Seems like Avast is modifying my hosts.txt file [modified 11/11]

Avast Free Antivirus / Premium Security
1

I don’t know when it is happened first time, my hosts.txt file constantly modified and detected my Security program(AhnLab Safe Transaction[AST]. this program is necessery for Internet Banking in Korea.)

AST detected hosts file modification, and the IP address which added in hosts.txt

119.207.66.177 r6015597.iavs9x.u.avast.com 119.207.65.63 n4464433.vpsnitro.u.avast.com

(Another IP added, I’ll constantly update it)

and similiar IPs every other time.
I can choose options between save hosts file or rollback it, and I chosed both options but it constantly happening.

Is this really Avast’s behavior or something else? What should I do?

(Sorry for my poor english writing skills since I’m not english-native.)

2
  • Which Avast…? (Free/Pro/IS/Premier)
  • Which version…?
  • OS…? (32/64 Bit…? - which SP/Build…?)
  • Other security related software installed…?
  • Which AV(s) did you use before Avast…?
3

Also running AhnLab Safe Transaction and Avast here and got a report of the following line added to hosts file:

23.192.162.201 p9555875.iavs9x.u.avast.com
4

I use the Free version of Avast and there is nothing
in the host file from Avast.

5

I can confirm it
When I try to modify my hosts file to block some ad domains, including avast’s domain, avast is actively deleting its domains

It is due to avast’s self-defense module
solution: temporarily disable self-defense → modify your hosts → right-click to the hosts file → security tab → edit permissions: deny all Write/modify for all users

6

Avast’s self defense protects Avast. It doesn’t protect or prevent you making changes to the host file.

7

I believe it could… I mean, hosts file could be used (e.g. by malware) to block Avast updates etc. - so if Avast domains are inserted, Avast self-defense may removed them.

8

Avast’s SelfDefense does protect Windows’ hosts file, it only makes sure it is clean.

If any changes are detected in the host file, self defense (if enabled) should remove such lines automatically. This is why your host files change back to default and is intentional behaviour.

9

I stand corrected. :slight_smile: