[perfume]

Dear friends,
Of late, my FF3 browser has been acting up and today i have run Windows defender and it showed a single problem as i will desribe below.

I visited the Microsoft Malware Detection Center and it explained what was found as " Trojan.Win32.qhost" and i cleaned it up!

Then i visited the "Hosts file" via command prompt and i received this message from Notepad"Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
# Begin GZapper

# End GZapper# Begin GZapper

# End GZapper# Begin GZapper

# End GZapper"

I am able to access any website of my choice and i do not touch unsafe websites and it includes torrent web sites or porn sites ( i need not, Paris has enough live scenes to view, they smooch on the pavements! )!

I have just ran a Sophos anti-rootkit and it came up with no problems found!

All the above info', i am typing from FF3 and i have neatly divided into paragraphs and if you see the whole thing as one saga, kindly excuse me and please clarify as to why all this is happening?

How do i go about re-creating a "new" and "clean" Hosts file ? Thanks in advance! will be grateful for constructive suggestions! Kindly view this link:http://www.microsoft.com/security/po...08427027806866

[perfume]

Dear Gizzy,
Hey, my smilies are back again, but i seem to be in a bigger bowl of soup!

[perfume]

Oh, i am really sorry as i forgot to post a thumbnail of what Windows Defender came up with :

[gurutech]

Looks like Defender cleaned the malware entries from the HOSTS file (at least the ones that weren't commented out.

Anything below the "127.0.0.1 localhost" line is safe to delete (is probably related to the malware).

I'd suggest downloading a copy of Spybot S&D (www.spybot.info) and make sure to install the "Tea Timer" app - it will add entries to your hosts file for known malware sites with an IP address of 127.0.0.1. Basically this re-routes any attempt to go to a known malware site back to your local machine instead of the malware site itself.

It's a great app (FREE!!!) and is much better than WinDefender.

[perfume]

Dear gurutech,
Thanks for the fast reply! Yes, i have used Spybot S&D in the past and of late when i was installing Kaspersky Internet Security Suite 2009, there was a conflict as KIS demanded that i delete Spybot which i had to! So, no Tea-Timer for me!

KIS2009 is very zealous and does not tolerate any program which"it" considers as unwanted and puts it in the "highly restricted Zone" with "limited Functionality"! It was prompting me like crazy that Sophos is "dangerous" and it offered to kill it, but i was merciful and saved Sophos anti-rootkit!

Now, how do i go about creating a new hosts file, as the previous one seems to be compromised?

[perfume]

By the way, i am going to delete Sophos as KIS2009 demanded!

[perfume]

I submitted the Hosts file to jott's online malware scan and kindly view this thumbnail! :

[Phantom010]

Dear Perfume,

Here's some info on how to deal with your Hosts file:

The first step in editing your HOSTS file is to find it.
It's located in C:\Windows\System32\Drivers\Etc.

Examine the content of your HOSTS file, and compare it to the screenshot below. We do not need to worry about any line that begins with an # because is ignored by Windows. Also, the line "127.0.0.1 localhost" can be safely ignored, because it is a standard entry.


A HOSTS file can be used to control Web page to IP address associations.

Anything else that appears in your HOSTS file without an # at the beginning, apart from the "127.0.0.1 localhost" line, should be viewed with suspicion when we are trying to diagnose the cause of "Page cannot be displayed" errors. The quickest way to test for HOSTS file involvement is to right click the HOSTS file, then select Rename. Add the letter X to the beginning or end of the file name and then ok your changes. By changing the name of the HOSTS file, we stop Internet Explorer from using it, and therefore resolve any issues caused by the file.

[Cookiegal]

Have you just started using G-Zapper?

[aka Brett]

perfume you can use spybot without conflict if tea timer is disabled
there is a section in tools to add the spybot hosts file so tea timer isnt needed.
without tea timer checked spybot doesnt run in memory and will run happily with other programs
edit
should anyway

[perfume]

Dear cookiegal,
i've been using G-Zapper since three months! Thank you! Do you suggest i remove it?

Dear phantom010,
will do as you directed me to, and will get back ASAP!(These folks who smooch standing on the pavements of Paris are a sight for sore eyes! you can imagine what's happening in the gardens we have!)

Dear brett888,
Man, i've missed your company in this forum! Scout's honour! Now what you posted is a great piece of news! Thanks a lot! Keep visiting us!

[perfume]

Dear phantom010,
Thanks to you, i think we have caught the culprit! I am posting four thumbnails and kindly go thru' them and tell me what to do next! Here it goes:

[aka Brett]

perfume
here is my hosts file from my xp side
it will open in notepad as i put txt file extension on it
open it and view it as this is what a good hosts file looks like.
if you want to use it while you are working on your own
then rename your hosts file to hostsold
save mine to the desktop and rename it hosts
then copy and paste in the folder where you old hosts is
you can have a spybot hosts file without having to have spybot
cheers
edit
there are better hosts files out there that the above..but the back button doesnt always work correctly with some others...i have never had a problem with spybots hosts file

[perfume]

Dear brett888,
You've again proved that inside you beats a heart of "Gold"! Can't express my gratitude in mere words, as they are so dry and unemotional in nature! Just can't thank you enough!

PS: which forum do you frequent most?

[perfume]

Originally Posted by brett888

perfume
here is my hosts file from my xp side
it will open in notepad as i put txt file extension on it
open it and view it as this is what a good hosts file looks like.
if you want to use it while you are working on your own
then rename your hosts file to hostsold
save mine to the desktop and rename it hosts
then copy and paste in the folder where you old hosts is
you can have a spybot hosts file without having to have spybot
cheers
edit
there are better hosts files out there that the above..but the back button doesnt always work correctly with some others...i have never had a problem with spybots hosts file

Dear brett888,
I just put the notepad you gave in the same folder where my HOSTS file is located, after saving your's to the desktop! Kindly explain how the notepad's mere presence in the folder works as a spybot? Excuse my confusion! Now that you've gone thru' my thumbnails in the post i addressed to phantom010, what's your verdict? Corrupted or not? I can see the second thumbnail looks like "gibberish",isn't it?

By the way is obomba related to your President Obama? Is he into Bomb-manufacture? A few bombs on these hypocrites would do a world of good in my country!