A couple more for the hosts file.

127.0.0.1 time.windows.com # Microsoft's default time sync server
127.0.0.1 time.nist.gov # MS's secondary time sync

Why in hosts?
1. Time sync servers built into Windows for automated updates by default.
2. Sync occurs at startup, and the clock starts before many firewalls (both of these are already in bluetack's blocklists).
3. Even if sync is disabled, it doesn't hurt to keep it in hosts in the event a "fix" from MS or something else reactivates them.
4. Their sync client is probably not well tested against exploits of yet unknown vulnerabilities simply because it seems so innocent, harmless, and useful. Just another way for big brother to sneak into your computer silently.

HI Vote Machine Malfunction,

You can add them yourself if you like, but I ain't gonna add them to the Hosts file. A lot of people are using Time Sync and I don't wanna receive any complaints about that. Time Sync is easy to disable in the date/time properties and a M$ fix will not re-enable it.

Kim

I feel your pain, Kim, and may I say you look simply smashing today. Of course, Microsoft never releases fixes for fixes that fixed fixes found in service packs.
http://www.microsoft.com/technet/security/...n/ms05-014.mspx

Sorry but I don't see the relationship between that Cumulative Security Update for IE and blocking Windows Time Sync servers. Time servers work on port 13 or 37. Furthermore, a decent firewall will not allow internet connections on boot. You can test this by allowing the root certificates update ... if your firewall is working like it should be, you'll find a deny entry in your logs refering to crl.microsoft.com