Hosts: Trojan.Win32.Hosts2.gen detected

[danewfie]

I haven't updated in a long time but decided to do it recently and have been scratching my head trying to figure out what is causing it. But something is now causing Kaspersky to identify the hosts file as malware now. Issue or any way to verify false positives?

[welcome[bot]]

Hello! Thank you for opening your first issue in this repo. It’s people like you who make these host files better!

[StevenBlack]

I consider this a high honor 😎

Off the top of my head, I'm guessing Kapersky scans some of our files and, seeing domain names in text, it's like

Which I totally understand.

If you use this hosts file, you can uninstall Kapersky.

[danewfie]

Due to the nature of what I do, that's not an option but I'll continue looking to see if something specific is triggering this. Like you said, could be a new specific domain which is flagging it.

[ScriptTiger]

Due to the nature of our hosts file, which contains many references to malware domains, many antivirus programs that scan the hosts file for possible hijacking are going to flag it. It's actually a good thing because it means they are agreeing with us. If you don't have the permissions needed on your system, I would definitely open a ticket with whoever does and get them to make an exception in your antivirus, or at least turn off the feature scanning your hosts file, if possible. With that being said, I would highly recommend NOT altering your hosts file to fix this issue, as it will just end up making you more vulnerable and exposed to the domains that are being flagged for hijacking.

[dnmTX]

I'm using Avast myself and when the hosts file was on my machine Avast was scanning it and removing any entries that contained "avast" in it.There were many complaints in their forum about that and all of them were ignored,or stated that Avast doesn't mess with the hosts file 👎 .Now that my hosts file is in my router Avast can honestly suck it.So..... @danewfie asking Kaspersky to not mess with your hosts file is just a lost cause,those f*ers want their hands on everything so they can sell your info and make some dolares 🤑

[ScriptTiger]

I use AVG and I have never had any of those problems, or at least nothing an exception can't fix. And, @dnmTX, before you make any wise cracks about AVG, I would like you to keep in mind it's owned by Avast :P I've used it literally for decades without any issue and I haven't found any rogue features about it, so I continue to trust it along with my other layers of security.

And while we are on the topic of antivirus, if you have Windows Update enabled, make sure you DO NOT allow them to automatically install. If your connection is good, allowing them to automatically download and wait for you is fine. And then before you manually trigger the Windows Update to begin installing the downloaded updates, DISABLE YOUR ANTIVIRUS. Microsoft has been crashing significant quantities of systems in recent updates due to conflicts with antivirus and they DO NOT provide support in these cases. If you have already fallen victim to this, check out my Windows 911 repo:
https://github.com/ScriptTiger/Windows-911

[kronflux]

Yeah, just a side note really - most Anti-virus/malware programs will almost certainly detect ANY hosts list(especially if it includes a script to replace the system hosts file, also especially if it contains url's related to the antivirus itself ie: tracking urls) as malicious, as many types of malware will often use the hosts file to redirect user traffic for their own malicious purposes.

The reality is, if you have an advanced enough knowledge base to be using this hosts file, you should really be aware of good practices for safe web browsing and system management, and really shouldn't need an anti-virus/malware.
Additionally, even if you DO need to use one(for example, corporate environment where it's not optional, or where lower-level users might be using the system you're managing), you should likely be aware of how to add exceptions to your anti-virus/malware software, and therefore this wouldn't be a problem at all.

[dnmTX]

@ScriptTiger i know they own it,never used it though 😋

[spirillen]

See this comment https://github.com/StevenBlack/hosts/issues/818#issuecomment-440448446

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 daysif no further activity occurs. Thank you for your contributions.

[stale[bot]]

Closing.