Hosts fie

Printable View

2008-10-05, 22:47
qimqim

Hosts fie

I looked i my Hosts file and found that it had been created by SpyBot and included en.Wikipedia.org.

Is this normal?
2008-10-06, 01:29
Greyfox

No, it certainly isn't in the Spybot listing in mine.
What other programs do you have that might be using the Host file?

What is the full entry you have for Wikipedia, and is it directed to 127.0.0.1?
What version of Spybot do you have and when did you last update and immunise it?
2008-10-06, 02:28
wyrmrider

you could also check the entry with site adviser or similar
I am a bit Leary about the en.
Wikipedia.org is the real thing
2008-10-06, 06:34
qimqim

My version is 1.6.0
I do not use immunization
The entry started with 127.0.0.1

If SpyBot did not place the entry there, ow could it get there? A virus? But what for?
The Hosts file is definitely SpBot because at the end it has:

# Start of entries inserted by Spybot - Search & Destroy
# This list is Copyright 2000-2008 Safer Networking Limited
# End of entries inserted by Spybot - Search & Destroy
2008-10-06, 07:23
md usa spybot fan

qimqim:

Spybot normally places its entries between the comments as follows:

Code:

# Start of entries inserted by Spybot - Search & Destroy 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com … … … … # This list is Copyright 2000-2008 Safer Networking Limited # End of entries inserted by Spybot - Search & Destroy
2008-10-06, 14:40
Greyfox

Quote:

Originally Posted by qimqim

My version is 1.6.0
I do not use immunization
The entry started with 127.0.0.1

If SpyBot did not place the entry there, ow could it get there? A virus? But what for?
The Hosts file is definitely SpBot because at the end it has:

# Start of entries inserted by Spybot - Search & Destroy
# This list is Copyright 2000-2008 Safer Networking Limited
# End of entries inserted by Spybot - Search & Destroy

qimqim,
Spybot put its entries in the host file as part of its immunisation process. If you don't use imminisation, then Spybot doesn't put entries in the host file.

Having said that, the three line you have quoted above, when they are together like that indicate that at some stage you have immunised in Spybot and then used the immunise undo. This removes the Spybot entries but leaves the three lines as you see them.

So the important thing now is that something else has placed the entry there, and you need to determine what that something is. Also it indicates that your host file was either not locked when the entry was inserted, or what ever inserted it was able to bypass the lock. Because the entry starts with 127.0.0.1 it is a "blocking" entry, which suggests placement by antispyware or security type software.