Norton Power Eraser thinks Hosts File by Spybot is Bad

Hello,

 

Last night I ran the new version of NPE and got a result saying that my hosts file is "bad."

 

As far as I know, my only source for a hosts file is the one provided by Safer Networking (the Spybot Search & Destroy folks). I doubt that they would create a hosts file with malicious content.

 

Can anyone fill me in on what may be going on? A false positive, maybe? I trust Spybot and I'm not keen on removing my hosts file.

 

I tried to attach three NPE screenshots (JPG files) so that you could see what NPE displayed, but I got an error message saying that only files with TXT, LOG,and LUE extensions are allowed.  :smileymad:

 

Thanks for any insight you might provide.

 

--JorgeA

 

Hi JorgeA,

 

To post a screenshot follow the instructions here, as you cannot upload images as attachments:

 

http://community.norton.com/t5/Forum-Feedback/Forum-Tip-How-to-post-screenshots-in-the-forum/m-p/254415/highlight/true#M6103

 

I don't know about NPE specifically, but some aggressive scanners like this will notify you about any changes detected in the hosts file, since malware often manipulates the hosts file to prevent users from being able to connect to security sites to download programs or updates.  When using programs like NPE it is important to realize that not everything they present to you is malicious, and you do have to make informed judgements on what steps to take with the scan results.

Hi SendOfJive,

 

Thanks very much for the link, and for the information. I do suspect that a false positive is involved, which is why I didn't allow NPE to delete the hosts file.

 

Here are the screenshots:

 

NPEhosts1.jpg

NPEhosts2.jpg

NPEhosts3.jpg

 

Pretty cool image insertion feature, now that I know about it!  :smileyhappy:

 

Hopefully this will provide some insight as to what's going on.

 

Thanks again!

 

--JorgeA

 

Hello JorgeA,

 

Norton Power Eraser is meant to be more agressive to be able to clean up the more entrenched threats.  This may cause FPs but we are constantly improving NPE to mitigate this side effect.  If you believe it to be safe, and have not noticed any suspicious behavior on your computer, you should be ok.

 

Thank you for trying NPE and providing feedback.

 

Regards,

Makoto