Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: mailaddyftw on October 18, 2020, 01:11:34 PM

Title: Some odd things in host file
Post by: mailaddyftw on October 18, 2020, 01:11:34 PM

I have some trojan (Trojan.MSIL.Krypt) and am trying to get rid of it. My scan found some anomaly in my hosts file:

127.0.0.1   download-avast.com
127.0.0.1   www.download-avast.com
127.0.0.1   telecharger-avast.com
127.0.0.1   www.telecharger-avast.com

it is asking me if i want  to allow this, or remove it from there, and I have no clue. I figured I would ask here since it has avast in the name.
Halp?

Title: Re: Some odd things in host file
Post by: DavidR on October 18, 2020, 02:34:26 PM

With those entries in your HOSTS file, they prevent (reroute) you from connecting to those two URLs.  They redirect to your local host IP address 127.0.0.1 where they would effectively fail.

That said they aren't URLs that I have come across before.

Title: Re: Some odd things in host file
Post by: Asyn on October 18, 2020, 04:16:44 PM

Quote from: DavidR on October 18, 2020, 02:34:26 PM

That said they aren't URLs that I have come across before.

+1

Title: Re: Some odd things in host file
Post by: rocksteady on October 18, 2020, 04:48:27 PM

Maybe better to ask your question in the Virus and Worms section of the forum here:
https://forum.avast.com/index.php?board=4.0

Title: Re: Some odd things in host file
Post by: DavidR on October 18, 2020, 08:45:43 PM

I would be interested in what scan mailaddyftw was doing, as I can't recall if avast checks the HOSTS file or not.

Title: Re: Some odd things in host file
Post by: Pondus on October 18, 2020, 09:24:55 PM

Trojan.MSIL.Krypt seems to not be a avast detection name ... possible Ikarus/Emsisoft ?

Title: Re: Some odd things in host file
Post by: alanb on October 19, 2020, 02:02:04 PM

Quote from: mailaddyftw on October 18, 2020, 01:11:34 PM

127.0.0.1   download-avast.com
127.0.0.1   www.download-avast.com
127.0.0.1   telecharger-avast.com
127.0.0.1   www.telecharger-avast.com

IIRC, some time ago entries like that were added to the hosts file in an attempt to prevent the user from downloading the antivirus solution to defeat the virus.

I found some references to those entries on the SpyBot forum from 2007-2008!

Title: Re: Some odd things in host file
Post by: mailaddyftw on October 19, 2020, 10:18:59 PM

Thanks all, I appreciate all the replies ♥
As for what program I used, it was SpyHunter. I don't really know much about any of this, so I just use what I THINK is good because friends said so. God, I sound like such a noob, but that's just because I am one. lol  ;D

Title: Re: Some odd things in host file
Post by: bob3160 on October 19, 2020, 10:24:37 PM

Quote from: mailaddyftw on October 19, 2020, 10:18:59 PM

Thanks all, I appreciate all the replies ♥
As for what program I used, it was SpyHunter. I don't really know much about any of this, so I just use what I THINK is good because friends said so. God, I sound like such a noob, but that's just because I am one. lol  ;D

SpyHunter is an expensive solution when Malwarebytes (FREE) could do the same thing for you.