RE:AVG Error Message- Reading Error c:\windows\system32\drivers\etc\hosts

David H. Lipman or anyone else:
A couple of days, in a reply to fred_7038@yahoo.com about a error problem
that he was having with installing AVG, you(David H. Lipman) suggested he
look in c:\windows\system32\drivers\etc\hosts for two files KERNEL32.DLL
and SHELL32.DLL to see if they had been changes.

Today after running AVG (free) I got a message in the test results that
said "reading error c:\windows\system32\drivers\etc\hosts" .

No other problems were noted, no virus detected.

When I looked in c:\windows\system32\drivers\etc\hosts, neither of the
two files you mentioned were present, folder was comletely empty.

You also mentioned to fred_7038@yahoo.com to check his java verson to see
if it was up todate...I don't have java installed.

I use Firefox 2.0, this I mention because at the Java site you posted it
doesn't refer to FireFox 2 only 1.5 , I think I'm correct on that.(G)

My question is about the two *.DLL files that apparently are missing and
the read error for the folder that you say they should be in?

Any help on this would be appreciated.

ICU

Forget about the DLL files. That's the OTHER person's situation.

Look to see if the Hosts files has actually changed...

notepad C:\WINDOWS\system32\drivers\etc\hosts

I mentioned Sun Java in my reply becuase of all the bugs and vulnerabuilities that have been
noted in that software which can lead to a malware infection. It was mentioned becuase
mitigation of vulnerabilities that are actively exploited is just important as removing
malware.

FireFox 2.0 is fully compatible with Java v6

The Secunia Software Inspector is one way to check if there are vulnerable versions of
software on the computer.

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in news:SjVoh.15120
$rz3.1907@trnddc03:

> From: "ICU" <ICU@Nowhere.com>
>
>
>| Just to be clear about the error reading message about c:\windows
>| \system32\drivers\etc\hosts. There are no files to check showing in
the
>| Hosts folder.
>|
>| TIA
>|
>| ICU
>
> Then there isn't a problem if there is NO hosts file.
>

So is it a AVG (Free antivirus) bug saying there is an error reading that
folder?
Today is the first time that error showed up after the daily scan.
Sorry for all the questions, but your replies are much appreciated.

TIA

ICU

"Jim" <j.n@nospam.com> wrote in
news:wZVoh.26453$QU1.24874@newssvr22.news.prodigy.net:

>
> "ICU" <ICU@Nowhere.com> wrote in message
> news:Xns98B3BB1D7859AICU@208.49.80.60...
>> "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
>> news:SjVoh.15120 $rz3.1907@trnddc03:
>>
>>> From: "ICU" <ICU@Nowhere.com>
>>>
>>>
>>>| Just to be clear about the error reading message about c:\windows
>>>| \system32\drivers\etc\hosts. There are no files to check showing in
>> the
>>>| Hosts folder.
>>>|
>>>| TIA
>>>|
>>>| ICU
>>>
>>> Then there isn't a problem if there is NO hosts file.
>>>
>>
>> So is it a AVG (Free antivirus) bug saying there is an error reading
>> that folder?
>> Today is the first time that error showed up after the daily scan.
>> Sorry for all the questions, but your replies are much appreciated.
>>
>> TIA
>>
>> ICU
>>
> HOSTS is not a folder; it is a file.
> Jim
>
>
>

OK I misread the original reply to the original poster's question in
another thread.
Because this other poster's problem appeared to be similar in nature to my
problem, i.e. AVG (free) scan error message of "reading error" "C:\windows
\system32\drivers\etc\hosts", after reading David H. Lipman's reply I
checked for c:\windows\system32\drivers\etc\hosts on my comouter and found
I didn't have \hosts, I misunderstood the replie's comment about two files
kernel32.dll and shell32.dll, thinking they were in a folder called hosts,
you have corrected me.
But I'm still left with the AVG (free) scan problem of the read error each
time I do a scan.
I'm also now left with the question of why do I not have c:\windws\system32
\drivers\etc\hosts or am I even supposed to have it.
When I replied to David H. Lipman in this thread he eventually said "well
there isn't a problem if there is NO hosts file", which still leaves me as
I said with the error message unexplained or corrective measures suggested.
I realize all this must make me look like a real dummy to some here and
maybe I am but if one doesn't ask a question how does one solve what
appears to be a problem.

Thanks for correcting my error.

ICU

ICU wrote:

> I'm also now left with the question of why do I not have
> c:\windws\system32 \drivers\etc\hosts or am I even supposed to have
> it.

S'far as I know, a HOSTS file is not required by any version of .. any
OS.

But why not create one? Make an empty text file in the folder
c:\windows\system32\drivers\etc\
named: HOSTS [no extension]

Copy this text into it:
http://k75s.home.att.net/hostsfile.txt

See: http://k75s.home.att.net/tips.html#hosts

--
-bts
-Motorcycles defy gravity; cars just suck

"Beauregard T. Shagnasty" <a.nony.mous@example.invalid> wrote in
news:rD8ph.361530$Fi1.166372@bgtnsc05-news.ops.worldnet.att.net:

> ICU wrote:
>
>> I'm also now left with the question of why do I not have
>> c:\windws\system32 \drivers\etc\hosts or am I even supposed to have
>> it.
>
> S'far as I know, a HOSTS file is not required by any version of .. any
> OS.
>
> But why not create one? Make an empty text file in the folder
> c:\windows\system32\drivers\etc\
> named: HOSTS [no extension]
>
> Copy this text into it:
> http://k75s.home.att.net/hostsfile.txt
>
> See: http://k75s.home.att.net/tips.html#hosts
>

Thanks for the reply, links stc.
After a quick scan/read of the info you posted I looked again at c:\windows
\system32\drivers\etc\
There were two files there with "hosts" in the name, one was hosts.bak and
another with Imhosts.sam, I decided to copy hosts.bak to "hosts" no
extension.
BTW readng the hosts.bak file showed me it was the original sample hosts
file, why or how it was renamed to hosts.bak is beyond me, the date on the
file was back in Feb.
Anyway everything so far is now running correctly, AVG (free) is no longer
producing an error message.
Thanks again for steering me in the right direction, it's much appreciated.

ICU.

ICU wrote:

> Thanks again for steering me in the right direction, it's much
> appreciated.

Welcome. Now, if you want annoying web page ads to go away, copy my
text into the file (which I've created manually to block common ad
servers) or see other versions elsewhere, such as:

http://www.mvps.org/winhelp2002/hosts.htm
where the text is located at:
http://www.mvps.org/winhelp2002/hosts.txt

Select, copy, paste. <g>

--
-bts
-Motorcycles defy gravity; cars just suck

ICU wrote:

> BTW I have already discovered It doesn't tell you it's changed if you
> replace it with the original host file.

Logic (<g>) would indicate that it should no longer tell you it was
changed. If it does, can you trust the program for complex things?
('cause there's sure nothing complex about the hosts text file.)

Maybe it thinks that any entry other than the must-have
127.0.0.1 localhost
is a problem. If so ... see above about trust.

--
-bts
-Motorcycles defy gravity; cars just suck

ICU wrote:

> "Beauregard T. Shagnasty" <a.nony.mous@example.invalid> wrote:
> <snip>
>
> Well this morning's scan gave me the "changed" message again, so how
> can I trust it? I'm just being rhetorical, logic prevails.(G) Thanks
> for the reply.

Just thought of something. Earlier you said "Did that...tried yours and
and one from the MVPS site, both give a warning/alert "HOSTS " changed
when doing a scan."

When you copied in the text from the second file, did you remove all the
text from the previous attempt? IOW, did you overwrite or append? You
should overwrite.

I'm not certain if this will make a difference with your scanner, but it
was a thought. Maybe you need to ask AVG why it alerts (I don't use it).

--
-bts
-Motorcycles defy gravity; cars just suck

On Wed, 10 Jan 2007 17:26:22 GMT, ICU <ICU@Nowhere.com> wrote:

>"Beauregard T. Shagnasty" <a.nony.mous@example.invalid> wrote in
>news:rD8ph.361530$Fi1.166372@bgtnsc05-news.ops.worldnet.att.net:
>
>> ICU wrote:
>>
>>> I'm also now left with the question of why do I not have
>>> c:\windws\system32 \drivers\etc\hosts or am I even supposed to have
>>> it.
>>
>> S'far as I know, a HOSTS file is not required by any version of .. any
>> OS.
>>
>> But why not create one? Make an empty text file in the folder
>> c:\windows\system32\drivers\etc\
>> named: HOSTS [no extension]
>>
>> Copy this text into it:
>> http://k75s.home.att.net/hostsfile.txt
>>
>> See: http://k75s.home.att.net/tips.html#hosts
>>
>
>Thanks for the reply, links stc.
>After a quick scan/read of the info you posted I looked again at c:\windows
>\system32\drivers\etc\
>There were two files there with "hosts" in the name, one was hosts.bak and
>another with Imhosts.sam, I decided to copy hosts.bak to "hosts" no
>extension.
>BTW readng the hosts.bak file showed me it was the original sample hosts
>file, why or how it was renamed to hosts.bak is beyond me, the date on the
>file was back in Feb.
>Anyway everything so far is now running correctly, AVG (free) is no longer
>producing an error message.
>Thanks again for steering me in the right direction, it's much appreciated.

This is very weird. I had the exact same thing happen to me. My AVG
had been running fine until yesterday when I got the same error
message as you. I removed the .bak and when I ran AVG instead of
"error" it said "change". Normally whenever I would run AVG I would
get the "change" message in that dialog section.

Btw, the exploit situation seems to have resolved itself. I downloaded
the scanner, ran it in normal mode, and it did not find any viruses.
Since I ran the scan I have not seen the exploit threat listed.

Rich
>
>ICU.
>

"Beauregard T. Shagnasty" <a.nony.mous@example.invalid> wrote in
news:DROph.374563$Fi1.194986@bgtnsc05-news.ops.worldnet.att.net:

> rich@notyahoo.com wrote:
>
>> This is very weird. I had the exact same thing happen to me. My AVG
>> had been running fine until yesterday when I got the same error
>> message as you. I removed the .bak and when I ran AVG instead of
>> "error" it said "change". Normally whenever I would run AVG I would
>> get the "change" message in that dialog section.
>
> Aha. So now a good guess would be that AVG has added something to their
> latest definitions or program, and is now issuing a false positive.
>
> Time to ask them about it - why is it alerting on anything other than
> the default hosts file?
>

Time to ask who, have you ever tried to ask a question in the AVG free
forum...first you get told you are not posting in the right forum, then a
lecture about reading all the FAQ's first before posting and finally a
link is provided that tells you of a suggested drastic measure on how to
remove virus from your computer. I know they are all volunteers, and any
help is always appreciated but geez AVG should have some guidelines for
these volunteers on how to respond to questions, it's almost like the
experience you go through trying to get one of those mail in rebates
validated and a cheque mailed to you.(G)
Thats why I posted the question here hoping I could be spared that
experience again.
Once bitten , twice shy.(G)

ICU