Hi,

Does anyone know how to change the location of the hosts
file on a win2k workstation?? Is there a reg entry??

Any help would great.
Regards,
Ron.

Yes there is but it is contraindicated.

Why would you want to do this ?

The "Qhosts-1" Trojan is an example of malware that does this.

Dave


"forthron" <(E-Mail Removed)> wrote in message
news:056f01c3a8b9$7d5feac0$(E-Mail Removed)...
| Hi,
|
| Does anyone know how to change the location of the hosts
| file on a win2k workstation?? Is there a reg entry??
|
| Any help would great.
| Regards,
| Ron.

We use hosts file instead of DNS. When users login a
batch file runs which is meant to copy an updated hosts
file to the WS from the server. These users only have
user rights so the batch file won't overwrite the hosts
file on the WS. I was thinking an easy solution would be
to change the location of the hosts file to, lets say C:\
where the user would be able to write to.
Know what I mean??


>-----Original Message-----
>Yes there is but it is contraindicated.
>
>Why would you want to do this ?
>
>The "Qhosts-1" Trojan is an example of malware that does
this.
>
>Dave
>
>
>"forthron" <(E-Mail Removed)> wrote in message
>news:056f01c3a8b9$7d5feac0$(E-Mail Removed)...
>| Hi,
>|
>| Does anyone know how to change the location of the hosts
>| file on a win2k workstation?? Is there a reg entry??
>|
>| Any help would great.
>| Regards,
>| Ron.
>
>
>.
>

I sure do. We use KixTart as our NT Domain Script interpreter (http://kixtart.org KixTart
is careWare) and we distribute the hosts file and the other static IP tables in our logon
script. However, we give our "Domain Users" membership in the local "Administrators" group.

I exported the 'DataBasePath' entry. What you see below is the export. The HEX values
represent
%SystemRoot%\System32\drivers\etc

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"DataBasePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,65,00,74,00,63,00,00,00

Dave


<(E-Mail Removed)> wrote in message
news:0b2901c3a8c5$e49f88b0$(E-Mail Removed)...
| We use hosts file instead of DNS. When users login a
| batch file runs which is meant to copy an updated hosts
| file to the WS from the server. These users only have
| user rights so the batch file won't overwrite the hosts
| file on the WS. I was thinking an easy solution would be
| to change the location of the hosts file to, lets say C:\
| where the user would be able to write to.
| Know what I mean??
|
|
| >-----Original Message-----
| >Yes there is but it is contraindicated.
| >
| >Why would you want to do this ?
| >
| >The "Qhosts-1" Trojan is an example of malware that does
| this.
| >
| >Dave
| >
| >
| >"forthron" <(E-Mail Removed)> wrote in message
| >news:056f01c3a8b9$7d5feac0$(E-Mail Removed)...
| >| Hi,
| >|
| >| Does anyone know how to change the location of the hosts
| >| file on a win2k workstation?? Is there a reg entry??
| >|
| >| Any help would great.
| >| Regards,
| >| Ron.
| >
| >
| >.
| >

Thanks Dave. Works like a dream.
All the best,
Ron.


>-----Original Message-----
>I sure do. We use KixTart as our NT Domain Script
interpreter (http://kixtart.org KixTart
>is careWare) and we distribute the hosts file and the
other static IP tables in our logon
>script. However, we give our "Domain Users" membership
in the local "Administrators" group.
>
>I exported the 'DataBasePath' entry. What you see below
is the export. The HEX values
>represent
>%SystemRoot%\System32\drivers\etc
>
>Windows Registry Editor Version 5.00
>
>
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
\Parameters]
>"DataBasePath"=hex
(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6
f,\
>
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33
,00,32,00,5c,00,\
>
64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,65,00,74,00
,63,00,00,00
>
>Dave
>
>
><(E-Mail Removed)> wrote in message
>news:0b2901c3a8c5$e49f88b0$(E-Mail Removed)...
>| We use hosts file instead of DNS. When users login a
>| batch file runs which is meant to copy an updated hosts
>| file to the WS from the server. These users only have
>| user rights so the batch file won't overwrite the hosts
>| file on the WS. I was thinking an easy solution would
be
>| to change the location of the hosts file to, lets say
C:\
>| where the user would be able to write to.
>| Know what I mean??
>|
>|
>| >-----Original Message-----
>| >Yes there is but it is contraindicated.
>| >
>| >Why would you want to do this ?
>| >
>| >The "Qhosts-1" Trojan is an example of malware that
does
>| this.
>| >
>| >Dave
>| >
>| >
>| >"forthron" <(E-Mail Removed)> wrote in message
>| >news:056f01c3a8b9$7d5feac0$(E-Mail Removed)...
>| >| Hi,
>| >|
>| >| Does anyone know how to change the location of the
hosts
>| >| file on a win2k workstation?? Is there a reg entry??
>| >|
>| >| Any help would great.
>| >| Regards,
>| >| Ron.
>| >
>| >
>| >.
>| >
>
>
>.
>

We don't even bother doing it from the login scripts. (our users are not in
the admin group and never will be). ;-)
We use a batch run as a task on the server to update the hosts every night.
It keeps a log of which machines did and did not get a new file.
If we add a new server or want the hosts updated ASAP, either myself or any
other admin simply types "updatehost" at the run command which runs another
batch and updates every machine in the domain. Works like a charm.

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:(E-Mail Removed)...
> I sure do. We use KixTart as our NT Domain Script interpreter
(http://kixtart.org KixTart
> is careWare) and we distribute the hosts file and the other static IP
tables in our logon
> script. However, we give our "Domain Users" membership in the local
"Administrators" group.
>
> I exported the 'DataBasePath' entry. What you see below is the export.
The HEX values
> represent
> %SystemRoot%\System32\drivers\etc
>
> Windows Registry Editor Version 5.00
>
> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
>
"DataBasePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,
6f,\
>
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
> 64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,65,00,74,00,63,00,00,00
>
> Dave
>
>
> <(E-Mail Removed)> wrote in message
> news:0b2901c3a8c5$e49f88b0$(E-Mail Removed)...
> | We use hosts file instead of DNS. When users login a
> | batch file runs which is meant to copy an updated hosts
> | file to the WS from the server. These users only have
> | user rights so the batch file won't overwrite the hosts
> | file on the WS. I was thinking an easy solution would be
> | to change the location of the hosts file to, lets say C:\
> | where the user would be able to write to.
> | Know what I mean??
> |
> |
> | >-----Original Message-----
> | >Yes there is but it is contraindicated.
> | >
> | >Why would you want to do this ?
> | >
> | >The "Qhosts-1" Trojan is an example of malware that does
> | this.
> | >
> | >Dave
> | >
> | >
> | >"forthron" <(E-Mail Removed)> wrote in message
> | >news:056f01c3a8b9$7d5feac0$(E-Mail Removed)...
> | >| Hi,
> | >|
> | >| Does anyone know how to change the location of the hosts
> | >| file on a win2k workstation?? Is there a reg entry??
> | >|
> | >| Any help would great.
> | >| Regards,
> | >| Ron.
> | >
> | >
> | >.
> | >
>
>

Just wondering why you don't use DNS?

Cheers,

Cliff

On Tue, 11 Nov 2003 18:37:19 -0800,
<(E-Mail Removed)> wrote:

>We use hosts file instead of DNS. When users login a
>batch file runs which is meant to copy an updated hosts
>file to the WS from the server. These users only have
>user rights so the batch file won't overwrite the hosts
>file on the WS. I was thinking an easy solution would be
>to change the location of the hosts file to, lets say C:\
>where the user would be able to write to.
>Know what I mean??
>
>
>>-----Original Message-----
>>Yes there is but it is contraindicated.
>>
>>Why would you want to do this ?
>>
>>The "Qhosts-1" Trojan is an example of malware that does
>this.
>>
>>Dave
>>
>>
>>"forthron" <(E-Mail Removed)> wrote in message
>>news:056f01c3a8b9$7d5feac0$(E-Mail Removed)...
>>| Hi,
>>|
>>| Does anyone know how to change the location of the hosts
>>| file on a win2k workstation?? Is there a reg entry??
>>|
>>| Any help would great.
>>| Regards,
>>| Ron.
>>
>>
>>.
>>

--

The complete lack of evidence is the surest sign
that the conspiracy is working.