Potential Threats Detected! HOSTS file

[SierraFoothills]

I got a notice this week "Hijack.Host". I use Hostman which fills my HOSTS file with ~914,000 unwanted domain names that are pointed to 127.0.0.1. I have been using Hostman all along but got the notice an a couple of computers this week, all at the same time.

 

This appears to be a false positive and I allowed it and added to the Malware Exclusions list. I just wanted to check and see if this is really what is happening.

[David H. Lipman]

Since a large etc/hosts file is NOT normal it should be flagged, intended modifications or not.  Just ignore it.

[MCFatTongue]

Hello SierraFoothills,

 

I too use Hostman and had the same detection.  Did you by any chance download the hpHosts HOSTS file under managed sources in Hostsman, because for me it was that file that MBAM was complaining about. I also beleve it to be a false positive.

 

If you go into 'managed sources' then 'Options' then 'Reset', then tick the HOSTS files you want to download (do not tick hpHost) then check for updates again, the problem sould be sorted, until the F.P. is cleared.

 

You might want to consider uploading the hpHosts file here so the mods can check it and clear the F.P.

 

Hope this helps.

Regards.

[David H. Lipman]

MCFatTongue:
 
Please reference: Please read before reporting a false positive
 
Post #2

If you are not a member of Staff or Experts group please do not reply to other users posts in either the File or Web Blocking forums.

 
Thank you for understanding.

[SierraFoothills]

Since a large etc/hosts file is NOT normal it should be flagged, intended modifications or not.  Just ignore it.

 

I removed it from the exclusion file, updated and scanned again and it came up clean.

I will ignore it, thanks.

[MCFatTongue]

Hi SierraFoothills,

 

It's fixed now because I reported it this afternoon.

 

Please see my post https://forums.malwarebytes.org/index.php?/topic/154741-hosts-file-false-positive/