13

I took over a Windows 7 PC from a developer and in the hosts file there was this entry:

192.168.3.2 NPI2A54EB

Does anybody know why this would be entered there and if this could be a virus or would that be related to the developer's work (I can only check with him next week again)? (Am a little bit worried that it might be a virus, but I have checked with multiple antivirus programs and it looks clean.)

  • 3
    It isn't a virus. NPI2A54EB is a hostname to a machine that only exists on the local network. – Ramhound Oct 7 '15 at 16:56
  • 2
    well, the IP address is in a private range, and the name is not a FQDN and more than anything else, you don't generally use the host file for any other purpose. its resolution is localized to the host that possesses the file. – Frank Thomas Oct 7 '15 at 17:09
  • 4
    @ManOnAMission - "192.168.3.2" cannot exist outside of your local network. So NPI2A54EB must belong to a machine on said network. From a technical stand point there is absolutely no difference between NPI2A54EB and localhost which exist in every single Windows machine's host file with a network connection. There is zero chance it is a virus, how can I be so sure you ask?, one simple reason the ip address does not exist outside of the network so the "virus" wouldn't be able to talk to anything except what is on the network. – Ramhound Oct 7 '15 at 17:21
  • 1
    @Ramhound I would just like to state, that if 192.168.3.2 were an infected machine, a virus could use that as some kind of relay. I have seen—and cleaned up—some crazy things so you never know. – JakeGould Oct 7 '15 at 18:14
  • 3
    @JakeGould, true, but a malware could also empty the recycle bin. that does not imply that when a recycle bin is emptied, that it is reasonable to assume that malware is a likely, probable, or even only remotely probable vector. Since the Op is specifically asking about a virus, we should point out that that is not in the top 10 most reasonable causes. – Frank Thomas Oct 7 '15 at 18:32
25

Most likely that "NPI2A54EB" is (was?) a network attached HP printer, as it appears to follow their default JetDirect naming convention.

Here's a few of ours for example/comparison: NPI191832, NPI4B6E05, NPI907B3F, NPI95393C, NPIB80D5E, NPIB81360, etc.

From HP's HP Jetdirect Print Servers - Jetdirect Configuration Options a using DHCP, WINS, and DDNS Servers:

Normally an HP Jetdirect that receives a DHCP address will register the default host-name NPIxxxxxx of the HP Jetdirect at the WINS server. (xxxxxx = the last 6 digits of the MAC address of the Jetdirect.)

Probably put in the Hosts file by HP's driver/utility installer.

  • 2
    NPI = Network Printer Interface. Just added that info to my answer while you were posting this answer. – JakeGould Oct 7 '15 at 17:24
8

Shorter answer.

My guess is that hosts entry is just some shortcut the developer who had the machine previously setup for their convenience and is nothing to worry about. If somehow you are concerned about this specific entry, then just comment out that line in the hosts file, restart the machine and move on. Perhaps check the hosts file again on reboot to see if somehow a virus/malware action recreated such an entry again. But I wouldn’t be too worried about it.

FWIW, the NPI in NPI2A54EB could simply stand for “Network Printer Interface” and that entry could have been created by a printer driver install or something else connected to that laptop’s need to connect to a printer management system on a local area network.

Longer answer.

Does anybody know why this would be entered there and if this could be a virus or would that be related to the developer's work (I can only check with him next week again)? (Am a little bit worried that it might be a virus, but I have checked with multiple antivirus programs and it looks clean.)

If you borrowed the system from a developer and you are concerned about this, my gut tells me not to be worried. Not too sure what kind of “development” this developer you mentioned is actually doing, but in the world of web development it’s fairly common to see hosts files edited to allow local web development while using a hostname to make things easier and make sites/applications behave more like real world sites.

For example, if I were working on developing the website for example.com on my local desktop I might create an entry like this in my hosts file to allow for what I just described:

127.0.0.1   example_dev

Or maybe something like example.local:

127.0.0.1   example.local

That said, NPI2A54EB seems like an odd hostname that wouldn’t make many people’s lives easier. To me it parses like an assigned machine name an I.T. department would assign to hardware. Or perhaps direct traffic to some internal network server or device?

If this all makes you nervous, this is what you can do. Just edit the hosts file like this. Change that line to this:

#192.168.3.2 NPI2A54EB

Then reboot your machine and check the hosts file again. That # will comment out that odd hosts entry and effectively neutralize. The logic being that if the machine is infected with something like a virus or malware, that line will be uncommented fairly quickly on reboot.

And if something breaks because of this change, well you now know there was something the system needed that was to that entry and you should uncomment it.

But honestly, I doubt commenting out that entry will break anything. Like I said if this is a virus/malware and that’s a key factor to it, you will find out quite quickly on reboot… But I doubt that is what that entry is about. It’s most likely some internal server DNS shortcut the developer who originally was using the machine setup for their convenience and is of no concern to you.

  • 1
    IIRC, with Windows 7 (and Vista?), you no longer need to reboot for changes to take effect; You just need to relaunch the application. Or maybe that was just Chrome? – Cole Johnson Oct 8 '15 at 20:01
  • @ColeJohnson Maybe that’s the case, but I don’t use Windows regularly so can’t say. I will say from I.T. experience, a reboot costs nothing, takes less than a minute and then can confirm the change happened. Depending on the end-users I deal with, I sometimes encourage a reboot since it makes some people feel like they have done something “heavy” to assuredly solve a problem. – JakeGould Oct 8 '15 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.