Solved

Can't Edit Hosts File on Windows XP

Posted on 2010-11-17
16
1,283 Views
Last Modified: 2012-05-10
I have a windows XP machine that has a host file that is set as a system file and is hidden.  When i go to c:\windows\system32\drivers\etc\hosts I see a ton of entries to all sorts of google and microsoft sites.  This explains why im getting so many redirects when going to google.  So i try and clear out all the entries and save it and it doesn't allow me to.

So i have tried many programs to remove the permissions but i have no luck.  Is there a way to remove the host file manually and re-create it?  
0
Comment
Question by:jmkotman
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 3
  • +4
16 Comments
 
LVL 18

Expert Comment

by:Cluskitt
ID: 34154720
That happens because you've been infected with a rootkit. You need to clean your XP and then use a tool to delete the file. I've had this happen on my sister's pc recently. I ended up using Unlocker to do it. Though you can use a live CD as well.
0
 
LVL 17

Accepted Solution

by:
houssam_ballout earned 500 total points
ID: 34154735

Try to edit in safe mode

After that scan your virus with malware & combofix:

http://www.malwarebytes.org/

http://www.bleepingcomputer.com/combofix/how-to-use-combofix
0
 

Author Comment

by:jmkotman
ID: 34154741
Ill give unlocker a try tonight and see.  I ran malwarebytes and hitman pro but they seem to thing everything is fine
0
Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 

Author Comment

by:jmkotman
ID: 34154753
I did try and edit in safe mode and still no love
0
 
LVL 17

Expert Comment

by:houssam_ballout
ID: 34154761
Try combofix

Try this unlocker:

http://ccollomb.free.fr/unlocker/
0
 
LVL 4

Expert Comment

by:Jsblanton
ID: 34154853
This could also just be because you have run spybot search and destroy which locks down the hosts file. There is a whole process for recreating it, or unlocking it to edit that I can't remember right now. But, if you have run spybot in the past this is probably what it is, and why you aren't coming up with any infections. Cheers.
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34154991
Right click it, and take ownership. Then click OK and go back into the Advanced Security Tab, and click the Top box, to inherit the permissions. Then Click OK again. Right Click the file, and deselect "Read Only"......

Now you should be able to save it.....

More than likely, all ACEs have been deleted to the file, and without them, Windows doesnt know who is allowed to access/edit the file....

0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34154995
Oh, and if this is NOT XP Pro, do this in Safe NMode, as you will not se the Security Tab in regular mode in XP Home....
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34154999
Oh, and Right Click>Security>Advanced>Owner....As the first step. Re read ity and it was incomplete above.....
0
 
LVL 30

Expert Comment

by:flubbster
ID: 34155860
Download the following batch file to your desktop and run it. This will free up the hosts file and allow you to remove it completely.
http://download.bleepingcomputer.com/bats/hosts-perm.bat

Delete the C:\Windows\System32\Drivers\etc\HOSTS file. Once it is deleted, download the following HOSTS file by right-clicking the link and select "Save Target As"
and save it in the C:\Windows\System32\Drivers\etc folder

http://download.bleepingcomputer.com/misc/host-files/windows-xp/hosts

You should be all set.

0
 
LVL 10

Expert Comment

by:GlobaLevel
ID: 34155931
you can try HijackThis...its one of the best by Trend Micro...if this doesnt fix it..take it to your local Geek Squad...at best buy
http://free.antivirus.com/hijackthis/
0
 

Author Comment

by:jmkotman
ID: 34156478
Is there a way to see the file though if its hidden.  Even if i say "view hidden files and folders" it doesn't appear.  But i know its there b/c i can navigate to it through run command
0
 
LVL 18

Expert Comment

by:Cluskitt
ID: 34156491
You have to uncheck the option "Hide system files and folders", found in the same place where you find "View hidden files and folders", a bit further down.
0
 
LVL 30

Expert Comment

by:flubbster
ID: 34156552
Beware of a rogue (fake )hosts file also. I don't think you can do anything from a permissions standpoint to get access and delete the file. According to Malwarebytes, the best way is via the instructions I posted.

Up to you.....
0
 
LVL 18

Expert Comment

by:Cluskitt
ID: 34156815
If you use unlocker, you can delete it. Unlocker will fail the delete and ask to delete it on next boot. Say yes and it will be done. You can then use one of Microsoft's FixIt to reset the hosts file.

Another easy way is to simply boot a live CD (like Ubuntu) and simply delete it from there.
0
 

Author Closing Comment

by:jmkotman
ID: 34160458
Combofix fixed the issue!
0

Featured Post

Get HTML5 Certified

Want to be a web developer? You'll need to know HTML. Prepare for HTML5 certification by enrolling in July's Course of the Month! It's free for Premium Members, Team Accounts, and Qualified Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you build your web application in Visual Studio you'll get at least a few binaries, or .DLL, files in your bin folder. However, there is more compiling to be done. Normally this would happen when an ASP.NET resource within the web site is request…
There are 2 things you must have in order to connect to the internet behind a router, The "Gateway IP" of the router, which is usually something like 192.168.xxx.1, I've seen routers with default values of: 192.168.0.1, 192.168.1.1, 192.168.11.1, …
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…
Suggested Courses

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question