Hello,
I agree with Greg's answers -
1. How can I remove the threat? Its as you see part of chrome and IE. So wont that corrupt those ? Please explain
Host files are not the Threat, however there is a suspicious code or changes to the host files.
2. Do I need to send these files to Symantec for Analaysis? If so, how can i Do it?
Yes, as Greg suggested, always a good idea.
3. As I Understand, so you recommend that its better to "Block" but then we have frequent Host & DNS file changes in the environment and that will create a lot of confusion, is it not? So what is the Best Pratice?
Try blocking host file modification -
How do I Block hosts file modification using Symantec Endpoint Protection (SEP) Application and Device Control policy?
https://www-secure.symantec.com/connect/downloads/how-do-i-block-hosts-file-modification-using-symantec-endpoint-protection-sep-application-
You can create a Application Control Policy, like to this below:
![](https://www-secure.symantec.com/connect/imagebrowser/view/image/1921521/_original)
by Creating this policy, thereforth onwards all the modifications to the host file would be blocked.
4. How I can see these SONAR logs from SEPM. Unfortuantely, I couldnt find any Logs in SONAR from SEPM. Please tell which logs \filters to be used. So that i can Terminate them from SEPM itself? Is there any actionto be taken from SEPM?
By default, SONAR is configured to ignore System Change Events--you may choose to use the default configuration if you do not wish to block these events. Or, you may choose "Prompt" and the user will receive a more informative message from Endpoint Protection, but the choice to block or allow will be up to the user.
See also Symantec Endpoint Protection 12.1: Manager Risk distribution summary report lists "Microsoft Windows Operating System" as a risk name