change location of hosts file

[Glenn Larkin]

I got bit by a Trojan recently that really did a number on
my DNS operation. I've got most of it cleaned up; just one
lingering problem. This Trojan has apparently changed the
location that Win2K uses to find the 'hosts' file. It's
now looking in the \winnt\help directory instead of
system32\drivers\etc. I know I could just move my existing
hosts file there, but I would like to know how to really
fix it. Can anyone tell me how this redirection was
accomplished?

 

[Jonathan de Boyne Pollard]

GL> Can anyone tell me how this redirection was accomplished?

Yes.

<URL:http://vil.nai.com/vil/content/v_100719.htm>
<URL:http://f-secure.com./v-descs/delude.shtml>

 

[Michael Johnston [MSFT]]

It's controled via the DataBasePath value in HKLM/SYSTEM/CCS/Services/TCPIP/Parameters

Thank you,
Mike Johnston
Microsoft Network Support
--

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this message are best directed to the newsgroup/thread from which they originated.