Question on Spyware Doctor scan results - false positives in HOSTS file?

[mishelle10878]

After about a 3 hour scan, my unregistered (so far) copy of Spyware Doctor
found what it called 17 infections. 9 were “known bad sites” IE in my
FAVORITES folder, and 8 were “Possible website Hijacks” in my HOSTS file.

I can delete some of the favorites, although most of them are benign forum
links which McAfee’s Siteadvisor doesn’t recognize as bad. I was under the
impression that if you don’t visit the url’s, and just have them as a
favorite, it can’t cause any harm.

Regarding the HOSTS “possible website hijacks”:

All 8 sites have 127.0.0.1 before the entry in the Spyware Doctor log. I
was under the assumption that this BLOCKS any hijack and ensures that the
browser is redirected to a blank home page. If so, why is “Spyware Doctor”
picking this up?

For example, one entry is

(1468) 127.0.0.1 vbs.t35.com - Indicates that a known good site may be
hijacked.

If this is all Spyware Doctor picks up, I don’t think it’s worth it. It
may be a good program to shield future malware, but between all the free
(non-rogue) anti-spyware programs and the very good free AV programs with
their multi-shield capability, it seems like enough.

My HOSTS file and IE-Spyad may be causing my browser to hang with 130 mg of
mem usage in resident memory, but it seems to be blocking most of the junk
out there.

 

[mishelle10878]

(e-mail address removed) wrote in

Regarding the HOSTS “possible website hijacks”:

All 8 sites have 127.0.0.1 before the entry in the Spyware Doctor log.
I was under the assumption that this BLOCKS any hijack and ensures
that the browser is redirected to a blank home page. If so, why is
“Spyware Doctor” picking this up?

For example, one entry is

(1468) 127.0.0.1 vbs.t35.com - Indicates that a known good site
may be hijacked.

If this is all Spyware Doctor picks up, I don’t think it’s worth it.
It may be a good program to shield future malware, but between all the
free (non-rogue) anti-spyware programs and the very good free AV
programs with their multi-shield capability, it seems like enough.

My HOSTS file and IE-Spyad may be causing my browser to hang with 130
mg of mem usage in resident memory, but it seems to be blocking most
of the junk out there.

In answer to my own question, I just found the following:

http://www.mvps.org/winhelp2002/hostsfaq.htm#Doctor


Why does Spyware Doctor report "Possible Website Hijack" in the HOSTS
file?

This is a false detection and can be Ignored ... you can place these
items in the "Ignore List" or if it becomes a problem - turn off hosts
protection (on Network Guard screen). PCTools has been notified but has
not corrected this problem.

 

[see.cher]

many anti spyware products report this about the HOSTS file.
They just don't like it being modified.