What keeps resetting the hosts file?

Topic

New Reply

I am trying to use the hosts file to block access to a couple of web sites. I add the lines and save the file and test it with IE8 and it blocks access to the sites just like I want.

However later the same day or the next day, the host file no longer contains the additions that I made and IE8 can access the unwanted sites.

It is as if something is rewriting the hosts file to contain only its original content. I have DNS Client service stopped and disabled.

Any ideas?

Reply | Quote

Replies

Hi Stephen,

That sounds like one of your security Apps is making the change, what have you installed in the way of security?

You do remove the read-only attribute from the file before changing it and reset it to read-only again afterwards? Do you also have a hosts.txt file in the directory? And you have file extensions unhidden?

Reply | Quote

Keep a eye on the time stamp, and see if that changes.

DaveA I am so far behind, I think I am First
Genealogy....confusing the dead and annoying the living

Reply | Quote

Stephen,

Andy had some good points.

One other question, when you notice your entries are missing do you see other entries or is it a completely blank hosts file?

Reply | Quote

Hi Andy, Dave and Tony,

Thanks for the quick responses.

I am using AVG free and Windows Firewall. I remove read-only, add my the sites I want to block, save the file and then set it to read-only. I do have file attributes unhidden and there is no hosts.txt file in the same directory.

I just checked the file and it was changed to contain the usual text header information about the file and only the 127.0.0.1 localhost entry yesterday afternoon about 3PM.

I appreciate everyone’s help. Any other ideas?

Thanks,

Steve

Reply | Quote

I just checked the file and it was changed to contain the usual text header information about the file and only the 127.0.0.1 localhost entry yesterday afternoon about 3PM.

I appreciate everyone’s help. Any other ideas?

Anything in your Event Viewer?

Otherwise, Winpatrol or a free trial of ZoneAlarm Internet Security may be able to indicate what is changing it.

Reply | Quote

Steve,

Just curious, but have you tried deleting the hosts file and recreating one?

Reply | Quote

I’ve had a quick browse over at the AVG Free forum and come across a thread which may be similar (unfortunately abandoned before a result was found). A normal scenario for a security app when the hosts file has changed unexpectedly is to replace the modified file with a saved copy of the original – of course, it would normally give you some kind of warning or option but if you were AFK when this happened, it may fit the bill. Check your Resident Shield and make an exception for the hosts file or folder and test. If that does not fix it, maybe it’s the potentially unwanted programs app that’s behind it, much less likely but you never can tell.

Do you have Windows Defender installed? I ask because it’s often so low-profile, it’s easy to forget about it.

Reply | Quote

Turn on Auditing via GPEDIT and then configure to audit changes to that file.

Reply | Quote

Thanks to everyone for your suggestions. I decided to uninstall AVG and installed MS Security Essentials and have run a full scan. I think that MS S E found that I had changed the hosts file since it popped up with “SettingsModifier: Win/32/PossibleHostsFileHijack”. Hopefully it found what has been changing the file, but the information did not identify any program that was making the change.

I will watch the file for a while and if it changes again, I’ll delet it and create a new one and try the audit.

Thanks for all the help. I’ll let you know what happens.

Thanks,

Steve

Reply | Quote

See if you find any help with this here.

Reply | Quote