How to navigate away from quicksand domains which hold your browser captive until you install their software?

[Hendrik Maryns]

Re: How to navigate away from quicksand domains which hold your browsercaptive until you install their software?

Tom schreef:

On Sun, 13 Jul 2008 19:16:24 +0200, Hendrik Maryns wrote:
>

>If I click on this in Firefox 3 (on Linux, but that shouldn’t make a
>difference), I get a page warning that it is a scam page, with a button
>‘Get me out of here!’.

>
That warning must be coming from the browser.

Of course it is. In the Preferences: Security → ‘Tell me whether the
website I am visiting is a possible attack site’ and ‘Tell me whether
the website I am visiting is a possible spoof site’ or something similar
(I have a Dutch version).

H.
--
Hendrik Maryns

http://tcl.sfs.uni-tuebingen.de/~hendrik/

=============== ===

http://aouw.org

Ask smart questions, get good answers:

http://www.catb.org/~esr/faqs/smart-questions.html

[hummingbird]

Re: How to navigate away from quicksand domains which hold your browser captive until you install their software?


On Sun, 13 Jul 2008 19:09:43 -0700 'Tom'
wrote this on alt.comp.freewa re:

>On Sun, 13 Jul 2008 21:58:18 +0100, hummingbird wrote:

>The HOSTS file is named exactly that: HOSTS
>It has no file extension.

>
>I know. I know. Of course it's named hosts.
>
>I'll explain again. You can fumble around trying to find the hosts file
>every time you have to edit it but I don't wish to be that inefficient.
>
>I just type "hosts", I make my edits, and I save the results as "hosts" and
>I'm done.

I can locate my HOSTS file on my system in about 2 seconds.
But then, I use a real filemanager (payware ZtreeWin).

>Behind the scenes, the magic of that simplicity is:
>a) Typing "Start -Run -hosts" exercises the "hosts.exe" registry key
>b) That hosts.exe registry key brings up the hosts.txt file
>c) Saving that as "hosts" saves that file as the proper hosts file.

I do not have a file called hosts.exe on my system, never have
had. Nor is there anything in the registry by that name.

>It's that simple. You might prefer the lousy inefficient way and that's
>just fine. Here's the horribly inefficient way to edit the hosts file.
>
>a) Navigate to C:\windows (hosts belongs here)
>b) Navigate to system32 (dunno why it's here)
>c) Navigate to drivers (it's not a driver)
>d) Navigate to etc (what's etc got to do with it?)
>e) Right click on the hosts file to edit in Notepad
>f) Save as hosts.bak (you should have a backup)
>g) Save as hosts (this overwrites the original file)

This is where the hosts file is located in XP:
C:\WINDOWS\syst em32\drivers\et c\HOSTS

>So, you can do it either way. I think the method I proposed is elegant.
>I think both methods will work.
>
>BTW, there isn't any hosts.exe file.
>Those who know the Windows registry know that, in Microsoft's infinite
>wisdom, the "App Paths" key MUST end with "exe" for it to work. There is no
>hosts.exe (I repeat) there is no hosts.exe. The whole point of the App
>Paths key is to make the editing of hosts a simple one-click affair.
>
>Hope this helps!

--
"All truth passes through three stages.
First, it is ridiculed, second it is violently opposed,
and third, it is accepted as self-evident"
(Arthur Schopenhauer)

[Tom]

Re: How to navigate away from quicksand domains which hold your browser captive until you install their software?

On Sun, 13 Jul 2008 22:48:05 -0400, Beauregard T. Shagnasty wrote:

Tom wrote:
>

>Behind the scenes, the magic of that simplicity is:

>
..to simply place a shortcut on your desktop - calling your text editor
to load HOSTS. Then all you have to do is save after you edit, and
bypass all those extra chores you've created for yourself.

That would work also. I prefer the registry App Paths (that's what it's
for) because I can export it and use it on multiple machines and use it
when I re-image my machine, etc. but there are more than a few ways to edit
a file that has no extension and all will work just fine.

[Beauregard T. Shagnasty]

Re: How to navigate away from quicksand domains which hold your browser captive until you install their software?

Me Here wrote:

Beauregard T. Shagnasty wrote:

>Me Here wrote:

>>If you have other tabs open that you want to keep viewing, then yes,
>>it's a good immediate, albeit 'temporary' solution to the problem.
>>I say temporary because using a Hosts file isn't a good solution.
>>Many malware sites scan and remove their listings from hosts files
>>(and even locking it via the read-only attribute won't protect
>>you).

>>
>What? You are gonna have to find reliable cites for that nonsense.
>>

>>They do it by making you log into a benign site first (one that
>>isn't blocked) and using that to remove their entry from your Hosts
>>file before redirecting you and trapping your browser. Even
>>running free FireFox addons such as NoScript won't protect you
>>unless you've been caught before and know not to allow the site
>>access to Java or JS.

>>
>More bollox.

>
Ahh fuckit, I wasn't going to do your homework but I just couldn't
help Googling to see how many links popped up - so many I just shook
my head and laughed. Of course, wikipedia was among the top 3...

Hey, I don't have to do homework; you are the one who made the
statements and I asked for cites. Why should I have to prove - or
disprove - your claims.

Here's two to start you off explaining why hosts files by themselves
aren't secure and how easily they get hijacked:
>
http://en.wikipedia.org/wiki/Hosts_file

Micha already answered the point about how a website hijacking the hosts
file isn't possible.

"A website alone doesn't do that. A good browser doesn't do that. An
appropriate system setup doesn't allow that. "

and just in case you have doubts about the authenticity of information
in wikipedia:
>

http://www.virusbtn.com/resources/glossary/hosts_file.xml

>
Once you've grasped that, then you may begin to realise why, if you
use a hosts file to block stuff, you need to run a hosts file manager
(all good hosts file managers monitor the hosts file for unauthorised
attempts at changing it) or else you're just pissing in the wind.

My hosts file is located here: /etc/hosts
What host file manager would you recommend I use?

Next time, please Google and get your facts right before slighting
someone else's post.

<lol Next time, don't write statements like "Many malware sites scan
and remove their listings from hosts files" that aren't true.

And like Micha, I don't have any anti- anything software on my computer
either.

--
-bts
-Friends don't let friends drive Windows

[Beauregard T. Shagnasty]

Re: How to navigate away from quicksand domains which hold your browser captive until you install their software?

Me Here wrote:

Beauregard T. Shagnasty wrote:

>Me Here wrote:

>>... Many malware sites scan and remove their listings from hosts
>>files (and even locking it via the read-only attribute won't
>>protect you).

>>
>What? You are gonna have to find reliable cites for that nonsense.

>
Oh, just so I don't get the wrong idea - are you saying that malware
can't change the hosts file or that you've never heard of it being
done?

And just so you don't think I have no knowledge of the subject, I'm
saying that your statement "Many malware sites ..." [I assume that means
web sites] is false. Subsequent infections by visiting those sites with
insecure browsers on unprotected Windows PCs may load something *else*
that could hijack a hosts file.

--
-bts
-Friends don't let friends drive Windows

[hummingbird]

Re: How to navigate away from quicksand domains which hold your browser captive until you install their software?


On Mon, 14 Jul 2008 00:25:33 -0400 'Alfred Einstein'
wrote this on alt.comp.freewa re:

>
>"Ed Mullen" <ed@edmullen.ne twrote in message
>news:oIGdnTL_7 8LaWefVnZ2dnUVZ _uydnZ2d@comcas t.com...

>Tom wrote:

>>On Sun, 13 Jul 2008 14:52:18 -0400, Ed Mullen wrote:
>>>
>>>And do a search on "hosts.exe" and you'll find things like this:
>>>
>>I know. I know.
>>>
>>Those who know the Windows registry know that, in Microsoft's infinite
>>wisdom, the "App Paths" key MUST end with "exe" for it to work. There is
>>no hosts.exe (I repeat) there is no hosts.exe. The whole point of the App
>>Paths key is to make the editing of hosts a
>>simple one-click affair.
>>>
>>But, Microsoft insists that ALL "Apps Paths" keys end with "exe" whether
>>or
>>not the file you're trying to open ends with ".exe".
>>>
>>So, that's the ONLY reason the hosts App Path key is called "hosts.exe" .
>>>
>>Please reply if you understand this 'cuz I feel badly that this was
>>misundersto od by a few of you.

>>
>You do not have a freaking clue. Your entire rant about the HOSTS file
>management process in Windows is ignorant at best, damaging most likely,
>possibly intent on some nefarious goal.

>
>I think Ed is dead in the head.

Ded Mullet?


--
"All truth passes through three stages.
First, it is ridiculed, second it is violently opposed,
and third, it is accepted as self-evident"
(Arthur Schopenhauer)

[hummingbird]

Re: How to navigate away from quicksand domains which hold your browser captive until you install their software?


On Mon, 14 Jul 2008 14:23:03 +1000 'Me Here'
wrote this on alt.comp.freewa re:

>Tom wrote:

>On Sun, 13 Jul 2008 13:45:20 -0400, C A Upsdell wrote:
>>

>>If Windows, Ctrl Alt Delete to call up the task manager; select the
>>browser; kill it.

>>
>Very inelegant.
>>
>When you have a dozen tabs open, killing the browser, kills all the tabs.
>>
>When you restart Firefox, it asks if you want to open all the old tabs,
>but, of course, that will just open the quicksand site all over again.
>>
>So, without editing the hosts file and shift reloading, you're forced to
>say NO to reloading your old tabs ... and you lose them all.
>>
>That's why you don't kill the browser session.
>>
>Luckily we found a single-click way to solve the problem (type "start ->
>run -hosts, add the offending domain, and shift reload the browser). This
>turns the quicksand URL into cement. Voila! Thanks to hummingbird!

>If you have other tabs open that you want to keep viewing, then yes,
>it's a good immediate, albeit 'temporary' solution to the problem. I
>say temporary because using a Hosts file isn't a good solution. Many
>malware sites scan and remove their listings from hosts files (and even
>locking it via the read-only attribute won't protect you). They do it
>by making you log into a benign site first (one that isn't blocked) and
>using that to remove their entry from your Hosts file before redirecting
>you and trapping your browser.

Good point MH. I've never experienced that trick, especially since
I started safe hexing, but I am aware it can happen.

These days, I seem to be safe with a hosts file to block unwanted
sites, plus a supplementary program or two (SpyWareBlaster etc).

>Even running free FireFox addons such as
>NoScript won't protect you unless you've been caught before and know not
>to allow the site access to Java or JS. You should really be running
>an IP blocking program like PeerGuardian or if that is too much hassle,
>do what I do and use OpenDNS. I'm sure there are other solutions, those
>two just spring to mind. My advice, if you don't want this happening
>again and you're the type that's likely to run across sites like these
>often, is to do a bit of research into blocking methods and choose the
>one that best suits your need.

--
"All truth passes through three stages.
First, it is ridiculed, second it is violently opposed,
and third, it is accepted as self-evident"
(Arthur Schopenhauer)

[Guy Macon]

Re: How to navigate away from quicksand domains which hold your browsercaptive until you install their software?




Ed Mullen wrote:

>This is idiotic to the max.

>This entire issue is bogus

I have found that a simple filter removes all of the noise from
this newsgroup. I have set my filters to not display anything that
is crossposted to alt.comp.freewa re. The remailing posts are all
high quality and on-topic.

--
Guy Macon
<http://www.GuyMacon.co m/>

[Me Here]

Re: How to navigate away from quicksand domains which hold your browsercaptive until you install their software?


Beauregard T. Shagnasty wrote:

Me Here wrote:
>

>Beauregard T. Shagnasty wrote:

>>Me Here wrote:
>>>If you have other tabs open that you want to keep viewing, then yes,
>>>it's a good immediate, albeit 'temporary' solution to the problem.
>>>I say temporary because using a Hosts file isn't a good solution.
>>>Many malware sites scan and remove their listings from hosts files
>>>(and even locking it via the read-only attribute won't protect
>>>you).
>>What? You are gonna have to find reliable cites for that nonsense.
>>>
>>>They do it by making you log into a benign site first (one that
>>>isn't blocked) and using that to remove their entry from your Hosts
>>>file before redirecting you and trapping your browser. Even
>>>running free FireFox addons such as NoScript won't protect you
>>>unless you've been caught before and know not to allow the site
>>>access to Java or JS.
>>More bollox.

>Ahh fuckit, I wasn't going to do your homework but I just couldn't
>help Googling to see how many links popped up - so many I just shook
>my head and laughed. Of course, wikipedia was among the top 3...

>
Hey, I don't have to do homework; you are the one who made the
statements and I asked for cites. Why should I have to prove - or
disprove - your claims.
>

>Here's two to start you off explaining why hosts files by themselves
>aren't secure and how easily they get hijacked:
>>
>http://en.wikipedia.org/wiki/Hosts_file

>
Micha already answered the point about how a website hijacking the hosts
file isn't possible.
>

It *IS* possible, that's the point - websites can, and do, do that. Why
does *his* statement pass without so much as a cite whereas mine is
required to produce fact (which I gave). Where are *his* cites? Why do
you believe *his* statement and not mine? Because it supports *your*
point of view? READ the damn links I gave you and then do some damn
research yourself.

My hosts file is located here: /etc/hosts
What host file manager would you recommend I use?

There are several freeware ones I used to use before I changed to
OpenDNS. Google Hostfile manager and I'm sure you'll find them.

>

>Next time, please Google and get your facts right before slighting
>someone else's post.

>
<lol Next time, don't write statements like "Many malware sites scan
and remove their listings from hosts files" that aren't true.
>

Of course it's true. Even the damn links I gave you proved it. Malware
isn't just downloaded programs you know..... or do you... hmmmm.

And like Micha, I don't have any anti- anything software on my computer
either.
>

It is true, there is a sucker born ever minute. It's only a matter of
time (if it hasn't happened yet) before you get bent over.


--
Me Here


After filing the largest corporate bankruptcy in history, Worldcom stock
closed at $0.14 on Monday which leaves consumers with the dilemma. Do
you buy one share of Worldcom stock, or 2 minutes of MCI long distance?
Dennis Miller Live 07/26/2002.

[Me Here]

Re: How to navigate away from quicksand domains which hold your browsercaptive until you install their software?


Beauregard T. Shagnasty wrote:

Me Here wrote:
>

>Beauregard T. Shagnasty wrote:

>>Me Here wrote:
>>>... Many malware sites scan and remove their listings from hosts
>>>files (and even locking it via the read-only attribute won't
>>>protect you).
>>What? You are gonna have to find reliable cites for that nonsense.

>Oh, just so I don't get the wrong idea - are you saying that malware
>can't change the hosts file or that you've never heard of it being
>done?

>
And just so you don't think I have no knowledge of the subject, I'm
saying that your statement "Many malware sites ..." [I assume that means
web sites] is false.

It's not false. You obviously have a problem with either reading or
English. If malware sites couldn't do anything to your computer, why
the hell are browser companies so worried about security now-a-days? Of
course malware sites can effect your computer.

Micha is right though, a properly secured browser reduces the chances of
this happening quite significantly.

As for ActiveX, only a fool runs that crap. Worst nightmare MS ever
introduced into the internet (IMHO).



--
Me Here


"First they came for the Communists but I was not a Communist so I did
not speak out. Then they came for the Socialists and the Trade
Unionists but I was not one of them, so I did not speak out. Then they
came for the Jews but I was not Jewish so I did not speak out. And
when they came for me, there was no one left to speak out for me."

[Me Here]

Re: How to navigate away from quicksand domains which hold your browsercaptive until you install their software?


hummingbird wrote:

On Mon, 14 Jul 2008 14:23:03 +1000 'Me Here'
wrote this on alt.comp.freewa re:
>

>Tom wrote:

>>On Sun, 13 Jul 2008 13:45:20 -0400, C A Upsdell wrote:
>>>
>>>If Windows, Ctrl Alt Delete to call up the task manager; select the
>>>browser; kill it.
>>Very inelegant.
>>>
>>When you have a dozen tabs open, killing the browser, kills all the tabs.
>>>
>>When you restart Firefox, it asks if you want to open all the old tabs,
>>but, of course, that will just open the quicksand site all over again.
>>>
>>So, without editing the hosts file and shift reloading, you're forced to
>>say NO to reloading your old tabs ... and you lose them all.
>>>
>>That's why you don't kill the browser session.
>>>
>>Luckily we found a single-click way to solve the problem (type "start ->
>>run -hosts, add the offending domain, and shift reload the browser). This
>>turns the quicksand URL into cement. Voila! Thanks to hummingbird!

>
>

>If you have other tabs open that you want to keep viewing, then yes,
>it's a good immediate, albeit 'temporary' solution to the problem. I
>say temporary because using a Hosts file isn't a good solution. Many
>malware sites scan and remove their listings from hosts files (and even
>locking it via the read-only attribute won't protect you). They do it
>by making you log into a benign site first (one that isn't blocked) and
>using that to remove their entry from your Hosts file before redirecting
>you and trapping your browser.

>
Good point MH. I've never experienced that trick, especially since
I started safe hexing, but I am aware it can happen.
>
These days, I seem to be safe with a hosts file to block unwanted
sites, plus a supplementary program or two (SpyWareBlaster etc).
>
>

>Even running free FireFox addons such as
>NoScript won't protect you unless you've been caught before and know not
>to allow the site access to Java or JS. You should really be running
>an IP blocking program like PeerGuardian or if that is too much hassle,
>do what I do and use OpenDNS. I'm sure there are other solutions, those
>two just spring to mind. My advice, if you don't want this happening
>again and you're the type that's likely to run across sites like these
>often, is to do a bit of research into blocking methods and choose the
>one that best suits your need.

>
>

As I said, a hosts file is great, so long as you protect it otherwise it
becomes pointless. Many programs out there now protect things like Home
pages and hosts files simply because security companies are aware that
they are easily hijacked with things like WSH or ActiveX (or even a
crappy FF addon).


--
Me Here


Don't let your education interfere with your intelligence. -- unknown

[Beauregard T. Shagnasty]

Re: How to navigate away from quicksand domains which hold your browser captive until you install their software?

hummingbird wrote:

On Mon, 14 Jul 2008 07:53:16 -0400 'Beauregard T. Shagnasty'
wrote this on alt.comp.freewa re:

>And like Micha, I don't have any anti- anything software on my
>computer either.

>
You're out of your depth Shagnasty. Accept it and go fishing.

That's funny...

There are plenty of people who surf unprotected and are at risk of
getting clobbered by websites containing malware. A HOSTS file is no
absolute guarantee of safety.

Of course not, and I did not say it was.

[HEALTH WARNING]
If you switch off all your security s/w and surf to this website,
see what happens: www.pricelessware.org

Ok, I did. I see a ~1995-coding-style web site with many lists of free
Windows software. What was supposed to happen?

--
-bts
-Friends don't let friends drive Windows

[Beauregard T. Shagnasty]

Re: How to navigate away from quicksand domains which hold your browser captive until you install their software?

Me Here wrote:

Beauregard T. Shagnasty wrote:

>And like Micha, I don't have any anti- anything software on my
>computer either.

>
It is true, there is a sucker born ever minute. It's only a matter
of time (if it hasn't happened yet) before you get bent over.

You are apparently assuming I am using a Windows operating system.

--
-bts
-Friends don't let friends drive Windows

[hummingbird]

Re: How to navigate away from quicksand domains which hold your browser captive until you install their software?


On Tue, 15 Jul 2008 00:16:33 +1000 'Me Here'
wrote this on alt.comp.freewa re:

>
>hummingbird wrote:

>On Mon, 14 Jul 2008 14:23:03 +1000 'Me Here'
>wrote this on alt.comp.freewa re:
>>

>>Tom wrote:
>>>On Sun, 13 Jul 2008 13:45:20 -0400, C A Upsdell wrote:
>>>>
>>>>If Windows, Ctrl Alt Delete to call up the task manager; select the
>>>>browser; kill it.
>>>Very inelegant.
>>>>
>>>When you have a dozen tabs open, killing the browser, kills all the tabs.
>>>>
>>>When you restart Firefox, it asks if you want to open all the old tabs,
>>>but, of course, that will just open the quicksand site all over again.
>>>>
>>>So, without editing the hosts file and shift reloading, you're forced to
>>>say NO to reloading your old tabs ... and you lose them all.
>>>>
>>>That's why you don't kill the browser session.
>>>>
>>>Luckily we found a single-click way to solve the problem (type "start ->
>>>run -hosts, add the offending domain, and shift reload the browser). This
>>>turns the quicksand URL into cement. Voila! Thanks to hummingbird!

>>
>>

>>If you have other tabs open that you want to keep viewing, then yes,
>>it's a good immediate, albeit 'temporary' solution to the problem. I
>>say temporary because using a Hosts file isn't a good solution. Many
>>malware sites scan and remove their listings from hosts files (and even
>>locking it via the read-only attribute won't protect you). They do it
>>by making you log into a benign site first (one that isn't blocked) and
>>using that to remove their entry from your Hosts file before redirecting
>>you and trapping your browser.

>>
>Good point MH. I've never experienced that trick, especially since
>I started safe hexing, but I am aware it can happen.
>>
>These days, I seem to be safe with a hosts file to block unwanted
>sites, plus a supplementary program or two (SpyWareBlaster etc).
>>
>>

>>Even running free FireFox addons such as
>>NoScript won't protect you unless you've been caught before and know not
>>to allow the site access to Java or JS. You should really be running
>>an IP blocking program like PeerGuardian or if that is too much hassle,
>>do what I do and use OpenDNS. I'm sure there are other solutions, those
>>two just spring to mind. My advice, if you don't want this happening
>>again and you're the type that's likely to run across sites like these
>>often, is to do a bit of research into blocking methods and choose the
>>one that best suits your need.

>>
>>

>
>As I said, a hosts file is great, so long as you protect it otherwise it
>becomes pointless. Many programs out there now protect things like Home
>pages and hosts files simply because security companies are aware that
>they are easily hijacked with things like WSH or ActiveX (or even a
>crappy FF addon).

Yeah, I must think about protecting my own hosts file. I think
SpyWareBlaster offers this feature.

[rushes off to check]


--
"All truth passes through three stages.
First, it is ridiculed, second it is violently opposed,
and third, it is accepted as self-evident"
(Arthur Schopenhauer)

[Gabriele Neukam]

Re: How to navigate away from quicksand domains which hold your browser captive until you install their software?

On this special day, Tom wrote:

No. Nothing works except to kill firefox and not restart with all the same
tabs all over again.

Strange. I just looked at this presumed antivirus 2009 (with FireFox 3)
and closed the tab. No problems at all. I have Java (not JavaScript)
disabled generally and will allow exceptions only to specific sites
that I will list.

As soon as I had installed FF3, I opened the JavaScript Expanded Button
and unchecked all except for the topmost box, which is "move or resize
existing windows" (which can still be abused IMHO but cannot do much
harm - at least I do hope so)

Maybe this is the soluton.


Gabriele Neukam

Gabriele.Spamfi ghter.Neukam@t-online.de

--
No I am not a troll. Just a beginner and lazy!!!!!!!!!!!
(leepeach in alt.comp.virus, asked why (s)he was repeatedly asking the
same question)