You are not logged in.

Thursday, July 24th 2014, 10:25am

Dear visitor, welcome to Avira Support Forum. If this is your first visit here, please read the Help. It explains in detail how this page works. To use all features of this page, you should consider registering. Please use the registration form, to register here or read more information about the registration process. If you are already registered, please login here.

  • "nu1116" started this thread

Date of registration:
Nov 4th 2011

Operating System:
Win 7

  • Send private message

1

Friday, November 4th 2011, 9:31pm

Avira keeps saying host file blocked

This problem appeared about one month ago. (Before that, I was using an older version.)
Every time I start my computer AVIRA informs me that host file was blocked, and the message shows up for every two hours.
So I performed many complete scans of my computer, sometime virus found but sometime not. Even the infected files were deleted, same message shows up.
Then I disabled the function, and the host file hadn't been modified.
And now I just reinstalled AVIRA, same message shows up...
One of my friends is also using the same version of AVIRA, but he says that he never saw anything like that...
I am using version 12.0.0.861, and I am running Win7 64 bit. (my friend is using Vista 32 bit, however.)

Note:
my computer was infected by a malware before. That malware pretends to be svchost.exe and has a description of winrscmde in the directory of C:\Windows (the real scvhost.exe should be in C:\Windows\System32, right?)
That malware kept my CPU usage 100% and slowed down my computer, but with the help of Malwarebytes' Anti-Malware, that malware was removed.

AVIRA gave me the host file blocked message when this malware was in my computer, but now that malware was removed the same message still shows up.
Now both AVIRA and Malwarebytes didn't detect any virus of malware...
So what could be the problem? Thanks.

marfabilis

Moderator

Date of registration:
May 14th 2010

Version:
Avira Free Antivirus
Avira Antivirus Suite
Avira Internet Security Suite
Avira Internet Security

Operating System:
System of a Down

  • Send private message

2

Saturday, November 5th 2011, 2:25am

Hi nu1116,

From now on the hosts file (which is used by some malware to prevent antivirus products to update) is protected from alteration by unauthorized programs. This feature was added in all Avira solutions. Also, this option is activated as the default setting (the Windows hosts files are write-protected).

Some software that you have installed or some process is trying a write access to your HOSTS file. Currently, Avira only shows a warning, but doesn't tell you what is trying to access it. So, there is a need for a further investigation. Keep in mind that some softwares like Spybot, try to add entries in the HOSTS file as part of the security promised by them (a write access).

Marco
| :: RU | EN | PT-BR | ZH-CN | ZH-TW ::

  • "nu1116" started this thread

Date of registration:
Nov 4th 2011

Operating System:
Win 7

  • Send private message

3

Saturday, November 5th 2011, 3:46am

OK, thank you.
But after I disabled that, my host file wasn't modified at all.
So Avira may be too sensitive?

marfabilis

Moderator

Date of registration:
May 14th 2010

Version:
Avira Free Antivirus
Avira Antivirus Suite
Avira Internet Security Suite
Avira Internet Security

Operating System:
System of a Down

  • Send private message

4

Saturday, November 5th 2011, 11:45am

Hi nu1116,

When a process asks for a HOSTS write-access, doesn't mean that the HOSTS file will be necessarily overwritten.
Every two hours sounds like some another security software.

Marco
| :: RU | EN | PT-BR | ZH-CN | ZH-TW ::

  • "nu1116" started this thread

Date of registration:
Nov 4th 2011

Operating System:
Win 7

  • Send private message

5

Saturday, November 5th 2011, 3:57pm

I had done some experiments by disabling some softwares' autostart.
Now I know what program Avira is blocking.
Thanks a lot marfabilis!

Rajo

Moderator

Date of registration:
Jun 12th 2006

Operating System:
Mac - Linux - Windows XP Pro SP3 - PUPPY 4.12 AUFM STICK

  • Send private message

6

Saturday, November 5th 2011, 4:31pm

Now I know what program Avira is blocking.


Then please DO tell us the name :thumbup:

Regards
Rajo :)

marfabilis

Moderator

Date of registration:
May 14th 2010

Version:
Avira Free Antivirus
Avira Antivirus Suite
Avira Internet Security Suite
Avira Internet Security

Operating System:
System of a Down

  • Send private message

7

Saturday, November 5th 2011, 4:42pm

Hi nul1116,

You're welcome :)

Marco
| :: RU | EN | PT-BR | ZH-CN | ZH-TW ::

  • "nu1116" started this thread

Date of registration:
Nov 4th 2011

Operating System:
Win 7

  • Send private message

8

Saturday, November 5th 2011, 5:21pm

Now I know what program Avira is blocking.


Then please DO tell us the name :thumbup:

Regards
Rajo :)
It is Tencent QQ, the most popular Chinese IM.