Hosts-file

Lord developers, when you already decide the question about the technical support? Again, we do not get answers to their questions.

Not sure but did you try different settings for IDS? I think Bitdefender don't block/detect modifications to host file. HIPS technology can detect this, but Bitdefender don't have HIPS as there is no place for HIPS (which require frequent prompts from user) in the silent security.

Pushkar112

Not sure but did you try different settings for IDS? I think Bitdefender don't block/detect modifications to host file. HIPS technology can detect this, but Bitdefender don't have HIPS as there is no place for HIPS (which require frequent prompts from user) in the silent security.

But Windows 8 Does Not Give Necessary permission to edit hosts till we don't give notepad admin rights

Anti-virus is installed on the infected system.

Before Bitdefender found such modifications when scanning, not now, I would like to draw attention.

Before Bitdefender found such modifications when scanning, not now, I would like to draw attention.

What do you want to say, does Bitdefender detect the infected host file in Real-Time (On-Access) Scanning or via On-Demand Scan (Full or Contextual Scan tasks etc)?

The on-demand scan, I put the file, you can check yourself.

https://www.virustotal.com/file/ab115547cd7...sis/1355417507/

@Rampant

I've checked the host file you uploaded, but it is not detected by the Contextual Scan by Bitdefender.

What was the path of that infected host file, I means is it at its original location or copied at some other path e.g D drive etc and then you scan it? I think path is also important and Bitdefender may also consider the path.

Kindly check the results from Virustotal.com

Most of the antiviruses not able to detect that malware entries in the host file. So from this I am thinking that the such infected host file can't be detected by the conventional detection techniques Signature based or Heuristics etc, rather its modification/access/read/write/delete etc can only be detected by HIPS based technology or similar or some antivirus programs such as Avira has option to block access and modification to host file. But I am keen to know how Bitdefender protect host file from modification, because its a very basic and protection concern.

Do you agree Rampant with my statements?

Actually also IDS failed in this situation i.e at the time of modification/infection. So after infection or modification, there is apparently nothing can be done now, instead we can restore the host file by deleting the malware entries manually.

I totally agree with you, proactive methods also do not protect against changes in the file, but the 2010 version, to track changes and warned of modifications.

Hi, Christian! Will comments?

Hello

The situation was send to our labs and I will get back to you with some conclusions.

Take care.

May be HIPS can provide better prevent such host file modifications.

http://yadi.sk/d/q242zVyo1mPtC

There is an interesting virus, Bitdefender does not respond. Swipe tests. Password - "infected"

http://rghost.ru/43323066

Just a couple of viruses.

http://rghost.ru/43332814

Laguna

I want to support user Rampant. I am unable to test the HIPS-protection on real viruses. But I spent this synthetic test and protection Bitdefender HIPS was not passed ...

Difference Between Ids And Hips?

As far as I know Bitdefender don't have HIPS, but the developers are claiming that IDS and AVC works together to meet HIPS requirements, but actually IDS + AVC ≠ HIPS . I've a some discussion about HIPS here, you can join me there

Laguna

Hi, ONT

I am ready to support you, indeed all would like to see a more efficient work HIPS-protection Bitdefender.

Hi, ONT

I am ready to support you, indeed all would like to see a more efficient work HIPS-protection Bitdefender.

Thanks, kindly post and support me there on that post about fully user customized HIPS implementation in future version of Bitdefender.

http://rghost.ru/43441253

http://file.karelia.ru/kv3z4k/

The virus changes the administrator password, bitdefender proactive module, can not prevent the destruction.

http://anubis.iseclab.org/?action=result&a...amp;format=html

Analysis of Anubis.

You certainly add this to the sample database of signatures, but would like to know when you expand the functionality of proactive technologies? I'm trying for a year to get a sensible answer you, but get only silence!

http://news.drweb.com/?i=3373&c=5&lng=en&p=0

Developers! I would like to get an answer why I was ignored on this forum? I am over 10 years to promote your product, and the result is a complete disregard to all my requests. I suggest that all my problems, because I'm from Russia. If it is, so you have to make the ban list, and I will not unsubscribe to your forum.

http://rghost.ru/private/44710704/a53de1f4...338db933479c246

Bitdefender again possible to modify the hosts file. Developers can already do something proactive technologies do not work, and you call it a quiet protection?

Hello

The files were submitted to the Labs for further analysis.

As for a solution against this malware, the Active Virus Control are currently working to solve this and update will be released soon in the market.

Thank you!

Hi Christian!

We will wait for the results.

Thank you.

Hello,

I think an option, to lock/unlock the Hostfile (check or unchecked by the user) is the best and simply way

Regards;

Vigen.

Hello,

My colleagues created a new detection routine for the Hosts file and any redirects should be detected and blocked.

Thank you!

@ Christian

How to implement this technology, the product should get an updated engine?

Hello,

My colleagues created a new detection routine for the Hosts file and any redirects should be detected and blocked.

Thank you!

Hello Christian,

In first, sorry for my bad English

This is just my opinion, but I think that option is more suitable, because some users change their file and the same could therefore find this block by this new détection routine.

If I understand correctly, these are the redirects that are blocked? No changes to the file?

I think it is more complex to develop a routine, a simple blocking option. I ask myself the question of relevance of blocking redirects if the file is even when modified.

If the host file is a change so will prevent the user on the web, and thus access the support and the user does not have sufficient knowledge to put a "zero" the host file, it may end up with a machine "blocked".

An option "basic" prevents this sort of troubles.

After, is it possible to integrate it into the product? Mystery ...

Regards;

Vigen.

Hello,

My colleagues created a new detection routine for the Hosts file and any redirects should be detected and blocked.

Thank you!

Host file is still vulnerable, why bitdefender does not protect this critical system object?

https://mega.co.nz/#!FwIUALZS!EIC8d...3INpMS1Pn6m5Rz0

And here's another virus that modifies the hosts file, and again the bitdefender does not react!

Bitdefender Windows 8 Security

A sample for analysis.

Hello Christian,

In first, sorry for my bad English

This is just my opinion, but I think that option is more suitable, because some users change their file and the same could therefore find this block by this new détection routine.

If I understand correctly, these are the redirects that are blocked? No changes to the file?

I think it is more complex to develop a routine, a simple blocking option. I ask myself the question of relevance of blocking redirects if the file is even when modified.

If the host file is a change so will prevent the user on the web, and thus access the support and the user does not have sufficient knowledge to put a "zero" the host file, it may end up with a machine "blocked".

An option "basic" prevents this sort of troubles.

After, is it possible to integrate it into the product? Mystery ...

Regards;

Vigen.

You want to say that Christian said that only the redirect attempts weill be detected and blocked and the modifications by the malware to the host will not be detected means that the altered host file will not be detected?

Hello,

This is what I understood.

But translation tools do not facilitate understanding

I think an option to just locked the file, and the simplest alternative, and faster development.

But its just my opinion.

Regards;

Vigen.

Thanks, kindly post and support me there on that post about fully user customized HIPS implementation in future version of Bitdefender.

HIPS is not useful in the case of Bitdefender ... For the HOST file, just an option to lock / unlock write, enough ... No need for that an HIPS.

Is just my opinion..

Regards;

Vigen.

Bitdefender found an infected host file after restoring

# BitDefender has clean hosts file

127.0.0.1    localhost


#Original code from this file
#<Line Removed>:#  Copyright  (c)  1993-2009  Microsoft  Corp.
#<Line Removed>:#
#<Line Removed>:#  This  is  a  sample  HOSTS  file  used  by  Microsoft  TCP/IP  for  Windows.
#<Line Removed>:#
#<Line Removed>:#  This  file  contains  the  mappings  of  IP  addresses  to  host  names.  Each
#<Line Removed>:#  entry  should  be  kept  on  an  individual  line.  The  IP  address  should
#<Line Removed>:#  be  placed  in  the  first  column  followed  by  the  corresponding  host  name.
#<Line Removed>:#  The  IP  address  and  the  host  name  should  be  separated  by  at  least  one
#<Line Removed>:#  space.
#<Line Removed>:#
#<Line Removed>:#  Additionally,  comments  (such  as  these)  may  be  inserted  on  individual
#<Line Removed>:#  lines  or  following  the  machine  name  denoted  by  a  '#'  symbol.
#<Line Removed>:#
#<Line Removed>:#  For  example:
#<Line Removed>:#
#<Line Removed>:#            102.54.94.97          rhino.acme.com                    #  source  server
#<Line Removed>:#              38.25.63.10          x.acme.com                            #  x  client  host
#<Line Removed>:#  localhost  name  resolution  is  handled  within  DNS  itself.
#<Line Removed>:#   127.0.0.1              localhost
#<Line Removed>:#   ::1                          localhost
#<Line Removed>:127.0.0.1  validation.sls.microsoft.com
#<Line Removed>:127.0.0.1  www.iobit.com

and it's original content

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

# localhost name resolution is handled within DNS itself.
#    127.0.0.1       localhost
#    ::1             localhost

why such a difference?

And there on this forum who can answer my question? Or am I asking too difficult questions?

http://yadi.sk/d/kLJ51CdXA3xb3

Bitdefender did not learn to defend the host file!

Hello, does anyone pay attention to this subject? Can anyone give comments?

I am a fool, and it's one I need, I'm sorry to bother you.