Please explain this message (SP2)

Topic

New Reply

Lately I’ve been getting the following message screen immediately after booting the PC. (I have a one year old Dell 4700 with Windows XP using Filefox 1.0.4 as my browser.)

————————————————————————————————————-
WinPatrol
————————————————————————————————————-
! A change has been detected in your Internet “HOSTS” file.
Entries in this file can be used to redirect your browser to alternate websites

Would you like to examine this file for changes?

Yes No
————————————————————————————————————

If I click on Yes, I get Notepad displaying the single line

127.0.0.1 localhost

After I clear it, it pops up again a few minutes later, and then again at one to two hour intervals throughout the day. Its appearance does not seem related to whatever I’m doing at the time.

Does anyone know a) What it means, What I’m supposed to do about it, and c) How I stop it happening.

Thank you,

John Littell

Reply | Quote

Replies

It sounds like the application WinPatrol is doing it’s job and notifying you of changes to your Hosts file. You need to read the documentation for the program and configure it correctly for your situation, for instance to protect you silently, if that’s an option, and so that you better understand what the program does and what you need to do in response. The changes seem to be directing the changes to look for 127.0.0.1 localhost which is nowhere land for nasties. But the fact that it keep reoccurring indicates that there might be a virus or worm on your system trying to setup housekeeping and phone home. I’d update run scans with all the AV and anti-spyware programs you have and see what turns up. If you don’t have any antivirus or antispyware programs loaded post back and we’ll tell you what you need to get to protect yourself.

Reply | Quote

127.0.0.1 localhost
Is a perfectly normal entry for a hosts file. It tells windows that attempts to access a server called localhost should be directed to address 127.0.0.1 this is correct as that address always points to your own system.

It is strange that WinPatrol thinks the file has changed if it always has exactly the same content when you look at it.

StuartR

Reply | Quote

Doc Watson & StuartR,
Thanks guys for your replies. They jogged my memory into remembering that WinPatrol is that darn dog that occasionally barks and scares the life out of me. Now knowing where to look, I researched WinPatrol’s help system and, in its FAQs, came up with the following. Quote

SpySweeper users have reported that Scotty regularly lets them know about changes to the HOSTs file. Apparently SpySweeper in its monitoring of the HOST file rewrites the file. We recommend you disable HOST file monitoring in either SpySweeper or in WinPatrol set the patrol time for HOST file to zero.

Unquote. (No, I haven’t messed up my typing; that’s what it says.) While I was unable to figure out how to “disable HOST file monitoring” in SpySweeper, I did follow the latter suggestion in WinPatrol. And the problem seems to have gone away. Now, of course, I worry about the consequenses of what I’ve disabled, but at least now I know what’s going on.

Thank you again for your support,

John Littell

Reply | Quote

I don’t think you need to be concerned about disabling WinPatrol’s Host monitoring as SpySweeper is very through. While it’s a good idea to have more than one line of defense, sometimes things don’t work and play well together and some tweaking is required to sort things out. Glad you got your issue straight.

Reply | Quote