full-disclosure - Windows hosts file changing.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <025501c3988b$532dc350$6400a8c0@WITT>
From: vosipov at tpg.com.au (V.O.)
Subject: Windows hosts file changing.

It's some homegrown filter set up by one

Evanchik, Michael mcbain@....com
High Power Marketing LLC
37 Ranson street
stamford, ct 06902
US
2035709385

on both of his domains - alanpickel.com and high-pow-er.com

Dont tell me you cannot use whois :)

Received: from LAW-MAIN.AlanPickel.com (mail.high-pow-er.com
[205.179.82.194])
 by mail1.tpgi.com.au (8.11.6/8.11.6) with ESMTP id h9MAUX017421
 for <vosipov@....com.au>; Wed, 22 Oct 2003 20:30:34 +1000
Received: from sir ([192.168.2.103]) by LAW-MAIN.AlanPickel.com with
Microsoft SMTPSVC(6.0.3790.0);
  Wed, 22 Oct 2003 06:36:35 -0400
From: "MailorDeamon@...eply.com" <MailorDeamon@...eply.com>
Subject: Mail undeliverable and filtered


----- Original Message ----- 
From: "Poof" <gui@...dessmoon.org>
To: <Full-Disclosure@...ts.netsys.com>
Sent: Wednesday, October 22, 2003 7:47 PM
Subject: RE: [Full-Disclosure] Windows hosts file changing.


> (Sending from the right email addy now)
>
> Anyhow... I just didn't expect it?
>
> And... What the HECK is with these bounces? -_- Can't people subscribe to
FD
> on email accounts that aren't secured to hell? Gets quite annoying. =/
>
> (Bounce message I just got:)
> Your mail to full-disclosure@...ts.netsys.com; was filtered because of the
> potential spam or virus keyword  [boobs]
>
> please contact the user by fax or telephone thank you.
>
> For this email filter system and other powerful software visit
> http://software.high-pow-er.com
>
> Meh. Doesn't even give me the person it's happening on. Nice software!
>
> > -----Original Message-----
> > From: gregh [mailto:chows@...mail.com.au]
> > Sent: Wednesday, October 22, 2003 2:44 AM
> > To: Kevin Gerry; Full-Disclosure@...ts.netsys.com
> > Subject: Re: [Full-Disclosure] Windows hosts file changing.
> >
> >
> > ----- Original Message -----
> > From: "Kevin Gerry" <poof1@....net>
> > To: <Full-Disclosure@...ts.netsys.com>
> > Sent: Wednesday, October 22, 2003 6:01 PM
> > Subject: [Full-Disclosure] Windows hosts file changing.
> >
> >
> > > Does -ANYBODY- know how it occurs?
> > >
> > > I've had this happen to a couple boxes of mine now...
> > >
> > > New one:
> > > --
> > > 127.0.0.1 localhost
> > > 66.40.16.131 livesexlist.com
> > > 66.40.16.131 lanasbigboobs.com
> > > 66.40.16.131 thumbnailpost.com
> > > 66.40.16.131 adult-series.com
> > > 66.40.16.131 www.livesexlist.com
> > > 66.40.16.131 www.lanasbigboobs.com
> > > 66.40.16.131 www.thumbnailpost.com
> > > 66.40.16.131 www.adult-series.com
> > > --
> > >
> > > Any idea how the search site is replacing that? =/ It's starting to
piss
> > me
> > > off =/ I had some custom information in there that's now overwritten
> > (Not
> > > backed up)
> > >
> >
> >
> > Not to answer your question directly but ask another - why don't you
just
> > set your hosts file to what you want and then just lock it so it cant
ever
> > be hijacked again? Easy to do even with Windows.
> >
> > Regards, Greg.
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>