Solved

Can't Edit Hosts File on Windows XP

Posted on 2010-11-17
16
1,251 Views
Last Modified: 2012-05-10
I have a windows XP machine that has a host file that is set as a system file and is hidden.  When i go to c:\windows\system32\drivers\etc\hosts I see a ton of entries to all sorts of google and microsoft sites.  This explains why im getting so many redirects when going to google.  So i try and clear out all the entries and save it and it doesn't allow me to.

So i have tried many programs to remove the permissions but i have no luck.  Is there a way to remove the host file manually and re-create it?  
0
Comment
Question by:jmkotman
  • 4
  • 3
  • 3
  • +4
16 Comments
 
LVL 18

Expert Comment

by:Cluskitt
ID: 34154720
That happens because you've been infected with a rootkit. You need to clean your XP and then use a tool to delete the file. I've had this happen on my sister's pc recently. I ended up using Unlocker to do it. Though you can use a live CD as well.
0
 
LVL 17

Accepted Solution

by:
houssam_ballout earned 500 total points
ID: 34154735

Try to edit in safe mode

After that scan your virus with malware & combofix:

http://www.malwarebytes.org/

http://www.bleepingcomputer.com/combofix/how-to-use-combofix
0
 

Author Comment

by:jmkotman
ID: 34154741
Ill give unlocker a try tonight and see.  I ran malwarebytes and hitman pro but they seem to thing everything is fine
0
 

Author Comment

by:jmkotman
ID: 34154753
I did try and edit in safe mode and still no love
0
 
LVL 17

Expert Comment

by:houssam_ballout
ID: 34154761
Try combofix

Try this unlocker:

http://ccollomb.free.fr/unlocker/
0
 
LVL 4

Expert Comment

by:Jsblanton
ID: 34154853
This could also just be because you have run spybot search and destroy which locks down the hosts file. There is a whole process for recreating it, or unlocking it to edit that I can't remember right now. But, if you have run spybot in the past this is probably what it is, and why you aren't coming up with any infections. Cheers.
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34154991
Right click it, and take ownership. Then click OK and go back into the Advanced Security Tab, and click the Top box, to inherit the permissions. Then Click OK again. Right Click the file, and deselect "Read Only"......

Now you should be able to save it.....

More than likely, all ACEs have been deleted to the file, and without them, Windows doesnt know who is allowed to access/edit the file....

0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34154995
Oh, and if this is NOT XP Pro, do this in Safe NMode, as you will not se the Security Tab in regular mode in XP Home....
0
Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

 
LVL 66

Expert Comment

by:johnb6767
ID: 34154999
Oh, and Right Click>Security>Advanced>Owner....As the first step. Re read ity and it was incomplete above.....
0
 
LVL 30

Expert Comment

by:flubbster
ID: 34155860
Download the following batch file to your desktop and run it. This will free up the hosts file and allow you to remove it completely.
http://download.bleepingcomputer.com/bats/hosts-perm.bat

Delete the C:\Windows\System32\Drivers\etc\HOSTS file. Once it is deleted, download the following HOSTS file by right-clicking the link and select "Save Target As"
and save it in the C:\Windows\System32\Drivers\etc folder

http://download.bleepingcomputer.com/misc/host-files/windows-xp/hosts

You should be all set.

0
 
LVL 10

Expert Comment

by:GlobaLevel
ID: 34155931
you can try HijackThis...its one of the best by Trend Micro...if this doesnt fix it..take it to your local Geek Squad...at best buy
http://free.antivirus.com/hijackthis/
0
 

Author Comment

by:jmkotman
ID: 34156478
Is there a way to see the file though if its hidden.  Even if i say "view hidden files and folders" it doesn't appear.  But i know its there b/c i can navigate to it through run command
0
 
LVL 18

Expert Comment

by:Cluskitt
ID: 34156491
You have to uncheck the option "Hide system files and folders", found in the same place where you find "View hidden files and folders", a bit further down.
0
 
LVL 30

Expert Comment

by:flubbster
ID: 34156552
Beware of a rogue (fake )hosts file also. I don't think you can do anything from a permissions standpoint to get access and delete the file. According to Malwarebytes, the best way is via the instructions I posted.

Up to you.....
0
 
LVL 18

Expert Comment

by:Cluskitt
ID: 34156815
If you use unlocker, you can delete it. Unlocker will fail the delete and ask to delete it on next boot. Say yes and it will be done. You can then use one of Microsoft's FixIt to reset the hosts file.

Another easy way is to simply boot a live CD (like Ubuntu) and simply delete it from there.
0
 

Author Closing Comment

by:jmkotman
ID: 34160458
Combofix fixed the issue!
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Tasks remote computer 12 148
window s 8 to 10 err 9 115
Computer software inventory 5 73
MS-Access 2002 error (Win XP on Win7Pro) 19 28
If you build your web application in Visual Studio you'll get at least a few binaries, or .DLL, files in your bin folder. However, there is more compiling to be done. Normally this would happen when an ASP.NET resource within the web site is request…
cPanel is a Unix based web hosting control panel that provides a graphical interface and automation tools designed to simplify the process of hosting a web site. cPanel utilizes a 3 tier structure that provides functionality for administrators, rese…
Delivering innovative fully-managed cloud services for mission-critical applications requires expertise in multiple areas plus vision and commitment. Meet a few of the people behind the quality services of Concerto.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now