I have a virus

[andyzammy]

mm yes o dear.

my hosts file is infected, and AVG Free can't sort it out. does anyone know how to remove the virus? will i spoil my computer if i just delete the hosts file?

if you have suggestions for programs, make them free ones

[Blake Seven]

www.trendmicro.com Free Housecall is pretty effective as far as a free service goes.

It's an online service which isn't everyone's cup of tea but I've found viruses and spy/greyware with it that other apps have missed.

[e-lite]

Just open the hosts file with any texteditor and manually edit away the bad parts of it. It should be pretty obvious what parts in the file that is bad. It should be more or less empty as per default.

the file should look something like this:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host
127.0.0.1       localhost

file is located at something like this:

C:\WINNT\system32\drivers\etc\hosts

[Mega]

AVG is good

I would recommend you try out their spyware program (use to be Ewido)

also Hijack This is excellent:

http://www.spywareinfo.com/~merijn/programs.php



Good luck!

[Etopia]

host file can be deletted , and you create a TXT file that you call host.
You really dont need it.its list of ip , that windows read , but never update or use...


Here what that file should contain :

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

[Dom_sufc]

Wow, loads of useful simultaneous posts. This community rocks

Good luck Andy!

Remember though, prevention Is always better than the cure...

[andyzammy]

i deleted the file but when i scanned again to double check, avg is acting like its still there and it is still infected

[Mega]

Originally Posted by andyzammy

i deleted the file but when i scanned again to double check, avg is acting like its still there and it is still infected

Have a go with Hijack This.

[Helmars]

hosts file itself can't contain viruses. You have to find out WHAT changed it. Most likely that program is still there. I suggest to download autoruns from microsoft.com. This tool lists all executable files that are started automatically.

[Etopia]

Originally Posted by Helmars

hosts file itself can't contain viruses. You have to find out WHAT changed it. Most likely that program is still there. I suggest to download autoruns from microsoft.com. This tool lists all executable files that are started automatically.

Autorun was a sysinternal tool , bouth by microsoft.
So now M$ have a bunch zillion of very very good free tool.

I recomend , autorun , process explorer , and som monitor , like regmon and filemon...


If something have strange behavior with you host file you must find it with one of those tool .