Hosts Hijack Warning

I'm using Windows Defender & the free version of Malwarebytes. Today, the notification area said "Windows Security - Actions needed". So I went to Settings > Update & Security > Windows Security > Virus & threat protection & saw this:
Clicking on the down arrow, showed this:
So I opened the hosts file, using BlueLife Hosts Editor. I didn't see anything funny, but I'm not sure how I'd check. I haven't noticed any problems with Windows. Also, my hosts file is "read only".

Note that the date of these "hijacks" were 4/9 & 4/10, & I didn't receive any notice until today 4/12. Also, I just checked again & now the alert level has been changed to Moderate. It also doesn't list any program that is infected.

Is there a way to check whether there's a virus or a false positive?

Thank you in advance.

Can you post the host file so we can check it

Possible false positive since you are using a host file editor.

Samuria said:

Can you post the host file so we can check it

Sure. Thank you for your quick reply. Whoops. I'm having some trouble uploading the file. When I click the attachments icon, put in the filepath & choose upload, it says invalid file. I'm wondering if there's some other way to upload it.
hosts.txt
I saved it as a text file...hope it's attached.

bro67 said:

Possible false positive since you are using a host file editor.

Thank you for your quick reply.

phrab said:

Note that the date of these "hijacks" were 4/9 & 4/10, & I didn't receive any notice until today 4/12.

Defender noticed, that you have changed HOSTS and probably today something was blocked, that triggered the alert. Like you have blocked fake antispyware, but Defender does not know that, malware tends to block legitimate ones via HOSTS as well.

TairikuOkami said:

Defender noticed, that you have changed HOSTS and probably today something was blocked, that triggered the alert. Like you have blocked fake antispyware, but Defender does not know that, malware tends to block legitimate ones via HOSTS as well.

Thank you for your reply. I checked & my hosts file hasn't changed.

I have the same one that I had since at least 3/27/21. Do you mean I tried to go to a website today that was blocked by my hosts file? I checked my history & don't see any site that's unusual.

A host file that size can slow the network to a crawl and the idea is outdated as ip change all the time by using open dns or cloudfire they block bad sites live and update all the time. Its a more modern solution

phrab said:

I checked my history & don't see any site that's unusual.

When you open a website, it also opens dozens of other websites, mostly related to ads/trackers.

Samuria said:

A host file that size can slow the network to a crawl and the idea is outdated as ip change all the time by using open dns or cloudfire they block bad sites live and update all the time. Its a more modern solution

Does that mean I should delete (or rename) my hosts file?
And do you recommend a particular open DNS or Cloudflare (I assume Cloudfire is a typo).

- - - Updated - - -

Samuria said:

A host file that size can slow the network to a crawl and the idea is outdated as ip change all the time by using open dns or cloudfire they block bad sites live and update all the time. Its a more modern solution

<br>
Does that mean I should delete (or rename) my hosts file?<br>And do you recommend a particular open DNS or Cloudflare (I assume Cloudfire is a typo).<br>

phrab said:

Does that mean I should delete (or rename) my hosts file?
And do you recommend a particular open DNS or Cloudflare (I assume Cloudfire is a typo).

- - - Updated - - -

<br>
Does that mean I should delete (or rename) my hosts file?<br>And do you recommend a particular open DNS or Cloudflare (I assume Cloudfire is a typo).<br>

What "probably" happened, is that your HOSTS file blocked some ad "for" Microsoft Edge", or some other Microsoft product.

VirusTotal <---- I scanned your HOSTS file at virustotal for you.


Also... your HOSTS file is located in the "etc" folder, here... C:\Windows\System32\drivers\etc

You don't need a tool to deal with the HOSTS file. If you want to use a pre-made HOSTS file, just open the etc folder, rename the current HOSTS file to hosts.old or similar, and just drag and drop the pre-made HOSTS file into the etc folder.
Make sure to make it "read-only", after you do this.