this site and CoolWebSearch are running the same scam under different 
names. The site's webmaster even has a link to the CWS removal tool and 
a "Don't blame me for trojaning you, blame Microsoft" message.

More info on CoolWebSearch: 
http://www.spywareinfo.com/~merijn/cwschronicles.html

-Joe

-- 
Joe Stewart, GCIH 
Senior Security Researcher
LURHQ http://www.lurhq.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread Exibar
I have seen qhosts act in strange ways.  Qhosts does indeed edit the HOSTS
file, sometimes will add those registry keys but not all.  Sometimes it will
add the reg keys but leave the HOSTS file alone.  I've seen it replace the
real HOSTS file, and I've also seen it add a new HOSTS file into the temp
directory.

  Qhosts doesn't always respond predictably from what I've seen.

  Exibar


- Original Message - 
From: "Brian Eckman" <[EMAIL PROTECTED]>
To: "David Gianndrea" <[EMAIL PROTECTED]>
Cc: "Kevin Gerry" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>
Sent: Wednesday, October 22, 2003 9:50 AM
Subject: Re: [Full-Disclosure] Windows hosts file changing.


>
>
> David Gianndrea wrote:
> > Kind of sounds like this...
> >
> > http://vil.nai.com/vil/content/v_100719.htm
> >
> >
> > Kevin Gerry wrote:
> >
> >> Does -ANYBODY- know how it occurs?
> >>
> >> I've had this happen to a couple boxes of mine now...
> >>
> >> New one:
> >> -- 
> >> 127.0.0.1localhost
> >> 66.40.16.131livesexlist.com
> >> 66.40.16.131lanasbigboobs.com
> >> 66.40.16.131thumbnailpost.com
> >> 66.40.16.131adult-series.com
> >> 66.40.16.131www.livesexlist.com
> >> 66.40.16.131www.lanasbigboobs.com
> >> 66.40.16.131www.thumbnailpost.com
> >> 66.40.16.131www.adult-series.com
> >> -- 
> >>
> >> Any idea how the search site is replacing that? =/ It's starting to
> >> piss me
> >> off =/ I had some custom information in there that's now overwritten
(Not
> >> backed up)
> >>
> >> Thanks =/
>
>
> Actually, I don't think it sounds a damn thing like Qhosts.
>
> Qhosts modifies DHCP-issued DNS server settings in the registry, and
> creates a new HOSTS file and tweaks the registry to use that HOSTS file.
> It doesn't touch the original HOSTS file.
>
> This post exhibits no Qhosts behavior, and Qhosts doesn't exhibit any
> of this behavior. I think Daniel got it right - quit going to porn
> sites. Better yet, quit going to porn sites advertised in Spam.
>
> Also, to respond to another comment, the MS03-040 patch might *not*
> address this type of attack on a system. Internet Explorer fully patched
> with default settings *still* allows silent delivery and install of
> executables. POC was sent to this list weeks ago.
>
> Brian
> -- 
> Brian Eckman
> Security Analyst
> OIT Security and Assurance
> University of Minnesota
> 612-626-7737
>
> "There are 10 types of people in this world. Those who
> understand binary and those who don't."
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] Windows hosts file changing.

2003-10-22 Thread Poof
Well, this isn't my specific computer. So, I have no real control at what
they screw up on it. They just expect me to fix it. -_-

~

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:full-disclosure-
> [EMAIL PROTECTED] On Behalf Of Austin Ehlers
> Sent: Wednesday, October 22, 2003 6:54 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Full-Disclosure] Windows hosts file changing.
> 
> Why are you browsing the internet on an Administrator account?  The HOSTS
> file is only editable by Admin accounts.  Never never never do daily work
> from an account with full priveleges, that's what the Power Users' group
> is
> for.  Admin accounts are for maintenance-only (installing and configuring
> s/w), not general work.
> 
> Austin Ehlers
> 
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] Behalf Of Kevin Gerry
> > Sent: Wednesday, October 22, 2003 03:01 AM
> > To: [EMAIL PROTECTED]
> > Subject: [Full-Disclosure] Windows hosts file changing.
> >
> >
> > Does -ANYBODY- know how it occurs?
> >
> > I've had this happen to a couple boxes of mine now...
> >
> > New one:
> > --
> > 127.0.0.1   localhost
> > 66.40.16.131livesexlist.com
> > 66.40.16.131lanasbigboobs.com
> > 66.40.16.131thumbnailpost.com
> > 66.40.16.131adult-series.com
> > 66.40.16.131www.livesexlist.com
> > 66.40.16.131www.lanasbigboobs.com
> > 66.40.16.131www.thumbnailpost.com
> > 66.40.16.131www.adult-series.com
> > --
> >
> > Any idea how the search site is replacing that? =/ It's starting
> > to piss me
> > off =/ I had some custom information in there that's now overwritten
> (Not
> > backed up)
> >
> > Thanks =/
> >
> > ___
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html