|
|
|
|
| Author |
Message |
kony
Guest
|
 Posted: Fri Jul 09, 2004 4:04 pm Post subject: Re: virus? |
 |
|
On Fri, 09 Jul 2004 08:42:17 -0500, David Maynard
<dNOTmayn@ev1.net> wrote:
| Quote: | jch wrote:
HOSTS is a valid name for legitimate files within Windows. This article
would incorrectly lead one to believe that just because HOSTS appears in a
search on their system that they are infected with some strange virus. Not
the case. For example. c:\windows\system32\drivers\etc\HOSTS is a legitimate
file at least on my XP Pro system. A search could turn up many other valid
entries containing the name HOSTS. Do the proper research and avoid running
off deleting files from your hard drive.
Good advice but only if they misread what was written. The problem found,
as stated, is correct: a 'hijack' where a gaggle of websites are entered
into the HOSTS file, the same one you correctly point out is a standard
Windows file, with a single IP address for all of them thereby directing
the machine to go there for every site listed.
And he corrected that particular problem by removing the bogus ENTRIES in
the hosts file and re-saving it.
He should have, however, left
127.0.0.1 localhost
in it.
|
It's not a bad idea to have a backup of the hosts file or at
least be familar with it's location so it can be retrieved from a
larger backup set... Don't know about what the typical user does
(probably no editing of hosts file at all) but mine is large
enough it could take days to edit it. |
|
| Back to top |
|
 |
Fix your Windows Problems - FAST.
FREE Safe Scan Registry Check. Locate & Fix Errors in Minutes!
|
|
David Maynard
Guest
|
| Posted: Sat Jul 10, 2004 1:06 am Post subject: Re: virus? |
|
|
kony wrote:
| Quote: | On Fri, 09 Jul 2004 08:42:17 -0500, David Maynard
dNOTmayn@ev1.net> wrote:
jch wrote:
HOSTS is a valid name for legitimate files within Windows. This article
would incorrectly lead one to believe that just because HOSTS appears in a
search on their system that they are infected with some strange virus. Not
the case. For example. c:\windows\system32\drivers\etc\HOSTS is a legitimate
file at least on my XP Pro system. A search could turn up many other valid
entries containing the name HOSTS. Do the proper research and avoid running
off deleting files from your hard drive.
Good advice but only if they misread what was written. The problem found,
as stated, is correct: a 'hijack' where a gaggle of websites are entered
into the HOSTS file, the same one you correctly point out is a standard
Windows file, with a single IP address for all of them thereby directing
the machine to go there for every site listed.
And he corrected that particular problem by removing the bogus ENTRIES in
the hosts file and re-saving it.
He should have, however, left
127.0.0.1 localhost
in it.
It's not a bad idea to have a backup of the hosts file or at
least be familar with it's location so it can be retrieved from a
larger backup set...
|
Yeah. Just like any 'user data': back it up or run the risk of losing it.
| Quote: | Don't know about what the typical user does
(probably no editing of hosts file at all) but mine is large
enough it could take days to edit it.
|
The typical user won't be manually editing ANY file of that kind, at least
not under normal circumstances. They just expect things to 'work'.
I'm curious, what all do you have in it and why? |
|
| Back to top |
|
|
kony
Guest
|
| Posted: Sat Jul 10, 2004 4:08 am Post subject: Re: virus? |
|
|
On Fri, 09 Jul 2004 18:55:31 -0500, David Maynard
<dNOTmayn@ev1.net> wrote:
| Quote: | I'm curious, what all do you have in it and why?
|
Tons of stuff, like routers and other remote systems, but mostly
blocked 'site like SW Flash downloads, other ads, popup
sources... I entered many myself but the majority are appended
from several host lists I've come across sporadically. |
|
| Back to top |
|
|
David Maynard
Guest
|
| Posted: Sat Jul 10, 2004 5:14 am Post subject: Re: virus? |
|
|
kony wrote:
| Quote: | On Fri, 09 Jul 2004 18:55:31 -0500, David Maynard
dNOTmayn@ev1.net> wrote:
I'm curious, what all do you have in it and why?
Tons of stuff, like routers and other remote systems, but mostly
blocked 'site like SW Flash downloads, other ads, popup
sources... I entered many myself but the majority are appended
from several host lists I've come across sporadically.
|
I see. |
|
| Back to top |
|
|
sozekizer
Member
Joined: 09 Aug 2004
Posts: 1
|
| Posted: Mon Aug 09, 2004 2:46 pm Post subject: Re: virus? |
|
|
The problem w/ Spybot in dealing w/ E-shredder is that it does not pick up the 2 extra explorers that are now installed on your pc.
This is from computer cops:
1.Restart the computer in safe mode/safe mode command prompt.
2.Go to the windows\system32 directory
3.Find and delete explorer.exe & system32.dll (ONLY from the windows\system32 directory)
4.Go to the windows\ directory & delete secure.html
5.Restart the computer
6.Search for files called "HOSTS" (with no file extention) & delete them (usually 2)
7.Modify your homepage settings in IE to your favourite homepage.
8.Restart your computer & run all your programs to check you have a sucessfull "erradication".
I spent 3 hrs on a friend's computer running -multiple times- Spybot and Adware. I was able to erradicate everything except for eshredder (didn't have the above info at the time). It seems that this is THE solution. I just haven't had time to do it.
Good luck to you. |
|
| Back to top |
|
|
|
|
|
|
| |
Watched Topics
Search
Register
Log in to check your private messages
Profile
Log in
Memberlist
Usergroups