How do I know which entries are bogus?
Main Topics
Browse All TopicsI have a virus that is blocking access to certain websites, such as microsoft updates and the AVG free website. I installed microsoft onecare and it says it's cleaned everything, but I still can't access certain sites.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Unless you've put something in the hosts file, there shouldn't be anything in there except some explanatory text and a single entry ... can't remember right off what the IP is, but it's something like 127.0.0.1.
I had a virus infection on one of the PCs that I manage at my work a few years ago and the virus put in bogus entries for all of the major antivirus vendors that routed requests for their web pages to IP addresses controlled by the virus maker. But it was not immediately obvious. The virus had put in a large number of blank lines and then put the fake entries at the bottom. Normally whern there's not much in the file and you open in in something like notepad, it all fits onto one page. I had not noticed that the scroll bar was active until I had looked at the file a couple of times. When I realized this I went to the bottom of the file, saw the entries and deleted them.
This is all I found in the host file. Doesn't look like anything out of the ordinary
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
As already had suggested,
Were you able to scroll down the Hosts file? Just make sure there aren't any blank lines inserted there to trick the users that there are no more entries after the blank lines. I've seen this happened with older infections, though I haven't seen this maybe over 2 years, nasties can add even up to 50 blank lines in the Hosts file.
See if you can access MalwareBytes on these links and download and run it.
Download MalwareBytes from either of these locations, update before scanning if you can.
If it won't run, you would need to re-download and rename it before saving to your desktop, or use another pc to download and rename it before installing it to the infected pc.
MalwareBytes:
http://www
http://pr
Business Accounts
Answer for Membership
by: jhyieslaPosted on 2009-01-03 at 14:09:59ID: 23287302
It's possible that the browser was hijacked by whatever infected your system. Try installing and using an alternate browser. It's also possible that your host file was co-opted. Check the hosts file at C:\windows\system32\driver s\etc to make sure that there are no bogus entires. Make sure to go all the way to the bottom of the file.