can the hosts file be changed to, or amended by, another file? IOW can there be a file named xyz that essentially replaces the hosts file, or adds entries to it?
Possibly by a registry key or configuration setting? Of course it could by altering library fxns, but by other "simpler" means?
I ask this with the interest/intent of thoroughly checking systems that have been recovered from an malware infection.
Thanks
Mike
i do believe that any file can be changed by a craftily written program.
even if a file has been set to read-only, the attributes can be changed. especially a file that has a known name and fixed location on any system.
more details please?
mickey,
hey, thanks for the response, but that not what I meant (my explanation is poorly worded)
like is there a reg key (for instance) that might hold the value "Hosts" which a evil proggie might change to "xyz" or "Hosts, xyz" for a CRUDE example - and ignoring the path in my example
mike
Thank you LogicEarth
Hi, Mike.
WinPatrol is one of my favorite programs. Among many other features, WinPatrol has a feature to monitor/edit the HOSTS file. From WinPatrol Features: Options
"Warn if changes are made to my Internet HOSTS file"
The HOSTS file is like a local road map to the internet. When you enter in a web address like BillP Studios - WinPatrol, the request is first sent out to a special internet server (known as a DNS server) that converts the web address into the numerical IP address like 217.146.53.2, which is the actual address for the web site you're visiting. You are then connected via that IP address to the web site. A HOSTS file simply speeds up the process by storing matched pairs of web addresses and their IP address equivalents so that your web browser can skip requesting the actual IP address from a DNS server.
Malicious programs have been known to use bogus entries in the HOSTS file to misdirect web surfers to sites to potentially dangerous, unwanted web sites. These malicious programs might add a known web address like Google but assign it the numerical IP address of an advertiser or even a more dangerous site. When you type in Google to your browser, you end up going to an unwanted, unexpected web site instead of where you wanted to go.
WinPatrol can monitor your HOSTS file and warn you when changes are made. You can also check your HOSTS file by clicking the View HOSTS file... button. By default the only entry you should see in your hosts file is:127.0.0.1 Localhost
Quote