f/p on HOSTS

[Maurice Naggar]

Going ahead and posting here with what are fasle positives by both Malwarebytes for Windows  as well as MBAR  on Hosts file.

Its all from this customer case in malware removal help

https://forums.malwarebytes.com/topic/260505-trojan-found-with-mbar/

 

The current content of Hosts is now one single line

127.0.0.1       localhost

 

This is the result from MB4  scan

Trojan.Agent, C:\WINDOWS\SYSTEM32\HOSTS, No Action By User, 496, 204104, 1.0.25184, , ame, 

 

While at the start of the case,  the Hosts file effectively had all comment lines   ( with #  at the first character of each line)

now the Hosts file has but one entry & it is good.

[exile360]

Note the path: C:\WINDOWS\SYSTEM32\HOSTS; no HOSTS file should exist there (assuming it isn't a folder named 'HOSTS', which I don't believe it is, but I'm not sure).  The path for the actual HOSTS file is C:\Windows\System32\drivers\etc\HOSTS

[Maurice Naggar]

Thanks Samuel.

My bad.   I entirely overlooked the full path.   Thanks for catching.