Comments on: Windows Defender apparent false alarm (Win32/PossibleHostsFileHijack)

By: Winner

Winner — Mon, 29 Mar 2010 08:25:55 +0000

How come a big company like MS make this fatal bug. That line 127.0.0.1 is so important that many networking application depend on it for loopbact test/service. Ms must reward you with something. Domain Name

By: Helmut

Helmut — Thu, 12 Mar 2009 16:25:01 +0000

I let defender place the file in quarantaine. Then I looked in quarantaine and found: nothing
My PC seems to function stil normal. The content of the file is only an instrction. Nothing seems to heve been changed, as the date of the file is 04-08-2004….

By: Marty

Marty — Tue, 10 Mar 2009 19:07:11 +0000

I’ve updated the post to add another informational link at the bottom. Nothing really new, just more confirmation that this was a transient false positive and some info on how to fix it. It might have been Vista-only as well.

By: Marty

Marty — Tue, 10 Mar 2009 18:21:55 +0000

All I know for sure is that the latest update did NOT fix the hosts file if you already cleaned it, only that Defender didn’t re-detect the localhost entry as a problem once I restored the original version.

Note that I’ve got v1.53.288 of the definitions right now (last night’s update). I’d expect that one or a later one should be OK.

If you didn’t clean it yet just run Windows update and see that Defender updates. A quick scan should be clean after that. If NOT then you may have a real issue in the hosts file that requires attention (it’d be wise to make a copy of this text-only file to your desktop before allowing it to be cleaned).

Mistakes happen. Hopefully the extent of this is just that one line. God knows I’ve had some pretty interesting problems crop up with Linux hotfixes as well so nobody is immune.

By: ClipHead

ClipHead — Tue, 10 Mar 2009 13:41:13 +0000

I’m working at a software company that sells server/client based RIPs.
Customers started complaining today about this issue. Good I found this entry. Keep it up!

By: Shirley

Shirley — Tue, 10 Mar 2009 12:40:26 +0000

Phew – I’ve not done the techy stuff yet because I’m not sure how (log in as administrator? Is that just my usual log in as it’s my own pc) but didn’t want to remove the ‘threat’ without checking it out first. Thank goodness I found your blog.

Will it just update automatically with the next automatic update from windows or do I need to go through the admin process as described above and on the link you gave?

By: lomanodr

lomanodr — Tue, 10 Mar 2009 11:38:01 +0000

Last night suddenly mysql was not reachable, I have wasted 3/4h rebooting and looking in the wrong site till I have seen in the system recovery that the son of a bitch of Windows Defender (and his Microsoft f*cking mother) have removed the localhost.
Sorry for my language but at this time to get calm I only have two options, blame Microsoft or smash Balmer’s face. I think many times about installing linux but as it takes time to migrate I never do and then I waste my time with the Microsoft bugs…