ShareThis

Wednesday, January 25, 2012

Is www.007guard.com a virus? Spybot S & D, Hosts file info

I just found out in doing a localhost TCP client server that my hostname was "www.007guard.com" for 127.0.0.1. Thinking this was a virus, I headed off to the hosts file to see what was up, and to my surprise, there was a huge list of virus/scam/phish type websites listed:

Example:

# Start of entries inserted by Spybot - Search & Destroy
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.1001-search.info
127.0.0.1 1001-search.info
127.0.0.1 www.100888290cs.com
127.0.0.1 100888290cs.com

None of these sites are actually viruses. This is part of Spybot's immunization process against these malicious urls.

Some software products (like spybot) place entries into the hosts file to disable access from your computer to known malware or advertising servers. 127.0.0.1 is a loopback address to your own computer, so by associating a web address with 127.0.0.1 in the hosts file will cause any attempts to visit that web address to fail because it's trying to load the website from your own computer and not the real location of the website - this results in less advertising in the webpages you view amongst other things.

SO! If you run into this... you are not infected or hacked. It is Spybot trying to protect your computer from that.

0 comments:

Post a Comment