hosts files 2

[lunatic23]

hey guys,

i was looking in my windows folder and i've found two separate hosts files

hosts.sam
and
hosts

hosts.sam only has the 127.0.0.1 localhost, but hosts has 193.125.201.46 worlds*x.com 193.125.201.46

http://www.worlds*x.com.

why have i got two separate hosts files? is it safe to delete this explicit hosts file?

thanks much
luni


someone once told me to shut up...

 

[Accessdabbler]

I believe hosts.sam is the backup of hosts. Just delete the entry in hosts for

http://www.worlds*x.com

 

[carrr]

.sam files are map files (i.e. they map IPs)

You can delete the porn URL, but I'd not delete the whole file.

Then I'd run SpyBot (after checking for updates):

http://www.safer-networking.org/

 

[lunatic23]

i ran spybot [just doing a general clear out] before i found the hosts files and it didn't pick anything up...

but i'll definetly delete the entries and keep an eye on it.

thanks again
luni

someone once told me to shut up...

 

[bcastner]

.sam files are (sam)ple files.
Without a registry edit, Windows will only look at HOSTS as a filename (without any extension).

 

[lunatic23]

so could the addresses be put there automatically by spyware/bugs etc or must it be done manually?

thanks
luni

someone once told me to shut up...

 

[carrr]

Spyware/malware/virus(e/s) have been known to do it.
And, just as you can manually remove it, it could have been manually put there (though it seems unlikely).

 

[lunatic23]

thanks for the help everyone, the entries are deleted and spybot searches are clear but i will keep an eye on them for anything else


thanks again
luni

i like anything fast enough to do something stupid in..

 

[lunatic23]

sorry to bring it back up but i've also found 5 backup hosts files called hosts.[YYYYMMDD-HHMMSS].backup, with various different dates & times all listing the same websites from above plus some more.

does windows usually automatically backup the hosts files if they're/its changed?

thanks
luni

i like anything fast enough to do something stupid in..

 

[bcastner]

lunatic,

It most certainly does not. I suspect the Qhosts trojan is at work on your machine.

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html

You might consider running the Trend Micro and the Panda online virus scanners from smah's FAQ: faq760-3862

 

[lunatic23]

thanks bcastner,

i've downloaded that and will run it shortly & post back the results

thanks again
luni

i like anything fast enough to do something stupid in..

 

[lunatic23]

sorry for the late reply,

bcastner, i've tried all you suggested and nothing was found: the qhosts fix said my machine was clean, and i ran thru the online virus checkers and they finished clean too.

i don't really understand what the qhosts trojan does with regards to DNS settings but it doesn't seem to be affecting my web browsing

thanks
luni

i like anything fast enough to do something stupid in..

 

[bcastner]

lunatic,

Good, you really did not want the qhosts problem.

I am assuming you did as carr suggested above to make certain your HOSTS file was clean.

Now clean your winsock service:

http://members.shaw.ca/techcd/VB_Projects/WinsockFix.zip

 

[lunatic23]

my hosts file is spotless, i cleaned the winsock service and the backup files have been deleted. hopefully this is the end of this fiasco.

thanks for the help guys
luni

i like anything fast enough to do something stupid in..