Hello,
I recently started using XP Pro SP2, installing it not long ago. The system hasn't had any time to be infected by any malware. Aside from FireFox 3.5.1, WordPerfect Suite 12, WinAmp 5, and my drivers, I haven't installed much in it. I have a program called Adfree 3.2. It is an ad blocker which relies on the system HOSTS text file to block ads, substituting any small GIF image of your choice in its place. I correctly reconfigured it to place its HOSTS file in the
C:\WINDOWS\system32\driver
folder. This is the beginning of the Adfree 3.2 HOSTS file which I have updated with newer advertisement server locations. I estimate there are about 1,890 server locations. The HOSTS file is 56K bytes:
===================
#
# Hosts file created by AdFree
#
# localhost: Needs to stay like this to work
127.0.0.1 localhost
# Other servers: These servers are directed towards
# AdFree to be filtered. You must alter these from
# within the AdFree program.
127.0.0.1 123banners.com
127.0.0.1 247media.com
127.0.0.1 24pm-affiliation.com
127.0.0.1 7adpower.com
127.0.0.1 911promotion.com
127.0.0.1 a.as-us.falkag.net
127.0.0.1 a.consumer.net
127.0.0.1 a.r.tv.com
...
===================
However, I am having a problem with XP Pro SP2. Every time I start any operation, no matter what it is, XP automatically deletes the HOSTS file. No matter if I start any browser, IE or FireFox, Windows Explorer, Notepad, even if I open any applet in "Control Panel" > "Administrative Tools", XP will delete the HOSTS file. The system and Adfree need the HOSTS file to properly block ads. I have spent over 12 hours trying find the solution online, but with no success. I shut off the "DNS Client" service, I even tried shutting off the XP firewall, but nothing has worked.
I can get Adfree to work correctly, substituting a GIF of my choice in place of ads. I must set the HOSTS file to "read only." However, Adfree isn't really meant to function that way and I will run into problems if I try to "pause" it. Plus, every time I start or exit Adfree, or shut off the system, I must change the "read only" setting. Reading posts on the 'Net, I know others have had this problem, but they never posted their solution. I know there is a either a service applet I can disable or Registry setting I can use to stop XP from deleting the HOSTS file. Does anyone know what it is?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Have you tried using Process Monitor to pinpoint which process is deleting the hosts file? http://technet.microsoft.c
Just start Process Monitor and the following filter: path, contains, hosts, include
That should show give you a better idea what exactly is happening to that file.
Never seen this problem myself but I out of curiosity I did some searching and found this post. It's a bit old but may still be useful.
http://www.computing.net/a
Cheers
Hello,
I ran Process Monitor v2.5 and added the HOSTS filter as suggested. I also opened Windows Explorer at folder C:\WINDOWS\system32\driver
I really wish I knew what is going on. I'm getting tired of dealing with this. If necessary, I will call Microsoft Support and perhaps someone there can help me if no one here can. That is, if they still provide free support for XP Pro SP2. Here are the results from Process Monitor. There are 5 lines, 4 from "Explorer.EXE" and 1 from "notepad.exe." I will post the Event and Process information from the first Explorer.EXE line. Does ANYONE know the solution to this problem? I know it's some kind of service or Registry setting. PLEASE!
==========================
EVENT
Date & Time: 8/6/2009 8:43:50 PM
Event Class: File System
Operation: CreateFile
Result: SUCCESS
Path: C:\WINDOWS\system32\driver
TID: 1312
Duration: 0.0000274
Desired Access: Read Attributes, Delete
Disposition: Open
Options: Non-Directory File, Open Reparse Point
Attributes: n/a
ShareMode: Read, Write, Delete
AllocationSize: n/a
OpenResult: Opened
==========================
PROCESS
Description: Windows Explorer
Company: Microsoft Corporation
Name: Explorer.EXE
Version: 6.0.2900.2180
Path: C:\WINDOWS\Explorer.EXE
Command Line: C:\WINDOWS\Explorer.EXE
PID: 1200
Parent PID: 1184
Session ID: 0
User: DANIEL\danielm
Auth ID: 00000000:0000ddef
Architecture: 32-bit
Virtualized: n/a
Integrity: n/a
Started: 8/6/2009 8:31:46 PM
Ended: (Running)
Modules:
Explorer.EXE 0x1000000 0xff000 C:\WINDOWS\Explorer.EXE
GUStrLib.dll 0x1590000 0x1c000 C:\WINDOWS\system32\GUStrL
hercplgs.cpl 0x1810000 0x73000 C:\WINDOWS\system32\hercpl
rsaenh.dll 0xffd0000 0x28000 C:\WINDOWS\system32\rsaenh
lpad32.dll 0x10000000 0x26000 C:\WINDOWS\system32\lpad32
PortableDeviceApi.dll 0x10930000 0x49000 C:\WINDOWS\system32\Portab
PortableDeviceTypes.dll 0x109c0000 0x2c000 C:\WINDOWS\system32\Portab
WPDShServiceObj.dll 0x164a0000 0x23000 C:\WINDOWS\system32\WPDShS
xpsp2res.dll 0x20000000 0x2c5000 C:\WINDOWS\system32\xpsp2r
PFIM120EN.DLL 0x383d0000 0xa000 H:\WordPerfect Office 12\Programs\PFIM120EN.DLL
PFSE120.DLL 0x38480000 0x16000 H:\WordPerfect Office 12\Programs\PFSE120.DLL
WINHTTP.dll 0x4d4f0000 0x58000 C:\WINDOWS\system32\WINHTT
UxTheme.dll 0x5ad70000 0x38000 C:\WINDOWS\system32\UxThem
NETAPI32.dll 0x5b860000 0x54000 C:\WINDOWS\system32\NETAPI
themeui.dll 0x5ba60000 0x71000 C:\WINDOWS\system32\themeu
ShimEng.dll 0x5cb70000 0x26000 C:\WINDOWS\system32\ShimEn
comctl32.dll 0x5d090000 0x97000 C:\WINDOWS\system32\comctl
msisip.dll 0x60980000 0x7000 C:\WINDOWS\system32\msisip
AcGenral.DLL 0x6f880000 0x1ca000 C:\WINDOWS\AppPatch\AcGenr
WS2HELP.dll 0x71aa0000 0x8000 C:\WINDOWS\system32\WS2HEL
WS2_32.dll 0x71ab0000 0x17000 C:\WINDOWS\system32\WS2_32
WSOCK32.dll 0x71ad0000 0x9000 C:\WINDOWS\system32\WSOCK3
SAMLIB.dll 0x71bf0000 0x13000 C:\WINDOWS\system32\SAMLIB
actxprxy.dll 0x71d40000 0x1c000 C:\WINDOWS\system32\actxpr
mydocs.dll 0x72410000 0x1a000 C:\WINDOWS\system32\mydocs
msacm32.drv 0x72d10000 0x8000 C:\WINDOWS\system32\msacm3
wdmaud.drv 0x72d20000 0x9000 C:\WINDOWS\system32\wdmaud
WZCSAPI.DLL 0x73030000 0x10000 C:\WINDOWS\system32\WZCSAP
mfc42.dll 0x73dd0000 0xfe000 C:\WINDOWS\system32\mfc42.
DSOUND.dll 0x73f10000 0x5c000 C:\WINDOWS\system32\DSOUND
msi.dll 0x745e0000 0x2c6000 C:\WINDOWS\system32\msi.dl
POWRPROF.dll 0x74ad0000 0x8000 C:\WINDOWS\system32\POWRPR
BatMeter.dll 0x74af0000 0xa000 C:\WINDOWS\system32\BatMet
webcheck.dll 0x74b30000 0x46000 C:\WINDOWS\system32\webche
oleacc.dll 0x74c80000 0x2c000 C:\WINDOWS\system32\oleacc
wshext.dll 0x74ea0000 0x10000 C:\WINDOWS\system32\wshext
CRYPTUI.dll 0x754d0000 0x80000 C:\WINDOWS\system32\CRYPTU
SXS.DLL 0x75e90000 0xb0000 C:\WINDOWS\system32\SXS.DL
BROWSEUI.dll 0x75f80000 0xfc000 C:\WINDOWS\system32\BROWSE
msvcp60.dll 0x76080000 0x65000 C:\WINDOWS\system32\msvcp6
stobject.dll 0x76280000 0x21000 C:\WINDOWS\system32\stobje
WINSTA.dll 0x76360000 0x10000 C:\WINDOWS\system32\WINSTA
MSIMG32.dll 0x76380000 0x5000 C:\WINDOWS\system32\MSIMG3
comdlg32.dll 0x763b0000 0x49000 C:\WINDOWS\system32\comdlg
NETSHELL.dll 0x76400000 0x1a6000 C:\WINDOWS\system32\NETSHE
CSCDLL.dll 0x76600000 0x1d000 C:\WINDOWS\System32\CSCDLL
RASDLG.dll 0x768d0000 0xa4000 C:\WINDOWS\system32\RASDLG
LINKINFO.dll 0x76980000 0x8000 C:\WINDOWS\system32\LINKIN
ntshrui.dll 0x76990000 0x25000 C:\WINDOWS\system32\ntshru
USERENV.dll 0x769c0000 0xb3000 C:\WINDOWS\system32\USEREN
ATL.DLL 0x76b20000 0x11000 C:\WINDOWS\system32\ATL.DL
WINMM.dll 0x76b40000 0x2d000 C:\WINDOWS\system32\WINMM.
credui.dll 0x76c00000 0x2e000 C:\WINDOWS\system32\credui
WINTRUST.dll 0x76c30000 0x2e000 C:\WINDOWS\system32\WINTRU
IMAGEHLP.dll 0x76c90000 0x28000 C:\WINDOWS\system32\IMAGEH
MPRAPI.dll 0x76d40000 0x18000 C:\WINDOWS\system32\MPRAPI
iphlpapi.dll 0x76d60000 0x19000 C:\WINDOWS\system32\iphlpa
adsldpc.dll 0x76e10000 0x25000 C:\WINDOWS\system32\adsldp
rtutils.dll 0x76e80000 0xe000 C:\WINDOWS\system32\rtutil
rasman.dll 0x76e90000 0x12000 C:\WINDOWS\system32\rasman
TAPI32.dll 0x76eb0000 0x2f000 C:\WINDOWS\system32\TAPI32
RASAPI32.dll 0x76ee0000 0x3c000 C:\WINDOWS\system32\RASAPI
WTSAPI32.dll 0x76f50000 0x8000 C:\WINDOWS\system32\WTSAPI
WLDAP32.dll 0x76f60000 0x2c000 C:\WINDOWS\system32\WLDAP3
CLBCATQ.DLL 0x76fd0000 0x7f000 C:\WINDOWS\system32\CLBCAT
COMRes.dll 0x77050000 0xc5000 C:\WINDOWS\system32\COMRes
OLEAUT32.dll 0x77120000 0x8c000 C:\WINDOWS\system32\OLEAUT
WININET.dll 0x771b0000 0xa6000 C:\WINDOWS\system32\WININE
urlmon.dll 0x77260000 0x9c000 C:\WINDOWS\system32\urlmon
comctl32.dll 0x773d0000 0x102000
C:\WINDOWS\WinSxS\x86_Micr
ff9\comctl32.dll
ole32.dll 0x774e0000 0x13c000 C:\WINDOWS\system32\ole32.
SHDOCVW.dll 0x77760000 0x16c000 C:\WINDOWS\system32\SHDOCV
SETUPAPI.dll 0x77920000 0xf3000 C:\WINDOWS\system32\SETUPA
cscui.dll 0x77a20000 0x54000 C:\WINDOWS\System32\cscui.
CRYPT32.dll 0x77a80000 0x94000 C:\WINDOWS\system32\CRYPT3
MSASN1.dll 0x77b20000 0x12000 C:\WINDOWS\system32\MSASN1
appHelp.dll 0x77b40000 0x22000 C:\WINDOWS\system32\appHel
midimap.dll 0x77bd0000 0x7000 C:\WINDOWS\system32\midima
MSACM32.dll 0x77be0000 0x15000 C:\WINDOWS\system32\MSACM3
VERSION.dll 0x77c00000 0x8000 C:\WINDOWS\system32\VERSIO
msvcrt.dll 0x77c10000 0x58000 C:\WINDOWS\system32\msvcrt
msv1_0.dll 0x77c70000 0x23000 C:\WINDOWS\system32\msv1_0
ACTIVEDS.dll 0x77cc0000 0x32000 C:\WINDOWS\system32\ACTIVE
ADVAPI32.dll 0x77dd0000 0x9b000 C:\WINDOWS\system32\ADVAPI
RPCRT4.dll 0x77e70000 0x91000 C:\WINDOWS\system32\RPCRT4
GDI32.dll 0x77f10000 0x46000 C:\WINDOWS\system32\GDI32.
SHLWAPI.dll 0x77f60000 0x76000 C:\WINDOWS\system32\SHLWAP
Secur32.dll 0x77fe0000 0x11000 C:\WINDOWS\system32\Secur3
msvcr70.dll 0x7c000000 0x54000 C:\WINDOWS\system32\msvcr7
mfc70.dll 0x7c140000 0xee000 C:\WINDOWS\system32\mfc70.
kernel32.dll 0x7c800000 0xf4000 C:\WINDOWS\system32\kernel
ntdll.dll 0x7c900000 0xb0000 C:\WINDOWS\system32\ntdll.
SHELL32.dll 0x7c9c0000 0x814000 C:\WINDOWS\system32\SHELL3
Are you saying that each time you open NotePad.exe your hosts file is being deleted?!?
That sounds suspiciously like a virus. I would verify that the file has not been replaced somehow. Try opening Notepad and leave it open then run Adfree 3.2. Just watch the folder for a while see what happens. Then while still watching the folder close and reopen notepad. If your hosts file gets deleted again I would say notepad.exe has been infected.
I see. Sorry about that. I did read your original question but did not review it again after reading your last post and it simply slipped my mind that you said "...any operation..." Still sounds like viral activity.
I am not personaly fammilar with Adfree. However, here are a couple of thing you can try.
Boot into Safe Mode and see if it still happens?
If it dosen't, take a look at those items that are loaded at startup by starting msconfig.
I would also look at all the "Run" keys in the registry.
Enabling auditing on the etc folder through Advanced security properties may turn up in the event logs.
Actually I wouldn't assume that XP does the deleting. I think that's unlikely. More likely is that AdFree itself is the culprit. You can easily test that by creating an empty hosts file yourself while AdFree isn't running and see if it still randomly disappears. Or you can reconfigure AdFree to place its hosts file at a different location and see if it still disappears.
AdFree 3.2 seems to be over 7 years old. If the problem stops as soon as you stop using AdFree, I'd strongly suggest changing your ad blocker to one of the newer (and most likely way better) offerings.
>>>>>>>>>>>>>>>>>>
However, here are a couple of thing you can try.
Boot into Safe Mode and see if it still happens?
If it dosen't, take a look at those items that are loaded at startup by starting msconfig.
I would also look at all the "Run" keys in the registry.
Enabling auditing on the etc folder through Advanced security properties may turn up in the event logs.
<<<<<<<<<<<<<<<<<<
Krompton,
I already looked at the Registry Run keys in MSConfig, nothing suspicious. I'll try auditing the folder, then Safe Mode if testing Adfree, as stated below, doesn't work. BTW, I looked for the Security tab\Auditing option for the etc folder but it wasn't there. Apparently I must enable auditing first through a system service or some such.
>>>>>>>>>>>>>>>>>>
Actually I wouldn't assume that XP does the deleting. I think that's unlikely. More likely is that AdFree itself is the culprit. You can easily test that by creating an empty hosts file yourself while AdFree isn't running and see if it still randomly disappears. Or you can reconfigure AdFree to place its hosts file at a different location and see if it still disappears.
<<<<<<<<<<<<<<<<<<
synque,
that's a good idea. I didn't think of that. I'll test your theory later tonight. If true, there might be a setting I can use in an Adfree config file.
I've been pretty busy installing other software. I've been gradually building up this system. I'm half finished. I am ready to install M$ Office 2003, Adobe Acrobat, Symantec Norton SystemWorks with Anti-Virus, and Encarta DVD, (all legal CD's if you're wondering) in that order.
While I don't believe I am infected with a virus, I might do a Symantec Internet-based pre-scan anyway. I will certainly do a Norton AV CD pre-scan before installing.
Mercury.
>>>>>>>>>>>>>>>>>>
Actually I wouldn't assume that XP does the deleting. I think that's unlikely. More likely is that AdFree itself is the culprit. You can easily test that by creating an empty hosts file yourself while AdFree isn't running and see if it still randomly disappears. Or you can reconfigure AdFree to place its hosts file at a different location and see if it still disappears.
<<<<<<<<<<<<<<<<<<
synque,
I tested XP Pro SP2 by placing a full HOSTS file in C:\WINDOWS\system32\driver
Hello,
this is my final report on this problem. I am writing this final post for others should they need to find a solution. The deletions of the c:\windows\system32\driver
The only reason I found the solution to this problem was because I installed Norton Anti-Virus. Apparently, I picked up the lpad32.dll trojan much quicker than I thought I could. I have been using my Adfree program with no problems ever since NAV removed the lpad32.dll trojan. Adfree blocks an average of 270 ads each day.
Here is the NAV report:
===================
Norton
Created: Monday, August 10, 2009 6:53:31 PM
------------------------
File Name
Location
Status Size Risk Name
User Name Machine Name Domain
Date Quarantined
Submitted to Symantec
------------------
lpad32.dll
c:\windows
Q
SYSTEM Mercury351 WORKGROUP
Monday, August 10, 2009 9:52:33 AM
Not submitted
-----------------
=========
Here are 2 websites which describe the lpad32.dll trojan. The first is more relevant than the second:
http://www.prevx.co
http://ww
Because Timoros was the first person to post an anti-trojan solution, I am awarding the points to him.
Mercury351
Business Accounts
Answer for Membership
by: TimorosPosted on 2009-08-05 at 03:55:16ID: 25021941
I haven't seen that problem again .... but
You can download Spybot S&D (http://www.safer-networki
Choose Immunize and press the immunize button.
If you go to "mode" menu - choose advanced mode , you will see several settings, from there it has an option "Tools" - "IETweeks" there is an option which says "Lock hosts file..."