Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HOSTS file lock and hidden


  • Please log in to reply
16 replies to this topic

#1 Tre Dizzle

Tre Dizzle

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:01 PM

Posted 14 October 2010 - 08:11 PM

My HOSTS file located at C:\WINDOWS\system32\drivers\etc\hosts is hiddden. It does not show up in windows explorer. If I type the path directly in the address bar of windows explorer, a program named FolderLock that I had installed opened. It had the file locked. When I unlocked the file, they immediately relocked and failed to show up in Windows Explorer. I uninstalled FolderLock and the file is still not showing up in windows explorer. I went to the address bar again and typed the file path. Now it gave me the dialog to select which program to use in opening the file. I opened the file in notepad and it has the following:


# Copyright © 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
10.254.254.253 AFS

I tried editing it and the file is read only. I tried typing C:\Documents and Settings\suttontr>attrib -r -h c:\WINDOWS\system32\drivers\etc\
hosts and got a Not resetting system file error.

I also tried using HJT to edit the file but it complains about it being read only as well.

I am running Avast and have SuperAntiSpyware and MBM installed but not actively running.

Can someone please help me resolve this issues and THANKS in advance!!

BC AdBot (Login to Remove)

 


#2 Gabrial

Gabrial

  • Members
  • 468 posts
  • OFFLINE
  •  
  • Local time:03:01 PM

Posted 14 October 2010 - 10:56 PM

In any Windows Explorer window, like My Computer, hit Alt-T and select Folder Options.

Under the view tab, select "Show hidden files and folders".

#3 Romeo29

Romeo29

    Learning To Bleep


  • BC Advisor
  • 3,165 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:03:01 PM

Posted 14 October 2010 - 11:36 PM

You should try attrib -s -h -r in the command prompt.

Edited by Romeo29, 14 October 2010 - 11:36 PM.


#4 Tre Dizzle

Tre Dizzle
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:01 PM

Posted 15 October 2010 - 10:56 AM

Thanks for you suggestions!!

1.) I already have my settings set up to show hidden files and folders.
2.) I tried using attrib -s -h -r C:\WINDOWS\system32\drivers\etc\hosts and it says access denied.

Any other suggestions? Thanks

#5 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 35,050 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:01:01 PM

Posted 15 October 2010 - 12:52 PM

Take ownership of hosts file: http://www.winxptutor.com/ownership.htm

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif




#6 Tre Dizzle

Tre Dizzle
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:01 PM

Posted 17 October 2010 - 10:50 AM

Broni, the page that you points me too requires that I be able to see the file in Explorer to be able to even right click on it. My problem is that the file does not even show up; however, I can open it so i know it's there. I just can't edit it.

Any other suggestions?

#7 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 35,050 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:01:01 PM

Posted 17 October 2010 - 11:58 AM

Download HostsXpert ( http://www.majorgeeks.com/Hoster_d4626.html ) and then follow the steps below:

* Unzip HostsXpert.zip
* It will create a folder named HostsXpert in whatever folder you extract it to.
* Run HostsXpert.exe by double clicking on it (Vista and Windows 7 users, right click and click "Run As Administrator").
* click Restore MS Hosts File and then click OK.
* Click the X to exit the program

Restart computer.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif




#8 Tre Dizzle

Tre Dizzle
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:01 PM

Posted 17 October 2010 - 01:35 PM

Broni, I ran the program you suggested and it errors with the following messages:

Your HOSTS file is marked as a "system file" and can NOT be manipulated. Press OK to remove the system file attribute, Cancel to Quit.

***HostXpert will NOT reset these attributes.***


I pressed OK and got the following:

Your HOSTS file is marked as a "Hidden file" and can NOT be manipulated. Press OK to remove the hidden file attribute, CANCEL to Quit.

***HostsXpert will NOT reset these attributes.***

Again, I pressed OK.

#9 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 35,050 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:01:01 PM

Posted 17 October 2010 - 01:39 PM

Did you run it as Administrator?

If so, I suspect, you may have some "baddies" on your computer, which prevent accessing "hosts" file.
I suggest, you start new topic in "Am I Infected?" forum.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif




#10 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:08:01 PM

Posted 17 October 2010 - 01:55 PM

Have you ran the Microsoft fix it tool for your HOSTS file?

Edited by cryptodan, 17 October 2010 - 01:56 PM.


#11 Gabrial

Gabrial

  • Members
  • 468 posts
  • OFFLINE
  •  
  • Local time:03:01 PM

Posted 17 October 2010 - 01:58 PM

From a command prompt with administrative access type each of the following commands:

CACLS.EXE C:\WINDOWS\system32\drivers\etc\hosts /G BUILTIN\Users:R
CACLS.EXE C:\WINDOWS\system32\drivers\etc\hosts /E /G "BUILTIN\Power Users:R"
CACLS.EXE C:\WINDOWS\system32\drivers\etc\hosts /E /G BUILTIN\Administrators:F
CACLS.EXE C:\WINDOWS\system32\drivers\etc\hosts /E /G "NT AUTHORITY\SYSTEM:F"
ATTRIB.EXE -S -H +A -R C:\WINDOWS\system32\drivers\etc\hosts

If this doesn't resolve the issue you will need a better program to do it. Download SubInACL from Microsoft. You can work up the syntax for taking ownership or I'll do it if you can't figure it out.

It should be something like:

SubInACL.EXE /file C:\WINDOWS\system32\drivers\etc\hosts /setowner=%USERDOMAIN%\%USERNAME%

then rerun the commands above.

Edited by Gabrial, 17 October 2010 - 02:04 PM.


#12 Tre Dizzle

Tre Dizzle
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:01 PM

Posted 20 October 2010 - 09:58 PM

Gabrial that worked!!! Thanks a lot for you help and thanks everybody for your suggestions

From a command prompt with administrative access type each of the following commands:

CACLS.EXE C:\WINDOWS\system32\drivers\etc\hosts /G BUILTIN\Users:R
CACLS.EXE C:\WINDOWS\system32\drivers\etc\hosts /E /G "BUILTIN\Power Users:R"
CACLS.EXE C:\WINDOWS\system32\drivers\etc\hosts /E /G BUILTIN\Administrators:F
CACLS.EXE C:\WINDOWS\system32\drivers\etc\hosts /E /G "NT AUTHORITY\SYSTEM:F"
ATTRIB.EXE -S -H +A -R C:\WINDOWS\system32\drivers\etc\hosts

If this doesn't resolve the issue you will need a better program to do it. Download <a href="http://www.microsoft.com/downloads/en/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b" target="_blank" rel="nofollow">SubInACL</a> from Microsoft. You can work up the syntax for taking ownership or I'll do it if you can't figure it out.

It should be something like:

SubInACL.EXE /file C:\WINDOWS\system32\drivers\etc\hosts /setowner=%USERDOMAIN%\%USERNAME%

then rerun the commands above.



#13 3KData

3KData

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:01 PM

Posted 21 October 2010 - 02:28 PM

this worked for me too, thanks for the help

#14 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:04:01 PM

Posted 21 October 2010 - 03:46 PM

Spybot's option to lock the Hosts file?

1. Click "Mode", selecting "Advanced Mode".
2. Click "Tools" in the left pane.
3. Click "IE tweaks" in the right pane.
4. Check "Lock Hosts file read-only as protection against hijackers".

Note that even with this tip it is still possible for some spyware and adware to unlock the hosts file for modification.


With a little help from TeaTimer?

Edited by DaChew, 21 October 2010 - 03:47 PM.

Chewy

No. Try not. Do... or do not. There is no try.

#15 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:08:01 PM

Posted 21 October 2010 - 05:32 PM

With a little help from TeaTimer?


Depending on the system TeaTimer can be quite the resource hog.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users