- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic to the Top
- Bookmark
- Subscribe
- Printer Friendly Page
Improperly flagging valid entries in HOSTS file
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Email to a Friend
- Notify Moderator
10-18-2008 09:53 PM
The Norton Security Inspector does not properly handle valid IP address entries in the HOSTS file. There are many users who utilize the HOSTS file to block invalid websites and ads via such security programs as HostsMan. Entries such as the list below should not be flagged as insecure by NSI. NSI will remove everything but 127.0.0.1 localhost and ::1 localhost. NSI should be "refined" to recognize the difference between valid and malicious entries in the HOSTS file.
127.0.0.1 localhost
::1 localhost
127.0.0.1 ad.a8.net
127.0.0.1 asy.a8ww.net
127.0.0.1 a9rhiwa.cn #[Google.Warning]
127.0.0.1 www.a9rhiwa.cn
127.0.0.1 acezip.net #[SiteAdvisor.acezip.net]
127.0.0.1 www.acezip.net #[Win32/Adware.180Solutions]
127.0.0.1 phpadsnew.abac.com
127.0.0.1 a.abnad.net
127.0.0.1 b.abnad.net
127.0.0.1 c.abnad.net #[eTrust.Tracking.Cookie]
127.0.0.1 d.abnad.net
127.0.0.1 e.abnad.net
127.0.0.1 t.abnad.net
127.0.0.1 z.abnad.net
127.0.0.1 banners.absolpublisher.com
127.0.0.1 tracking.absolstats.com
127.0.0.1 adv.abv.bg
127.0.0.1 bimg.abv.bg
127.0.0.1 www2.a-counter.kiev.ua
127.0.0.1 track.acclaimnetwork.com
127.0.0.1 accuserveadsystem.com
127.0.0.1 www.accuserveadsystem.com
127.0.0.1 gtb5.acecounter.com
127.0.0.1 gtcc1.acecounter.com
Dell XPS 410 & Vostro 220s with 8/4 gbyte RAM, Intel 2-Core 2.66/2.93 ghz, Win 7 x64 Professional & Win 7 x86 Professional, dual 300/150 gbyte VelociRaptor/Raptor HDDs, Cable Modem, NIS 2010, TrojanHunter V5.2, HostsMan V3.2.71B7, SpywareBlaster, SAS and MBAM on demand, Casper V5.0 Backup
Re: Improperly flagging valid entries in HOSTS file
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Email to a Friend
- Notify Moderator
05-14-2009 05:41 PM
I talked to someone who knows quite a bit more than I about NSI, and he has informed me that it's a good bet that NSI may have been flagging your hosts file as insecure because it's not set to read only (If that is indeed the case) - A hosts file, he says, might only be considered secure if it's set to "read only" in order to help prevent malicious software from infecting it. Have you tried setting it to read only and seeing if NSI stops flagging it?
Let me know how it turns out, and if that doesn't fix your problem, I'll do a little bit of digging for you! :-P
