hosts file, BitDefender, AVG

[sobriquet]

Hello.
Since a while, when I look up words in the online dictionary, Merriam-
Webster I encounter a problem, presumably due to certain ads on the
page:
http://www.m-w.com
Sometimes IE suddenly navigates away from the page unexpectedly and
jumps to the bottom right corner of the screen pointed at a different
url with a notification popping up, as can be seen in the following
screenshot:
http://www.ibbu.nl/~nsprakel/drivecleaner_x.jpg

So the notification from IE pops up with a msg in Dutch and the choice
to accept or cancel installing drivecleaner,
http://www.ibbu.nl/~nsprakel/drivecleaner_note.jpg
as well as a small browser window in the bottom right corner pointed
at their site.
When I cancel or close the notification, I end up at the site visible
in the next screenshot:
http://www.ibbu.nl/~nsprakel/drivecleaner_url.jpg

Or at a similar site, visible in this screenshot:
http://www.ibbu.nl/~nsprakel/errorsafe.jpg

So, I thought, maybe I can use the hosts file:
C:\WINDOWS\system32\drivers\etc\hosts

to redirect urls like that with the line

"127.0.0.1 nl.errorsafe.com"

added to that hosts text file.

But it seems something recovers the original hosts file and eliminates
the line that was added manually. Does anyone know if this is done by
BitDefender, AVG or by the Windows XP Pro (SP2) system itself and
whether and how I can modify these settings?
Or perhaps a better way to get rid of this annoying behavior of
unwanted websites that spontaneously come up when I look up words at
www.m-w.com?

Thx in advance for any feedback, Niek

 

[Mike]

But it seems something recovers the original hosts file and eliminates
the line that was added manually. Does anyone know if this is done by
BitDefender, AVG or by the Windows XP Pro (SP2) system itself and
whether and how I can modify these settings?

Try spybot S&D - this has the option to block updates to the hosts file

 

[What's in a Name?]

snip <
But it seems something recovers the original hosts file and
eliminates the line that was added manually. Does anyone know if
this is done by BitDefender, AVG or by the Windows XP Pro (SP2)
system itself and whether and how I can modify these settings?

I don't think that the free version of BitDefender has a setting for
locking the hosts file. AVG Anti-Spyware does. XP doesn't lock it
either.

Or perhaps a better way to get rid of this annoying behavior of
unwanted websites that spontaneously come up when I look up words
at www.m-w.com?

How about using Firefox with NoScript and AdBlock extensions
installed instead of IE?
Try SuperAdBlocker or a better AV solution like NOD32.

max

 

[Jim]

Hello.
Since a while, when I look up words in the online dictionary, Merriam-
Webster I encounter a problem, presumably due to certain ads on the
page:
http://www.m-w.com
Sometimes IE suddenly navigates away from the page unexpectedly and
jumps to the bottom right corner of the screen pointed at a different
url with a notification popping up, as can be seen in the following
screenshot:
http://www.ibbu.nl/~nsprakel/drivecleaner_x.jpg

So the notification from IE pops up with a msg in Dutch and the choice
to accept or cancel installing drivecleaner,
http://www.ibbu.nl/~nsprakel/drivecleaner_note.jpg
as well as a small browser window in the bottom right corner pointed
at their site.
When I cancel or close the notification, I end up at the site visible
in the next screenshot:
http://www.ibbu.nl/~nsprakel/drivecleaner_url.jpg

Or at a similar site, visible in this screenshot:
http://www.ibbu.nl/~nsprakel/errorsafe.jpg

So, I thought, maybe I can use the hosts file:
C:\WINDOWS\system32\drivers\etc\hosts

to redirect urls like that with the line

"127.0.0.1 nl.errorsafe.com"

added to that hosts text file.

But it seems something recovers the original hosts file and eliminates
the line that was added manually. Does anyone know if this is done by
BitDefender, AVG or by the Windows XP Pro (SP2) system itself and
whether and how I can modify these settings?
Or perhaps a better way to get rid of this annoying behavior of
unwanted websites that spontaneously come up when I look up words at
www.m-w.com?

Thx in advance for any feedback, Niek

None of the above will do that. Instead, it is the malware that is sending
you to all of those strange places.
Since it is well known what the contents of the HOSTS file must be, malware
can just download its own copy.
I would try setting the file as read only.

Jim