You are not logged in.

Thursday, July 31st 2014, 5:18am

The Avira Forum will be moved to the new platform Avira Answers soon. We'll make the transition of existing user profiles and threads as smooth as possible.
New visitors are able to log in on Avira Answers with the existing Avira account directly or sign up with a new account.

  • "nu1116" started this thread

Date of registration:
Nov 4th 2011

Operating System:
Win 7

  • Send private message

1

Friday, November 4th 2011, 9:31pm

Avira keeps saying host file blocked

This problem appeared about one month ago. (Before that, I was using an older version.)
Every time I start my computer AVIRA informs me that host file was blocked, and the message shows up for every two hours.
So I performed many complete scans of my computer, sometime virus found but sometime not. Even the infected files were deleted, same message shows up.
Then I disabled the function, and the host file hadn't been modified.
And now I just reinstalled AVIRA, same message shows up...
One of my friends is also using the same version of AVIRA, but he says that he never saw anything like that...
I am using version 12.0.0.861, and I am running Win7 64 bit. (my friend is using Vista 32 bit, however.)

Note:
my computer was infected by a malware before. That malware pretends to be svchost.exe and has a description of winrscmde in the directory of C:\Windows (the real scvhost.exe should be in C:\Windows\System32, right?)
That malware kept my CPU usage 100% and slowed down my computer, but with the help of Malwarebytes' Anti-Malware, that malware was removed.

AVIRA gave me the host file blocked message when this malware was in my computer, but now that malware was removed the same message still shows up.
Now both AVIRA and Malwarebytes didn't detect any virus of malware...
So what could be the problem? Thanks.

marfabilis

Moderator

Date of registration:
May 14th 2010

Version:
Avira Free Antivirus
Avira Antivirus Suite
Avira Internet Security Suite
Avira Internet Security

Operating System:
System of a Down

  • Send private message

2

Saturday, November 5th 2011, 2:25am

Hi nu1116,

From now on the hosts file (which is used by some malware to prevent antivirus products to update) is protected from alteration by unauthorized programs. This feature was added in all Avira solutions. Also, this option is activated as the default setting (the Windows hosts files are write-protected).

Some software that you have installed or some process is trying a write access to your HOSTS file. Currently, Avira only shows a warning, but doesn't tell you what is trying to access it. So, there is a need for a further investigation. Keep in mind that some softwares like Spybot, try to add entries in the HOSTS file as part of the security promised by them (a write access).

Marco
| :: RU | EN | PT-BR | ZH-CN | ZH-TW ::

  • "nu1116" started this thread

Date of registration:
Nov 4th 2011

Operating System:
Win 7

  • Send private message

3

Saturday, November 5th 2011, 3:46am

OK, thank you.
But after I disabled that, my host file wasn't modified at all.
So Avira may be too sensitive?

marfabilis

Moderator

Date of registration:
May 14th 2010

Version:
Avira Free Antivirus
Avira Antivirus Suite
Avira Internet Security Suite
Avira Internet Security

Operating System:
System of a Down

  • Send private message

4

Saturday, November 5th 2011, 11:45am

Hi nu1116,

When a process asks for a HOSTS write-access, doesn't mean that the HOSTS file will be necessarily overwritten.
Every two hours sounds like some another security software.

Marco
| :: RU | EN | PT-BR | ZH-CN | ZH-TW ::

  • "nu1116" started this thread

Date of registration:
Nov 4th 2011

Operating System:
Win 7

  • Send private message

5

Saturday, November 5th 2011, 3:57pm

I had done some experiments by disabling some softwares' autostart.
Now I know what program Avira is blocking.
Thanks a lot marfabilis!

Rajo

Moderator

Date of registration:
Jun 12th 2006

Operating System:
Mac - Linux - Windows XP Pro SP3 - PUPPY 4.12 AUFM STICK

  • Send private message

6

Saturday, November 5th 2011, 4:31pm

Now I know what program Avira is blocking.


Then please DO tell us the name :thumbup:

Regards
Rajo :)

marfabilis

Moderator

Date of registration:
May 14th 2010

Version:
Avira Free Antivirus
Avira Antivirus Suite
Avira Internet Security Suite
Avira Internet Security

Operating System:
System of a Down

  • Send private message

7

Saturday, November 5th 2011, 4:42pm

Hi nul1116,

You're welcome :)

Marco
| :: RU | EN | PT-BR | ZH-CN | ZH-TW ::

  • "nu1116" started this thread

Date of registration:
Nov 4th 2011

Operating System:
Win 7

  • Send private message

8

Saturday, November 5th 2011, 5:21pm

Now I know what program Avira is blocking.


Then please DO tell us the name :thumbup:

Regards
Rajo :)
It is Tencent QQ, the most popular Chinese IM.