Host file and Defender

[Betty]

Defender is reporting my custom host file as a high level alert and a
possible hijack. The host file I use comes from
http://www.everythingisnt.com/hosts.html and I doubt very much that there is
anything wrong with it.

Just for added information I am using Windows XP Pro with SP2.

Betty

 

[Guest]

I am also seeing this with a modified hosts file.

 

[Guest]

MSAS always reacted when I installed the Spybot S&D Hosts File, but it did
not give much info. Windows Defender will let you "allow" your Hosts File,
and then you can view what changes it is alerting you to. Now it shows all
the entries in the hosts file. If you know it's safe because you are putting
it there, just ALLOW or IGNORE it. Make sure you don't automatically chose to
block.

 

[Betty]

Good advice, Rebel. MSAS never gave me a problem about the Host file so I
was surprised when Defender did. I downloaded and installed a fresh copy of
the file just to be sure and then I told Defender to Allow it. I can't find
where I can view what changes it is alerting me to though.

Betty

 

[Guest]

Look under Deefender's "History" section.

 

[Guest]

I have a custom HOSTS file and so the first night it ran the scheduled quick
scan and came up with the "Possible Hosts File Hijack" result, I understood.
I set it to Ignore and figured that was the last I'd have to do with it.
Well, every scan it does it still flips out about my HOSTS file. It still
wants me to take some action, even though I have it set to ignore. This
surely isn't proper behavior or is WinDef designed so that "ignore" really
doesn't mean leave it alone? (MSASbeta never had this problem, by the way.)

 

[Guest]

Ok, I replied to this post a few minutes ago and it doesn't show up yet, but
in case it does at some point, I had said I used "ignore" and it would always
come back... duh.
Double "duh" with an "dumb" on top. Sorry, just changed it to "Allow Always".

Despite my temporary stupidity, perhaps "Ignore" should be changed to
"Ignore Once", to make it more clear that it only applies to the last scan
and not future scans like the "Allow Always" does? *shrug*