From: Lil' Abner on
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
news:hqlf9e016jk(a)news3.newsguy.com:

> From: "gufus" <stop.nospam.gbbsg(a)shaw.ca>
>
>| Hello, Virus!
>
>| You wrote on Tue, 20 Apr 2010 08:49:39 -0400:
>
> VG>> 2) If you don't do (1), then check the hosts file for tampering.
>
>| I'd set the HOSTS file to READ-ONLY too..
>
> Worthless proposition as it is a waste of time. Any software can
> change the attribute back to Read/Write.

I'm not sure how HOSTMAN works, but it keeps the HOSTS file pretty well
locked up. Explorer doesn't even show the read only attribute as checked,
but if you try to alter it, you can't.

--
--- Everybody has a right to my opinion. ---
From: David Kaye on
"Lil' Abner" <blvstk(a)dogpatch.com> wrote:

>I'm not sure how HOSTMAN works, but it keeps the HOSTS file pretty well
>locked up. Explorer doesn't even show the read only attribute as checked,
>but if you try to alter it, you can't.

Back when I was routinely adding the MSMVP host file to my customer computers
I did not find even a single instance where any subsequent malware changed the
write permissions on the file or added or changed any entries.

In fact, the hosts file idea works so well I'm considering implementing it
again with future customers.

From: David H. Lipman on
From: "Lil' Abner" <blvstk(a)dogpatch.com>

| "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
| news:hqlf9e016jk(a)news3.newsguy.com:

>> From: "gufus" <stop.nospam.gbbsg(a)shaw.ca>

>>| Hello, Virus!

>>| You wrote on Tue, 20 Apr 2010 08:49:39 -0400:

>> VG>> 2) If you don't do (1), then check the hosts file for tampering.

>>| I'd set the HOSTS file to READ-ONLY too..

>> Worthless proposition as it is a waste of time. Any software can
>> change the attribute back to Read/Write.

| I'm not sure how HOSTMAN works, but it keeps the HOSTS file pretty well
| locked up. Explorer doesn't even show the read only attribute as checked,
| but if you try to alter it, you can't.

It holds the etc/hosts file handle open.


--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


From: gufus on
Hello, Erehwon!

You wrote on Tue, 20 Apr 2010 23:29:48 -0500:


E> eliminated problem. What does that indicate about the cause of the
E> problem in the first place and where is 4.2.2.2?
E>

Good question, where is 4.2.2.2

--
With best regards, gufus. E-mail: stop.nospam.gbbsg(a)shaw.ca


From: gufus on
Hello, Erehwon!

You wrote on Tue, 20 Apr 2010 23:29:48 -0500:

E> 2) Hosts file indicates last modified in November. Reviewed anyway and
E> all redirects are to 127.0.0.1.
E>

That should be okay then, 127.0.0.1 is your "localhost" if I'm wrong I'm
sure someone will correct me. I only have basic networking skills.


--
With best regards, gufus. E-mail: stop.nospam.gbbsg(a)shaw.ca