PDA

View Full Version : Has SSD Added Many Lines To My Hosts File?



TomBrooklyn
2011-11-09, 12:32
Win XP Pro
SSD v. 1.6.2.46 Latest Detection: today: 11/9/11

While running a Spybot SD scan, is it normal that I found my hosts file has hundreds of lines of entries beginning with a reference to Spybot?

I was expecting my hosts file to have only one line in it.

I was running SSD to clean up any stray bits of malware after an apparently successful running of Kaspersky's TDSSKiller to get rid of a Google Redirect virus. And I was checking my hosts file to see if the Google Redirect virus had modified it.

A partial copy of my current hosts file, from the top, is as follows:

# Start of entries inserted by Spybot - Search & Destroy
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
etc,
etc
for hundreds more similar lines.

Gopher John
2011-11-09, 14:42
The entries between

# Start of entries inserted by Spybot - Search & Destroy
# This list is Copyright 2000-2010 Safer-Networking Ltd.

and

# End of entries inserted by Spybot - Search & Destroy

are part of SpyBot Search & Destroy's normal immunization when "Windows | Global {Hosts} is checkmarked at the bottom of the Immunization window. They should all start with 127.0.0.1, effectively pointing the site to localhost on your machine and preventing your machine from connecting to the site.

TomBrooklyn
2011-11-09, 23:10
Hi.

I thought maybe these items in host might only stay there while SSD was running.

I see now after the run, they are still there.

Is this a list of malicious websites that if I would now be prevented from inadvertantly going to?

I notice there are many sites on the list that are common sites with mispelled names, like esbay.it and ewbay.it, although I've never heard of ".it" before.

I don't quite understand how the host file works, but I thought it was supposed to only have a one line entry.

Gopher John
2011-11-10, 03:09
See Blocking Unwanted Parasites with a Hosts File (http://winhelp2002.mvps.org/hosts.htm).