Quote:
|
Originally Posted by JohnHorb
...The other thing to check regularly is that nothing has 'tweaked' your HOSTS file (<windows directory>\system32\drivers\etc\hosts) to add a false IP address for www.paypal.com (or any other site) - that's the REAL danger! |
On a similar note, something else to check when you suspect your machine's been hijacked, is to check the value «Databa sePath» under key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters ?
It should be "%SystemRoot%\system32\drivers\etc" but there are certain spyware that modify this key to point elsewhere to a dodgy hosts file that they use to redirect sites such as Paypal to their IP address.