This is on two computers in my home

[JonPaulOnLine]

Is this a false positive

its on two of my computers that I ran a scan of today

C:\WINDOWS\system32\drivers\hosts (Trojan.Agent) -> No action taken.

here is the Zip

[nosirrah]

*:\WINDOWS\system32\drivers\etc\HOSTS <- this is the path to the hosts file

*:\WINDOWS\system32\drivers\hosts <- this is not

Please zip and attach WINDOWS\system32\drivers\hosts to your next post so that I can take a look at it.

[JonPaulOnLine]

[JonPaulOnLine]

[nosirrah]

Your image stops long before the "h"s so I am not sure what you are showing me.

i dont have your path in my c drive

We are not on the same page here as I am showing you your path on your system:

C:\WINDOWS\system32\drivers\hosts (Trojan.Agent) -> No action taken. [EFBE367C363874F132B3BCC49E1EEAD0]

[nosirrah]

I see what you are missing here:

Files Infected:

C:\WINDOWS\system32\drivers\hosts

Your log clearly shows a file being detected, not a folder. Do not be confused by the lack of an extension, those are only for visual aid, they do not actually even exist within the file structure. You can even name a folder file.exe and it is still just a folder.

[JonPaulOnLine]

[nosirrah]

Download, unzip and run the file attached to this post, it will unhide this file if it is there.

Let me know if you can find the file afterwords.

unhide.zip

[JonPaulOnLine]

Cannot open file: it does not appear to be a valid archive.per win zip 12.0

i downloaded several times and attempted to unzip several times

[JonPaulOnLine]

i found it by searching PC for file titled Hosts

I had to paste it into this "Here" folder ,because I cannot see the file when I place it on my desktop

[nosirrah]

The zipping problem may be a result of your browser, if you have firefox installed it should work.

[JonPaulOnLine]

i found it by searching PC for file titled Hosts

I had to paste it into this Here folder because I cannot see the file when i placed it on my desktop

[nosirrah]

OK that is definitely not a copy of your hosts file and should not be there. You mentioned that this was on 2 computers, any idea what created these?

This not a typical windows file (if it was potentially millions of people would be affected and reporting this here with you) so something you are using (intentionally or not) is creating it.

If you do not know where this came from I would start by doing a cut and paste to move it someplace else and reboot. If using your regular software does not recreate the file just leave it removed.

[JonPaulOnLine]

This hidden Hosts file is old on system at least a year or more

[JonPaulOnLine]

[JonPaulOnLine]

Dont know where it came from ( strange is so old)

Thank You Bruce for your assistance

Regards,

Jon Paul

[JonPaulOnLine]

This file in question did not appear as a Hit in the quick scan on my two computers today.

Somewhere between last night MBAM Database version 4497 thru 4500, the change was performed.

I thank you

[shadowwar]

Do you have winpatrol on both computers? I think this may be causing the file. If you look in your pictures. The next line down IS the correct location for hosts. Have a feeling winpatrol may be creating this file in the incorrect location.

[JonPaulOnLine]

Thank you Rich

Jon