Anne__Burns Posted January 24, 2016 ID:1014383 Share Posted January 24, 2016 Hello, I was told to come here because I am getting large quantities of Hijack. Hosts entries every time I have done a scan (over 60 today). I restored one from quarantine and it must be with new ones that have been detected. I am doing the best I can to follow instructions but I am struggling here. What do I need to show so you can determine if they are false positives? Anne Link to post Share on other sites More sharing options...
Staff blender Posted January 24, 2016 Staff ID:1014385 Share Posted January 24, 2016 Hello Anne, If you still have the scan window open with the results, click the "save results" button at the bottom left, choose "text file", give it a name like "MBAMLog" or similar & save it to your desktop.Once you save it, please attach it in your next reply.If you already closed the program..Open MBAM again, click "history" tab, then "application logs"Choose the scan log that showed threat results which opens in a new window.Choose "export", choose "text file", give it a name like "MBAMLog" or similar & save it to your desktop.Once you save it, please attach it in your next reply. Thanks! Link to post Share on other sites More sharing options...
Anne__Burns Posted January 24, 2016 Author ID:1014386 Share Posted January 24, 2016 Hello blender,Just to make things more interesting, I have the same problem going on with my laptop!! What are thechances of getting false positives on two different machines? BTW, I have HostsMan onboth machines.Just saying. Right now, every time I do a threat scan on my desktop or laptop, I get more threat entries. AnneHelp.txt Link to post Share on other sites More sharing options...
Staff blender Posted January 24, 2016 Staff ID:1014389 Share Posted January 24, 2016 Thanks for the log.It will take me a few minutes to t-shoot here what is happening. Link to post Share on other sites More sharing options...
Staff blender Posted January 24, 2016 Staff ID:1014390 Share Posted January 24, 2016 Hi again, When you used HostMan to install a Hosts file... which in the list did you choose? There are several listed.. Thanks, Link to post Share on other sites More sharing options...
Anne__Burns Posted January 24, 2016 Author ID:1014393 Share Posted January 24, 2016 Hi Tammy, I have HostsMan file set up the same way on both of my machines and use the same support forum for each- hpHosts. See attached. Anne Link to post Share on other sites More sharing options...
Staff blender Posted January 24, 2016 Staff ID:1014395 Share Posted January 24, 2016 Cool. Thanks. Link to post Share on other sites More sharing options...
Anne__Burns Posted January 24, 2016 Author ID:1014397 Share Posted January 24, 2016 It just occurred to me that in the past, and not every day, I have gotten messages from MBAM that (and I can't remember the exact message) that an outgoing threat existed; Hosts? Link to post Share on other sites More sharing options...
Staff blender Posted January 24, 2016 Staff ID:1014399 Share Posted January 24, 2016 Hello, New updates have been released to fix these false-positives.Please make sure you are updated to 2016.01.24.01 & try a re-scan. If there are still detections, please post a new log. As for your outgoing protection alerts you saw in the past.. These alerts are related to the IP protection. These alerts will tell you what program was trying to reach the bad IP.When you see these, it is a good idea to run a scan because nothing on your machine should be trying to access bad IP addresses.It likely wouldn't be anything to do with the hosts file... since the hosts file itself is designed to block your machine from getting to bad sites and block other communications that are a concern for privacy. If you believe the site that is being blocked by IP protection is safe, you can report it here:https://forums.malwarebytes.org/index.php?/forum/123-website-blocking/ Let me know please how the updated definitions get along with your hosts file. Thanks! Link to post Share on other sites More sharing options...
Anne__Burns Posted January 24, 2016 Author ID:1014400 Share Posted January 24, 2016 I just want to be certain of what I am updating. Should I have 2016.01.24.01 as the latest MBAM? Link to post Share on other sites More sharing options...
Staff blender Posted January 24, 2016 Staff ID:1014401 Share Posted January 24, 2016 That is the latest definition database. The latest MBAM itself is 2.2.0.1024 Link to post Share on other sites More sharing options...
Anne__Burns Posted January 24, 2016 Author ID:1014402 Share Posted January 24, 2016 I went to my control panel to see my program list and MBAM's latest definition database is indeed 2.2.0.1024. Link to post Share on other sites More sharing options...
Staff blender Posted January 24, 2016 Staff ID:1014403 Share Posted January 24, 2016 Yep, that will be the program version. It also shows at the top of the MBAM window itself. When you open the MBAM dashboard, it should show you the database version here. The latest MBAM updates the definitions before a scan anyway Link to post Share on other sites More sharing options...
Anne__Burns Posted January 24, 2016 Author ID:1014405 Share Posted January 24, 2016 Okay. But lets go back to those false positives being reported in both my desktop and laptop. What to do? Link to post Share on other sites More sharing options...
Staff blender Posted January 24, 2016 Staff ID:1014406 Share Posted January 24, 2016 Once MBAM has updated the definitions on both machines, there is nothing to do... the hosts file detections should no longer occur. Your scans should run clean this round Link to post Share on other sites More sharing options...
Anne__Burns Posted January 24, 2016 Author ID:1014417 Share Posted January 24, 2016 Just so you know, I had updated MBAM both my laptop and desktop before I even started to scan them. They are both scanning clean now. In another post I put in I was told that the 'false positives' were fixed on the website. Did it take until now for the fix to take effect on my machines? Link to post Share on other sites More sharing options...
Staff blender Posted January 24, 2016 Staff ID:1014431 Share Posted January 24, 2016 You should be good to go at this point..We had a few false positives over the last 2 days on these hosts entries so some took longer to fix than others. Thank you again for reporting & good to hear things are running clean. Link to post Share on other sites More sharing options...
Anne__Burns Posted January 24, 2016 Author ID:1014498 Share Posted January 24, 2016 Thank you for your assistance but one last thing. I have a question about the quarantine list out of curiosity. Do entries stay there for ever and if so how many get piled up over time? Should I get rid of the old ones? Link to post Share on other sites More sharing options...
Staff blender Posted January 25, 2016 Staff ID:1014559 Share Posted January 25, 2016 Hello, You can delete them if you like.. good idea to check the logs/quarantine history once a month or so to keep the logs & quarantine stuff from building up over time.Myself.. I usually keep stuff for about 2 weeks & delete anything older.If the logs and such keep building & if there are a lot of logs/quarantine items, I find the program takes longer to open unless I keep the history items cleaned out & only keep a couple weeks worth of data. Link to post Share on other sites More sharing options...
Anne__Burns Posted January 25, 2016 Author ID:1014667 Share Posted January 25, 2016 Thanks for the information. I never had so many entries security warnings until now so I never needed to know what to get rid of in the quarantine area. I will so as you say. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now