full-disclosure - Mystery DNS Changes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <00e301c38aba$573447a0$21c5fea9@inspiron>
From: oconnor123 at sympatico.ca (Mike O'Connor)
Subject: Mystery DNS Changes

I have a somewhat different strain.  Mine displays ads coming from
http://cdn2.adsdk.com, which is an alias for a1906.g.akamai.net .  There
are no registry changes that I can detect, and my DNSs remain unmolested
according to the ipconfig program.  I have looked (particularly in the
WINDOWS\Help directory) but I can find no rogue Hosts file, although
there must be one somewhere to do the google hijacking.

All of which is to say that I think my infection, although related to
the one described on McAfee and in previous posts to this thread, is
distinct from it.