PDA

View Full Version : Trojan in Spybot or False positive



johnwrites
2005-12-01, 20:18
According to ewido security suite C:\Program Files\Spybot - Search & Destroy\Includes\Hosts.sbs -> Trojan.Qhost.ew : Cleaned with backup

Google brought me to http://forum.hijackthis.de/archive/index.php/t-11630.html but I cannot understand this.
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html says the defs for this infection are 2 years old and I am up to date so why did NAV not flag it?

I have quarantined it in ewido. Will Spybot work OK
Thanks
johnwrites

md usa spybot fan
2005-12-01, 21:14
The Hosts.sbs file is used by the Spybot Hosts file facility. Without that file if you go into:Spybot > Mode > Advanced Mode > Tools > Hosts file
You will notice that the following buttons are no longer active:
"Add Spybot S&D hosts list"
"Remove Spybot S&D hosts list"
I don't know if you will encounter any other problems with Spybot without that file. I suggest that you restore the file and report the problem to ewido.

johnwrites
2005-12-01, 21:33
Thanks do you know if it is a false positive? I do not understand how Spybot could be infected and i cannot find much through Google I might just donload and install a clean copy of spybot

johnwrites

md usa spybot fan
2005-12-01, 22:06
It is probably a false positive. It appears that there were several reported problems with not only Spybot but also with the scans of the HOSTS file. See:
Ewido found something new...
http://reviews.cnet.com/5208-6132_7-0.html?forumID=32&messageID=1569703&threadID=139759

In that thread I didn’t notice any positive feed back from Ewido specifically about the Hosts.sbs file although Ewido indicated some of the problems were false positives:
''Pipeline'' and ''411'' / Ewido...says false positives..
http://reviews.cnet.com/5208-6132-0.html?forumID=32&threadID=139759&messageID=1570396

Report the problem to Ewido and send them the file to be sure.

johnwrites
2005-12-02, 20:51
Thanks for the link.I googled but did not find that. ewido have confirmed to me that it was a False ositive and they have now fixed it
Thanks again
Johnwrites