Windows Defender/System Restore

I installed the Windows Defender (WD) a few weeks ago and I keep having a problem that it keeps identifying a HOST file in C:\Windows\system32\drivers\etc\HOSTS and I have no idea what this is.

I have "Cleaned" and "Deleted" it, but it continues to be identified EVERY TIME I start my computer.

Also, it seems that every week (on the Weekend) I have to do a System Restore because I lose access to the Intenet. This too started after I installed WD.

HELP!!!

I just saw a post concerning the "HOSTS" file, but there was too much in it to post here, so I included just a few lines below:

127.0.0.1 1.httpdads.com #SpySweeperCASS
127.0.0.1 207-87-18-203.wsmg.digex.net #SpySweeperCASS
127.0.0.1 a.mktw.net #SpySweeperCASS
127.0.0.1 a.tribalfusion.com #SpySweeperCASS
127.0.0.1 a207.p.f.qz3.net #SpySweeperCASS
127.0.0.1 a3.suntimes.com #SpySweeperCASS
127.0.0.1 actionsplash.com #SpySweeperCASS
127.0.0.1 ad.abcnews.com #SpySweeperCASS
127.0.0.1 ad.adsmart.net #SpySweeperCASS
127.0.0.1 ad.adtraq.com #SpySweeperCASS
127.0.0.1 ad.atlas.cz #SpySweeperCASS
127.0.0.1 ad.au.doubleclick.net #SpySweeperCASS
127.0.0.1 ad.be.doubleclick.net #SpySweeperCASS
127.0.0.1 ad.blm.net #SpySweeperCASS
127.0.0.1 ad.ca.doubleclick.net #SpySweeperCASS
127.0.0.1 ad.ch.doubleclick.net #SpySweeperCASS
127.0.0.1 ad.de.doubleclick.net #SpySweeperCASS
127.0.0.1 ad.dogpile.com #SpySweeperCASS
127.0.0.1 ad.doubleclick.com #SpySweeperCASS

127.0.0.1 ad.fr.doubleclick.net #SpySweeperCASS
127.0.0.1 ad.harmony-central.com #SpySweeperCASS
127.0.0.1 ad.horvitznewspapers.net #SpySweeperCASS
127.0.0.1 ad.howstuffworks.com #SpySweeperCASS
127.0.0.1 ad.img.yahoo.co.kr #SpySweeperCASS
127.0.0.1 ad.infoseek.com #SpySweeperCASS
127.0.0.1 ad.iwin.com #SpySweeperCASS
127.0.0.1 ad.jp.doubleclick.net #SpySweeperCASS
127.0.0.1 ad.kimo.com.tw #SpySweeperCASS
127.0.0.1 ad.linkexchange.com #SpySweeperCASS
127.0.0.1 ad.linksynergy.com #SpySweeperCASS
127.0.0.1 ad.moscowtimes.ru #SpySweeperCASS
127.0.0.1 ad.net-service.de #SpySweeperCASS
127.0.0.1 ad.nl.doubleclick.net #SpySweeperCASS
127.0.0.1 ad.no.doubleclick.net #SpySweeperCASS
127.0.0.1 ad.openfind.com.tw #SpySweeperCASS
127.0.0.1 ad.preferances.com #SpySweeperCASS
127.0.0.1 ad.preferences.com #SpySweeperCASS
127.0.0.1 ad.sales.olympics.com #SpySweeperCASS
127.0.0.1 ad.se.doubleclick.net #SpySweeperCASS
127.0.0.1 ad.sg.doubleclick.net #SpySweeperCASS
127.0.0.1 ad.sma.punto.net #SpySweeperCASS
127.0.0.1 ad.tomshardware.com #SpySweeperCASS
127.0.0.1 ad.trafficmp.com #SpySweeperCASS
127.0.0.1 ad.uk.doubleclick.net #SpySweeperCASS
127.0.0.1 ad.usatoday.com #SpySweeperCASS
127.0.0.1 ad.vol.at #SpySweeperCASS
127.0.0.1 ad.washingtonpost.com #SpySweeperCASS
127.0.0.1 ad.webprovider.com #SpySweeperCASS
127.0.0.1 ad01.mediacorpsingapore.com #SpySweeperCASS
127.0.0.1 ad08.focalink.com #SpySweeperCASS
127.0.0.1 ad1.aaddzz.com #SpySweeperCASS
127.0.0.1 ad1.peel.comwww.xbn.ru #SpySweeperCASS
127.0.0.1 ad10.doubleclick.net #SpySweeperCASS
127.0.0.1 ad11.doubleclick.net #SpySweeperCASS
127.0.0.1 ad12.doubleclick.net #SpySweeperCASS
127.0.0.1 ad13.doubleclick.net #SpySweeperCASS
127.0.0.1 ad14.doubleclick.net #SpySweeperCASS
127.0.0.1 ad15.doubleclick.net #SpySweeperCASS
127.0.0.1 ad16.doubleclick.net #SpySweeperCASS
127.0.0.1 ad17.doubleclick.net #SpySweeperCASS
127.0.0.1 ad18.doubleclick.net #SpySweeperCASS
127.0.0.1 ad19.doubleclick.net #SpySweeperCASS
127.0.0.1 ad2.adcept.net #SpySweeperCASS
127.0.0.1 ad2.doubleclick.net #SpySweeperCASS
127.0.0.1 ad2.peel.com #SpySweeperCASS
127.0.0.1 ad20.doubleclick.net #SpySweeperCASS
127.0.0.1 ad3.doubleclick.net #SpySweeperCASS
127.0.0.1 ad3.peel.com #SpySweeperCASS
127.0.0.1 ad4.doubleclick.net #SpySweeperCASS
127.0.0.1 ad5.doubleclick.net #SpySweeperCASS
127.0.0.1 ad6.doubleclick.net #SpySweeperCASS
127.0.0.1 ad7.doubleclick.net #SpySweeperCASS
127.0.0.1 ad7.internetadserver.com #SpySweeperCASS
127.0.0.1 ad8.doubleclick.net #SpySweeperCASS
127.0.0.1 ad9.doubleclick.net #SpySweeperCASS
127.0.0.1 ad-adex3.flycast.com #SpySweeperCASS
127.0.0.1 adbanner.sweepsclub.com #SpySweeperCASS
127.0.0.1 adbot.com #SpySweeperCASS
127.0.0.1 adbureau.net #SpySweeperCASS
127.0.0.1 adcodes.bla-bla.com #SpySweeperCASS
127.0.0.1 adcontent.gamespy.com #SpySweeperCASS
127.0.0.1 adcontroller.unicast.com #SpySweeperCASS
127.0.0.1 adcount.hollywood.com #SpySweeperCASS
127.0.0.1 adcreative.tribuneinteractive.com #SpySweeperCASS
127.0.0.1 adcreatives.imaginemedia.com #SpySweeperCASS
127.0.0.1 add.yaho.com #SpySweeperCASS
127.0.0.1 adengine.theglobe.com #SpySweeperCASS
127.0.0.1 adex3.flycast.com #SpySweeperCASS
127.0.0.1 adfarm.mediaplex.com #SpySweeperCASS
127.0.0.1 adforce.ads.imgis.com #SpySweeperCASS
127.0.0.1 adforce.adtech.de #SpySweeperCASS
127.0.0.1 adforce.imgis.com #SpySweeperCASS
127.0.0.1 adfu.blockstackers.com #SpySweeperCASS
127.0.0.1 adi.mainichi.co.jp #SpySweeperCASS
127.0.0.1 adimage.asia1.com.sg #SpySweeperCASS
127.0.0.1 adimage.asiaone.com.sg #SpySweeperCASS
127.0.0.1 adimage.bankrate.com #SpySweeperCASS
127.0.0.1 adimage.blm.net #SpySweeperCASS
127.0.0.1 adimages.earthweb.com #SpySweeperCASS
127.0.0.1 adimages.go.com #SpySweeperCASS
127.0.0.1 adimg.com.com #SpySweeperCASS
127.0.0.1 adimg.egroups.com #SpySweeperCASS
127.0.0.1 adimg1.chosun.com #SpySweeperCASS
127.0.0.1 adlink.deh.de #SpySweeperCASS
127.0.0.1 adlog.com.com #SpySweeperCASS
127.0.0.1 adlui001.adlink.de #SpySweeperCASS
127.0.0.1 admedia.xoom.com #SpySweeperCASS
127.0.0.1 adng.ascii24.com #SpySweeperCASS
127.0.0.1 adpick.switchboard.com #SpySweeperCASS
127.0.0.1 adpop.theglobe.com #SpySweeperCASS
127.0.0.1 adpulse.ads.targetnet.com #SpySweeperCASS
127.0.0.1 adremote.pathfinder.com #SpySweeperCASS
127.0.0.1 ads*.focalink.com #SpySweeperCASS
127.0.0.1 ads.1for1.com #SpySweeperCASS
127.0.0.1 ads.adflight.com #SpySweeperCASS
127.0.0.1 ads.ad-flow.com #SpySweeperCASS
127.0.0.1 ads.admaximize.com #SpySweeperCASS
127.0.0.1 ads.admonitor.net #SpySweeperCASS
127.0.0.1 ads.adtegrity.net #SpySweeperCASS
127.0.0.1 ads.advance.net #SpySweeperCASS
127.0.0.1 ads.adviva.net #SpySweeperCASS
127.0.0.1 ads.amazingmedia.com #SpySweeperCASS
127.0.0.1 ads.as4x.tmcs.net #SpySweeperCASS
127.0.0.1 ads.astalavista.us #SpySweeperCASS
127.0.0.1 ads.belointeractive.com #SpySweeperCASS
127.0.0.1 ads.bfast.com #SpySweeperCASS
127.0.0.1 ads.bianca.com #SpySweeperCASS
127.0.0.1 ads.bigcitytools.com #SpySweeperCASS
127.0.0.1 ads.bitsonthewire.com #SpySweeperCASS
127.0.0.1 ads.bloomberg.com #SpySweeperCASS
127.0.0.1 ads.cashsurfers.com #SpySweeperCASS
127.0.0.1 ads.cbc.ca #SpySweeperCASS
127.0.0.1 ads.centralohio.com #SpySweeperCASS
127.0.0.1 ads.clearbluemedia.com #SpySweeperCASS
127.0.0.1 ads.clearchannel.com #SpySweeperCASS
127.0.0.1 ads.clickagents.com #SpySweeperCASS
127.0.0.1 ads.clickhouse.com #SpySweeperCASS
127.0.0.1 ads.colo.kiva.net #SpySweeperCASS
127.0.0.1 ads.columbian.com #SpySweeperCASS
127.0.0.1 ads.courierpostonline.com #SpySweeperCASS
127.0.0.1 ads.criticalmass.com #SpySweeperCASS
127.0.0.1 ads.csi.emcweb.com #SpySweeperCASS
127.0.0.1 ads.currantbun.com #SpySweeperCASS
127.0.0.1 ads.dai.net #SpySweeperCASS
127.0.0.1 ads.democratandchronicle.com #SpySweeperCASS
127.0.0.1 ads.desmoinesregister.com #SpySweeperCASS
127.0.0.1 ads.detelefoongids.nl #SpySweeperCASS
127.0.0.1 ads.developershed.com #SpySweeperCASS
127.0.0.1 ads.devx.com #SpySweeperCASS
127.0.0.1 ads.digitalmedianet.com #SpySweeperCASS
127.0.0.1 ads.discovery.com #SpySweeperCASS
127.0.0.1 ads.doubleclick.com #SpySweeperCASS
127.0.0.1 ads.doubleclick.net #SpySweeperCASS
127.0.0.1 ads.ecircles.com #SpySweeperCASS
127.0.0.1 ads.enliven.com #SpySweeperCASS
127.0.0.1 ads.erotism.com #SpySweeperCASS
127.0.0.1 ads.eu.msn.com #SpySweeperCASS
127.0.0.1 ads.exhedra.com #SpySweeperCASS
127.0.0.1 ads.fairfax.com.au #SpySweeperCASS
127.0.0.1 ads.filez.com #SpySweeperCASS
127.0.0.1 ads.floridatoday.com #SpySweeperCASS
127.0.0.1 ads.fool.com #SpySweeperCASS
127.0.0.1 ads.forbes.com #SpySweeperCASS
127.0.0.1 ads.forbes.net #SpySweeperCASS
127.0.0.1 ads.fortunecity.com #SpySweeperCASS
127.0.0.1 ads.fredericksburg.com #SpySweeperCASS
127.0.0.1 ads.freshmeat.net #SpySweeperCASS
127.0.0.1 ads.gameanswers.com #SpySweeperCASS
127.0.0.1 ads.gamespy.com #SpySweeperCASS
127.0.0.1 ads.globeandmail.com #SpySweeperCASS
127.0.0.1 ads.god.co.uk #SpySweeperCASS
127.0.0.1 ads.granadamedia.com #SpySweeperCASS
127.0.0.1 ads.greensboro.com #SpySweeperCASS
127.0.0.1 ads.guardian.co.uk #SpySweeperCASS
127.0.0.1 ads.guardianunlimited.co.uk #SpySweeperCASS
127.0.0.1 ads.hitcents.com #SpySweeperCASS
127.0.0.1 ads.hollywood.com #SpySweeperCASS
127.0.0.1 ads.hyperbanner.net #SpySweeperCASS
127.0.0.1 ads.i33.com #SpySweeperCASS
127.0.0.1 ads.iafrica.com #SpySweeperCASS
127.0.0.1 ads.iambic.com #SpySweeperCASS
127.0.0.1 ads.icq.com #SpySweeperCASS
127.0.0.1 ads.ign.com #SpySweeperCASS
127.0.0.1 ads.imagine-inc.com #SpySweeperCASS
127.0.0.1 ads.imdb.com #SpySweeperCASS
127.0.0.1 ads.infi.net #SpySweeperCASS
127.0.0.1 ads.infospace.com #SpySweeperCASS
127.0.0.1 ads.iwon.com #SpySweeperCASS
127.0.0.1 ads.jacksonsun.com #SpySweeperCASS
127.0.0.1 ads.jpost.com #SpySweeperCASS
127.0.0.1 ads.jwtt3.com #SpySweeperCASS
127.0.0.1 ads.link4ads.com #SpySweeperCASS
127.0.0.1 ads.list-universe.com #SpySweeperCASS
127.0.0.1 ads.live365.com #SpySweeperCASS
127.0.0.1 ads.lycos.com #SpySweeperCASS
127.0.0.1 ads.madison.com #SpySweeperCASS
127.0.0.1 ads.mcafee.com #SpySweeperCASS
127.0.0.1 ads.mdchoice.com #SpySweeperCASS
127.0.0.1 ads.mediadevil.com #SpySweeperCASS
127.0.0.1 ads.mediaodyssey.com #SpySweeperCASS
127.0.0.1 ads.mediaturf.net #SpySweeperCASS
127.0.0.1 ads.mh5.com #SpySweeperCASS
127.0.0.1 ads.mirrormedia.co.uk #SpySweeperCASS
127.0.0.1 ads.msn.com #SpySweeperCASS
127.0.0.1 ads.msn-ppe.com #SpySweeperCASS
127.0.0.1 ads.musiccity.com #SpySweeperCASS
127.0.0.1 ads.mysimon.com #SpySweeperCASS
127.0.0.1 ads.nandomedia.com #SpySweeperCASS
127.0.0.1 ads.narrowline.com #SpySweeperCASS
127.0.0.1 ads.nerve.com #SpySweeperCASS
127.0.0.1 ads.netmechanic.com #SpySweeperCASS
127.0.0.1 ads.newcity.com #SpySweeperCASS
127.0.0.1 ads.newcitynet.com #SpySweeperCASS
127.0.0.1 ads.newsdigital.net #SpySweeperCASS
127.0.0.1 ads.newsint.co.uk #SpySweeperCASS
127.0.0.1 ads.newsquest.co.uk #SpySweeperCASS
127.0.0.1 ads.newtimes.com #SpySweeperCASS
127.0.0.1 ads.ninemsn.com.au #SpySweeperCASS
127.0.0.1 ads.northjersey.com #SpySweeperCASS
127.0.0.1 ads.nwsource.com #SpySweeperCASS
127.0.0.1 ads.nyi.net #SpySweeperCASS
127.0.0.1 ads.nypost.com #SpySweeperCASS
127.0.0.1 ads.nytimes.com #SpySweeperCASS
127.0.0.1 ads.ole.com #SpySweeperCASS
127.0.0.1 ads.paxnet.co.kr #SpySweeperCASS
127.0.0.1 ads.paxnet.com #SpySweeperCASS
127.0.0.1 ads.peel.com #SpySweeperCASS
127.0.0.1 ads.pennyweb.com #SpySweeperCASS
127.0.0.1 ads.premiumnetwork.com #SpySweeperCASS
127.0.0.1 ads.realcities.com #SpySweeperCASS
127.0.0.1 ads.realmedia.com #SpySweeperCASS
127.0.0.1 ads.rottentomatoes.com #SpySweeperCASS
127.0.0.1 ads.scifi.com #SpySweeperCASS
127.0.0.1 ads.seattletimes.com #SpySweeperCASS
127.0.0.1 ads.smartclicks.com #SpySweeperCASS
127.0.0.1 ads.smartclicks.net #SpySweeperCASS
127.0.0.1 ads.snowball.com #SpySweeperCASS
127.0.0.1 ads.specificpop.com #SpySweeperCASS
127.0.0.1 ads.sptimes.com #SpySweeperCASS
127.0.0.1 ads.starnews.com #SpySweeperCASS
127.0.0.1 ads.statesmanjournal.com #SpySweeperCASS
127.0.0.1 ads.stileproject.com #SpySweeperCASS
127.0.0.1 ads.switchboard.com #SpySweeperCASS
127.0.0.1 ads.telegraph.co.uk #SpySweeperCASS
127.0.0.1 ads.themes.org #SpySweeperCASS
127.0.0.1 ads.theolympian.com #SpySweeperCASS
127.0.0.1 ads.thestar.com #SpySweeperCASS
127.0.0.1 ads.tmcs.net #SpySweeperCASS
127.0.0.1 ads.tripod.com #SpySweeperCASS
127.0.0.1 ads.tucows.com #SpySweeperCASS
127.0.0.1 ads.ugo.com #SpySweeperCASS
127.0.0.1 ads.usatoday.com #SpySweeperCASS
127.0.0.1 ads.viaarena.com #SpySweeperCASS
127.0.0.1 ads.videoaxs.com #SpySweeperCASS
127.0.0.1 ads.vnuemedia.com #SpySweeperCASS
127.0.0.1 ads.washingtonpost.com #SpySweeperCASS
127.0.0.1 ads.web.aol.com #SpySweeperCASS
127.0.0.1 ads.web.de #SpySweeperCASS
127.0.0.1 ads.web21.com #SpySweeperCASS
127.0.0.1 ads.webcash.nl #SpySweeperCASS
127.0.0.1 ads.wnd.com #SpySweeperCASS
127.0.0.1 ads.x10.com #SpySweeperCASS
127.0.0.1 ads.xtra.co.nz #SpySweeperCASS
127.0.0.1 ads.zdnet.com #SpySweeperCASS
127.0.0.1 ads01.focalink.com #SpySweeperCASS
127.0.0.1 ads02.focalink.com #SpySweeperCASS
127.0.0.1 ads03.focalink.com #SpySweeperCASS
127.0.0.1 ads-03.tor.focusin.ads.targetnet.com #SpySweeperCASS
127.0.0.1 ads04.focalink.com #SpySweeperCASS
127.0.0.1 ads05.focalink.com #SpySweeperCASS
127.0.0.1 ads06.focalink.com #SpySweeperCASS
127.0.0.1 ads08.focalink.com #SpySweeperCASS
127.0.0.1 ads09.focalink.com #SpySweeperCASS

If you need to see everything, pls let me know how to get it to you.

 

BeetleBailey--I did not know whether to put the last paragraph first, but decided to go with this sequence.

Is Windows Defender identifying the whole HOSTS file or just an entry in the HOSTS file?
You do not have to run a HOSTS file. You can delete the whole file.
This was something you created, unless some malware created it. It does not come with Windows (unless it is the HOSTS.sam file--which I cannot believe would cause problems). And you can delete HOSTS.sam, too, if necessary.
Some info on the HOSTS file.
http://www.accs-net.com/hosts/

Having said all that, maybe malware did create your HOSTS file. Malware certainly is capable of creating entries in the HOSTS file. And the fact that you are losing the connection to the internet could also suggest mayware.
Perhaps you should try the procedure here
http://www.windowsbbs.com/showthread.php?t=37074

 

I'm going to give a guess and say you're running SpySweeper with its 'Host Shield' enabled. As all those entries look to be from their hosts file which only includ ad servers.

What windows Defender is 'seeing' is the names of each line, which if they were not re-directing to your own machine, which is what 127.0.0.1 is, would be a problem.

I would suggest as stated above, to have Windows Defender ignore that hosts file, if that option is available. I'm not familiar enough with it to say one way or the other.

BTW, it is a fairly short hosts file with other third party hosts files typically running at 20,00 entries or more, some as high as 40,000. Those host file apps, Spy Sweeper cannot handle. Even the new beta, released May 15 does not appear to have any extra oomph in that area.

Hope that hlps some.

 

BeetleBailey--
(Did you add those HOSTS file entries to your post after I posted? )

The HOSTS file you have posted is close to the start of a typical HOSTS file. But are there several lines preceeded by the # symbol that appear at the very beginning--before what you have posted ?
Actually that is not very important.
It is the next line that is important. Is it 127.0.0.1 localhost ?
127.0.0.1 localhost should appear just before the entries you have posted.
If it does, your HOSTS file is one that should protect you.
If not, your HOSTS file has a problem, as TeMerc has mentioned.
And did you create this HOSTS file ?
As I mentioned earlier, a HOSTS file is not a part of Windows.
Or did SpySweeper create it?
In that case, I know nothing about SpySweeper, other than it appears reputable. And apparently there is a conflict between SpySweeper and Windows Defender.
So do not bother reading the rest of this post because I cannot help with SpySweeper issues.
If you are still reading--
What is the actual Windows Defender message about the HOSTS file?
You say "it keeps identifying a HOST file in C:\Windows\system32\drivers\etc\HOSTS " . I do not understand "identifying ".
What I would expect Windows Defender to alert you to is that some program is trying to change your HOSTS file--not just that you have a HOSTS file.
For what it is worth, I have a HOSTS file and Windows Defender without any WD alerts.
What to do about it? Answers to the above would help us help you.
I suggest that first.
Yes, you can tell Windows Defender to ignore the HOSTS file. But I am not sure I would want to not know if something was trying to alter my HOSTS file.
You might want to look at some of the references here
http://www.google.com/search?source...GGLD:2004-31,GGLD:en&q=Windows+Defender+HOSTS
There are so many possibilities.

 

TeMerc, welcome to the Board

Is this you ? http://temerc.com/

Regards - Charles

 

Yes, sir, that would indeed be me, thanks for the welcome, just getting a feel for things.

 

msg deleted