Reply
Super Contributor
siliconman01
Posts: 241
Registered: 04-10-2008
0

Improperly flagging valid entries in HOSTS file

The Norton Security Inspector does not properly handle valid IP address entries in the HOSTS file.  There are many users who utilize the HOSTS file to block invalid websites and ads via such security programs as HostsMan.  Entries such as the list below should not be flagged as insecure by NSI.  NSI will remove everything but 127.0.0.1 localhost and ::1   localhost.  NSI should be "refined" to recognize the difference between valid and malicious entries in the HOSTS file.

 

127.0.0.1  localhost
::1        localhost
127.0.0.1  ad.a8.net
127.0.0.1  asy.a8ww.net
127.0.0.1  a9rhiwa.cn #[Google.Warning]
127.0.0.1  www.a9rhiwa.cn
127.0.0.1  acezip.net #[SiteAdvisor.acezip.net]
127.0.0.1  www.acezip.net #[Win32/Adware.180Solutions]
127.0.0.1  phpadsnew.abac.com
127.0.0.1  a.abnad.net
127.0.0.1  b.abnad.net
127.0.0.1  c.abnad.net #[eTrust.Tracking.Cookie]
127.0.0.1  d.abnad.net
127.0.0.1  e.abnad.net
127.0.0.1  t.abnad.net
127.0.0.1  z.abnad.net
127.0.0.1  banners.absolpublisher.com
127.0.0.1  tracking.absolstats.com
127.0.0.1  adv.abv.bg
127.0.0.1  bimg.abv.bg
127.0.0.1  www2.a-counter.kiev.ua
127.0.0.1  track.acclaimnetwork.com
127.0.0.1  accuserveadsystem.com
127.0.0.1  www.accuserveadsystem.com
127.0.0.1  gtb5.acecounter.com
127.0.0.1  gtcc1.acecounter.com

____________________________________________
Dell XPS 410 & Vostro 220s with 8/4 gbyte RAM, Intel 2-Core 2.66/2.93 ghz, Win 7 x64 Professional & Win 7 x86 Professional, dual 300/150 gbyte VelociRaptor/Raptor HDDs, Cable Modem, NIS 2010, TrojanHunter V5.2, HostsMan V3.2.71B7, SpywareBlaster, SAS and MBAM on demand, Casper V5.0 Backup
Contributor
pbjtime
Posts: 22
Registered: 05-14-2009
0

Re: Improperly flagging valid entries in HOSTS file

I talked to someone who knows quite a bit more than I about NSI, and he has informed me that it's a good bet that NSI may have been flagging your hosts file as insecure because it's not set to read only (If that is indeed the case) - A hosts file, he says, might only be considered secure if it's set to "read only" in order to help prevent malicious software from infecting it. Have you tried setting it to read only and seeing if NSI stops flagging it?

 

Let me know how it turns out, and if that doesn't fix your problem, I'll do a little bit of digging for you! :-P