Entry: RestoreHostsFile; Change: Value deleted

[Crimea]

Windows XP, SP2

Hi,

Whenever I boot-up, I get the following Spybot - S & D warning:

"Spybot ...has detected an important registry entry has been changed.
Category: System Startup global entry
Change: Value deleted
Entry: RestoreHostsFile
Old data: cscript "C:\Documents and Settings\All Users..."

Should I "Allow" it or "Deny" it?

I've a horrible feeling this is something bad.

Thanks for any help anyone can give.

[129260]

read about teatimer in the help section of spybot S&d. Also find more info here: http://www.spybot.info/en/faq/index.html look under the teatimer heading to read more info about it. Bassicaly, when you install a program or uninstall something, teatimer will notify you that something changed. If you didnt change anything at all, nothing was updated and nothing was installed or downloaded or uninstalled, you should deny it. In your list there that u gave, something was deleted, so its safe to allow, because something you did prob uninstalled a program or something, or you changed what starts up when you boot your computer.
hope that helps you.

[Zenobia]

Also,when searching for RestoreHostsFile,I came across this somewhat similar RunOnce startup entry,though I can't find much info on it:
RunOnce: RestoreHostsFile cscript "C:\Documents and Settings\All Users\Application Data\Juniper Networks\restore.vbs"
Thought maybe posting it might ring a bell with you,if you have anything by Juniper Networks or something.
http://en.wikipedia.org/wiki/Juniper_Networks

When the entry kept coming up on Startup,were you denying it each time,or did you Allow it?

[Crimea]

To be honest, Zenobia, I can't remember whether I "Allowed" it or "Denied" it the first time, but I certainly "Deny" it every time, now.

Thanks for the info. about Juniper Networks. I've just used "Add or Remove Programs" and ZSoft Uninstaller 2.4.1 and both list two entries for Juniper Networks, two progs. I don't recall installing:
Juniper Networks Host Checker; and
Juniper Terminal Services Client

When I can find the time, I'll investigate these further.

I can't find it now, but when I searched for info. on RestoreHostsFile, I found a forum posting regarding spam pron e-mails and how, after clicking on one of the e-mails, the poster's own e-mails were constantly being returned "undelivered". I don't have the pron problem but I also have a problem with my e-mail; Hotmail, in my case. For over a month, I haven't received any replies to any Hotmail e-mail I've sent to non-Hotmail accounts. As the e-mails addresses I have are the only ways of contacting the people, I don't know what the problem is.

I wondered whether the two were linked.

I've contacted Hotmail's tech. support but am still awaiting a reply.

Thanks for any help.

[Zenobia]

That's okay,it's a RunOnce startup entry,so it is okay for it to be deleted from startup.So you can Allow that change.RunOnce entries ordinarily only run on startup once.Denying with Teatimer would prevent that being deleted from startup.
I was asking if you Allowed or Denied the entry,because there was an old bug with Teatimer 1.4 where it would prompt about things on startup over and over again until it's snapshot files were refreshed,so I wanted to know if it was possible that that was happening with you.

I think I may have saw the same post you did,but I think perhaps the problems they were having were connected to other problems they were having,and them having the RestoreHostsFile entry was just a coincidence.

Those two entries in add/remove programs don't appear to be bad or anything,from all I have gathered.

[129260]

which was to allow it lol. thanx alot Zenobia. You are great to have in these forums.

[Crimea]

Thanks, both of you.

[129260]

i try to help as best as i can, and when i don't know, and no other member knows how to help, thats what the spybot team members are for.

[Zenobia]

You're welcome.

which was to allow it lol. thanx alot Zenobia. You are great to have in these forums.

Why,thank you.