rf_getattr(/) rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/) rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/) rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/) rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_mknod(/hosts-copy) Checking if it's opened ... no. Checking if an IFREG is requested ... yes. Checking if it's an editor file ...no. Checking if it's a file ... root.file?(/hosts-copy) no. Checking if it's writable to ... root.can_write?(/hosts-copy) yes. rf_getattr(/hosts-copy) Checking for created file ... created. rf_open(/hosts-copy) Checking if it's already open ... no. Checking if an editor file is requested... no. Checking for a raw_opened file... no. Checking open type ... WRONLY. Checking if we can write to it ... yes. rf_truncate(/hosts-copy,0) Checking if it's an editor file ... root.file?(/hosts-copy) rf_truncate(/hosts-copy,71) Checking if it's an editor file ... root.file?(/hosts-copy) rf_write(/hosts-copy) Offset is 70 Checking if file is open... yes. Checking if it's opened for raw write... no. Checking if it's open for write ... yes. rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_write(/hosts-copy) Offset is 0 Checking if file is open... yes. Checking if it's opened for raw write... no. Checking if it's open for write ... yes. rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_release(/hosts-copy) Checking for opened file ... yes. Checking if it's opened for raw write... no. Checking if it's for write ... yes ... and modified. root.write_to(/hosts-copy,...) rf_getattr(/) rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/) rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-copy) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-copy) root.file?(/hosts-copy) nonexistant. rf_getattr(/) rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_getattr(/) rf_getattr(/hosts-cp.exe) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.exe) root.file?(/hosts-cp.exe) nonexistant. rf_getattr(/hosts-cp.exe) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.exe) root.file?(/hosts-cp.exe) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-cp.exe) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.exe) root.file?(/hosts-cp.exe) nonexistant. rf_getattr(/) rf_getattr(/hosts-cp.exe.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.exe.lnk) root.file?(/hosts-cp.exe.lnk) nonexistant. rf_getattr(/hosts-cp.exe.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.exe.lnk) root.file?(/hosts-cp.exe.lnk) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-cp.exe.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.exe.lnk) root.file?(/hosts-cp.exe.lnk) nonexistant. rf_getattr(/) rf_getattr(/hosts-cp.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.lnk) root.file?(/hosts-cp.lnk) nonexistant. rf_getattr(/hosts-cp.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.lnk) root.file?(/hosts-cp.lnk) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-cp.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.lnk) root.file?(/hosts-cp.lnk) nonexistant. rf_getattr(/) rf_getattr(/) rf_getattr(/) rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_getattr(/) rf_getattr(/hosts-cp.exe) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.exe) root.file?(/hosts-cp.exe) nonexistant. rf_getattr(/hosts-cp.exe) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.exe) root.file?(/hosts-cp.exe) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-cp.exe) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.exe) root.file?(/hosts-cp.exe) nonexistant. rf_getattr(/) rf_getattr(/hosts-cp.exe.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.exe.lnk) root.file?(/hosts-cp.exe.lnk) nonexistant. rf_getattr(/hosts-cp.exe.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.exe.lnk) root.file?(/hosts-cp.exe.lnk) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-cp.exe.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.exe.lnk) root.file?(/hosts-cp.exe.lnk) nonexistant. rf_getattr(/) rf_getattr(/hosts-cp.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.lnk) root.file?(/hosts-cp.lnk) nonexistant. rf_getattr(/hosts-cp.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.lnk) root.file?(/hosts-cp.lnk) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-cp.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.lnk) root.file?(/hosts-cp.lnk) nonexistant. rf_getattr(/) rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_getattr(/) rf_getattr(/hosts-cp.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.lnk) root.file?(/hosts-cp.lnk) nonexistant. rf_getattr(/hosts-cp.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.lnk) root.file?(/hosts-cp.lnk) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-cp.lnk) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp.lnk) root.file?(/hosts-cp.lnk) nonexistant. rf_getattr(/) rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_getattr(/) rf_getattr(/) rf_readdir(/) root.contents(/) rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_mknod(/hosts-cp) Checking if it's opened ... no. Checking if an IFREG is requested ... yes. Checking if it's an editor file ...no. Checking if it's a file ... root.file?(/hosts-cp) no. Checking if it's writable to ... root.can_write?(/hosts-cp) yes. rf_getattr(/hosts-cp) Checking for created file ... created. rf_open(/hosts-cp) Checking if it's already open ... no. Checking if an editor file is requested... no. Checking for a raw_opened file... no. Checking open type ... WRONLY. Checking if we can write to it ... yes. rf_write(/hosts-cp) Offset is 70 Checking if file is open... yes. Checking if it's opened for raw write... no. Checking if it's open for write ... yes. rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_getattr(/hosts-cp) Checking for created file ... no. Checking if editor file...No. Checking filetype ... root.directory?(/hosts-cp) root.file?(/hosts-cp) nonexistant. rf_release(/hosts-cp) Checking for opened file ... yes. Checking if it's opened for raw write... no. Checking if it's for write ... yes ... and modified. root.write_to(/hosts-cp,...) ** notice: truncating content from 71 to 20 bytes. More hosts-copy for my collection! ** notice: truncating content from 71 to 20 bytes. More hosts-cp for my collection! Look what I just found... ... some "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" rusted by my hosts-cp... ... some "127.0.0.1 localhost" rusted by my hosts-copy... That's it!