F-Secure modifies hosts file and states that it can be restored but it's not possible

Hello,

Thanks for your feedback and response!

Yes, I do not mean that backup was a necessary thing in your case. I just wanted to understand if there was the hosts file with a lot of additions / editions , and if so, what if somewhere or somehow there might be a backup copy of its contents. But I think that if it were possible - you would have already tried to do it (let's say another system with the same approach, and so on).

And in other words, to understand the scale of the trouble - is it possible to restore all the edits manually by yourself (in case there is no way to find a proper solution).

However, it's good that there is already a potential possibility to communicate with Support Agent via the email channel.

I tried to quarantine two Eicars(test-file). It was generic "eicar.com"

Then, tried to use fsdumpqrt.exe. My "malware_samples.zip" structure is:

• Quarantine-folder with two folders "00000001" and "00000002"; each then with another folder that contained Info.xml and then path to the quarantined item (starting from Drive-letter). Both then with 'eicar.com' at the end.

I don't know if they encrypt, but it would make sense (to be honest). In my testing, nothing appears to be encrypted (except that the .zip file itself was password protected). If you got it not with Quarantine Dumper, but in a really complete manual approach (as described in KB article if Quarantine Dumper does not help) - then there may still be some differences. I did not check it (yet)

In Info.xml there is a 'binary' (?) description in base32 or base64 or something which looks like that. I did not manage to convert it to file by some online tools (but I think quarantined .com is a bit of 'tricky' - I just puzzled how to do so properly).

Too bad, then I would have thought - that with some other tool (as with F-Secure Online Scanner) or version - item would be visible in the quarantine.

It remains possible that some kind of scan was performed during the installation (it used to be, but as far as I remember, this has not been used for a long time). However, I haven't tried a clean install for a long time, and perhaps such a check happens only in very unique cases, the very-very first installation, or when some conditions arrives (there was no Windows Defender turned on or something like that, for example).

In any case, of course I think - that there should have been some kind of notification about the detection or information about. Could you also tried to check Windows Event Viewer (Journal) - Windows 7 (Start : Control Panel : System and Security : Administrative Tools --> Event Viewer) and Windows 8, Windows 10 (11?) by opening start menu (or whatever it called) and typing Event Viewer (or your local name of that tool; if Windows is localized).

For example, "FSecureUltralightSDK" under "Application and Services logs/F-Secure Ultralight SDK" - it may be with a bit more information about blocking/detecting event. Whether something was even logged or not.

Yes, true.

I can only note that if this was such a reason (that is, the hosts file was restored to the default view due to the detection and fixing of something else) - then it would be difficult for the software to evaluate the changes made to the hosts - are they safe or not (in the case if they are not known to be "dangerous" and when hosts-file itself is detected/quarantined). Therefore, such a rather generic title as ""Your original HOSTS file was infected"" is more like a limitation (and may be ok for most situations).

What about restoring from quarantine - still good to keep the potential opportunity.. that it will be possible to do it even if with the help of Support agents.

The Communtiy engine was changed and some of these resources (there are many of them, unfortunately) were not automatically available at the new URLs. But I think that mentioned one is which I provided in the first reply (about Quarantine Dumper).

How do I collect quarantined files? - F-Secure Community

I think yes. Although I would consider that there is little difference with contacting Support (especially since you may be contacted by email).

I think it meant there that F-Secure Labs will evaluate if it was a false positive or if there was a reason to quarantine the Hosts file.

Therefore, assuming that your result with a manual approach was with Quarantine Dumper (if not - could you try to use it?). F-Secure SAS is still there: Submit a sample | F-Secure (KB article about procedure: How can I submit samples to F-Secure? - F-Secure Community). Also, you can try to send already gathered files\folders 00000010 and 00000020.

But I think they might be empty.. By the way, what is their file size (does it look like an empty file or maybe a modified hosts file)?

If still not possible to deal with the situation (restore from quarantine). It might have been some kind of bug. And the quarantine process itself was not successfully completed or failed. This should not be, of course, in the best understanding. But, for example, if the system name or path, or username or something else contained / contains some features - the tool with which the attempt was made (at some stage) did not cope with the task. Well, this is just an virtual example (I don't know if this scenario is possible).

Then or still now (if the Support Agent contacts) - create fsdiag (Using the support tool | Total | Latest | F-Secure User Guides) and send it for analysis.

It's just not clear to me - when, at what stage and why the hosts file was changed. Especially if, as you say, there were no notifications about this.

Thanks!

Hello,

Good to hear that all is fine now!

Yes, mentioned thing is also part of 'post-removal' routine. I never experienced this by only installing F-Secure. Also, not every detection or 'cleaning up' will ended with those changes.

My understanding - if a malicious file (or something) found in critical area of system (let's say, even 'Desktop' folder) or many of them at once - situation can be treated as 'infection'. So, to disinfect: items are quarantined (or deleted); some settings are reverted to default state (which considered to be safe or secure).

So, to uncheck "show hidden files" is surely one of them (which I experienced a lot). And it is likely that "Windows Updates" (manual or disabled) can be reverted to be active (auto). In my Windows 10 it is 'on and active', but based on my past experience - probably that was a case indeed (as 'system updates' are recommended and malware will try to disable this component or 'replace' it sometimes).

So, these changes are not a detection of something suspicious - but was part of 'removal operation'. I think, it may be described somewhere in KB articles or Online Guides. I mean, I feel that you can use these settings - it can be 'restored' to default only after removing something (from critical area or a certain type of threat). If not - well, need to find a reason.

A good idea. :) But if it will be so - I mean, no prompts about any actions, but still something quarantined / changed - good to create a Support ticket. With fsdiag (F-Secure User Guides) - it may be easy to find out why such situations there.

Because it should not be like that (I think). Like if F-Secure failed to show popup or prompt/toast in very certain system's background.. or something malfunctioning.

You, also, can to exclude things to prevent any unwanted detections. For example, 'hosts' file was possible to exclude before. However, manual (context) scan will still detect it if something 'malicious' in there.

But I am not sure that excluding 'hosts'-file will prevent reverting back to default view in case of 'virus removal operation' (as other changes like 'showing hidden files'..) ... but I never tried to check this.

Thanks!