Trojan in Spybot or False positive

[johnwrites]

According to ewido security suite C:\Program Files\Spybot - Search & Destroy\Includes\Hosts.sbs -> Trojan.Qhost.ew : Cleaned with backup

Google brought me to http://forum.hijackthis.de/archive/i...p/t-11630.html but I cannot understand this.
http://securityresponse.symantec.com...an.qhosts.html says the defs for this infection are 2 years old and I am up to date so why did NAV not flag it?

I have quarantined it in ewido. Will Spybot work OK
Thanks
johnwrites

[md usa spybot fan]

The Hosts.sbs file is used by the Spybot Hosts file facility. Without that file if you go into:

• Spybot > Mode > Advanced Mode > Tools > Hosts file

You will notice that the following buttons are no longer active:

• "Add Spybot S&D hosts list"
• "Remove Spybot S&D hosts list"

I don't know if you will encounter any other problems with Spybot without that file. I suggest that you restore the file and report the problem to ewido.

[johnwrites]

Thanks do you know if it is a false positive? I do not understand how Spybot could be infected and i cannot find much through Google I might just donload and install a clean copy of spybot

johnwrites

[md usa spybot fan]

It is probably a false positive. It appears that there were several reported problems with not only Spybot but also with the scans of the HOSTS file. See:
Ewido found something new...
http://reviews.cnet.com/5208-6132_7-...hreadID=139759

In that thread I didn’t notice any positive feed back from Ewido specifically about the Hosts.sbs file although Ewido indicated some of the problems were false positives:
''Pipeline'' and ''411'' / Ewido...says false positives..
http://reviews.cnet.com/5208-6132-0....sageID=1570396

Report the problem to Ewido and send them the file to be sure.

[johnwrites]

Thanks for the link.I googled but did not find that. ewido have confirmed to me that it was a False ositive and they have now fixed it
Thanks again
Johnwrites