On my XPSP2 computer, my hosts file has only one line local hosts. On my new Vista computer, Spybot Search & destroy 1.5.1.15 added a bunch of other lines with the same IP number, OK, but different web sites, with some sex content etc… (never been, but it’s a guess…). Am I invaded? Should I worry?
On contrary, your Vista computer has the latest Spybot version while the other, the XP, hasn’t or has that features disabled. It’s a new layer of Spybot protection.
There has been a similar post in the forums where we believe that a number of entries in the HOSTS file were created (mainly security based web shits) purporting to be Spybot S&D entries.
The HOSTS file can be used to effectively block malicious/adult sites, etc. but some malware also writes to the file to block anti-virus sites to prevent access to remove malware.
If you can post the contents of the Vista HOSTS file here and we can check it out.
But some malware also writes to the file to block anti-virus sites to prevent access to remove malware.If anybody does not know, WinPatrol and Spybot could prevent malware to write on HOSTS file.
Thanks, (for prompt reply). I tried to copy paste the hosts file here or to send it as attachment but failed because I wasn’t smart enough to save it as .txt (…). Sorry, I’m not in shape. Here is the file but thanks to Tech I’m reassured a lot and now think in effect it’s the new version of Spybot that does the trick.
Well that looks legit (only a quick look) but my god what a monster of a hosts file.
In fact, on my new Vista, I have Norton internet suite installed as trial. I just runned the inspector and he fixed the hosts file in one line (like on my XPSP2) telling me it was unsecure for IP addresses. Now, what’s wrong with Spybot search and destroy 1.5??? I found a bug because it wouldn’t give my IE and hosts file all protection points at first after installing. I decided to uncheck one of the item in IE and to immunize and it fully immunized everything left. I then finished the job. Still unexplained behavior. My Acer PC is optimized for Norton but as a AVAST LOVER I am studying with great intensity the day when I will decide to go with it on VISTA since it did a GREAT JOB for the past 5-6 years on XP on my old PC. Thanks all… 
Your first hosts file contains entries placed tere by spybot. They would be the entries between # Start of entries inserted by Spybot - Search & Destroy and # This list is Copyright 2000-2007 Safer Networking Limited
End of entries inserted by Spybot - Search & Destroy
The ip 127.0.0.1 is the address for localhost, in this case your computer. Spybot has assigned this address to all the names in the list. When to try to access an address, windows first checks the hosts file. If the name you enter matches a name in the hosts file, the address in the host file will be the one your browser will attempt to reach. By using 127.0.0.1, your browser will look for the site on your computer. Since it’s not there, no page will open.
In my opinion SB has added protection by not allowing you to access these sites. SB seems to be working properly.
Well, in this case, it’s totally wrong for the first hosts file originally posted (the wrong one). For example, it will allow access to a porn/sex site without me wanting it to be. How can it be permitted (SB). Why is Norton correcting the hosts file back to normal? Thanks!
Spybot has a huge host file. You don’t even want to see mine. ;D
Any of the sites listed in the first hosts file will not be accessable. Sites other than those listed will be accessable.
As far a normal, well it depends on what normal is. A hosts file with just the one listing or two listings in the case of vista, is the default hosts file. You can add any site you want blocked simply by adding it to the file porceded bu the 127.0.0.1 address.
For a better understanding of the hosts file and what it can do check this out
http://www.download.com/How-to-Lock-Down-Your-Hosts-File/1200-2023_4-5144149.html
As for norton returnning the file back to “normal”, well it probably recognized the sites as sites not wise to visit and removed them not knowing how they got there.
Norton? Do you use Norton?
Just on his vista computer. It seems norton is removing the spybot entries from the hosts file and reseting it to “normal”. He seems happy with that.
Happy? Or it’s a conflict or the dual programs are colliding each other: one does and the other removes…
I get the feeling that he feels that the spybot entries in the hosts file are due to a bug in spybot. If I’m wrong, he can correct me.
We know it’s not truth. It’s not a Spybot malfunction, on contrary, it’s a good feature.
Yes, Tech, I agree with you.
I don’t know how the norton feature works, but you would think it would ask first before it removed entried from the hosts file.
Yes,
People, thanks!!! I think I got it. It’s a new layer of protection offered by the new SB Search & Destroy 1.5 and as of Norton they simply are not aware of this improvement. I was suspicious since I already had problems with my hosts file. As for Norton, I expect to try it for few days just to test it. Works fine on Vista Home Premium (stable) but I don’t like it updating its virus definition files almost once a week (less false positives?..). Conclusion, it’s certainly not worth its $70.00 a year (Internet suite-the firewall is ‘poor’ as the AV, I guess…). ???
I would not pay .07 cents for Norton and it will be doing your computer an injustice by deleting Spybot’s host file entries. >:(
You’re right. It does not worth… you’ll make your computer faster is you install other antivirus besides Norton.