Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

No hosts file, but can't paste/create one.


  • This topic is locked This topic is locked
9 replies to this topic

#1 NpaMA

NpaMA

  • Members
  • 635 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Memphis, TN
  • Local time:09:15 PM

Posted 04 June 2010 - 04:16 PM

So I recently ran Malware bytes-anti malware and AVG Free on a friend's computer. They removed somewhere around 21 total infections. However, the hosts file(C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS) does not exist if you navigate there, even with "show hidden folders/files" marked. It also will not let me overwrite, change, modify, or do anything to the hosts file. Its as if it exists but is invisible/protected.

Thoughts?

I should also mention that doing this in command prompt

cd C:\Windows\System32\Drivers\Misc
del hosts

Returns not found error.

Edited by NpaMA, 04 June 2010 - 05:07 PM.


BC AdBot (Login to Remove)

 


#2 lucylane

lucylane

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:15 PM

Posted 04 June 2010 - 04:47 PM

What I do is do a search in "My Computer" search word - ETC. When I see it, I open it and that's when I see the Hosts file which I then open with notebook.

#3 marktreg

marktreg

  • Members
  • 403 posts
  • OFFLINE
  •  
  • Local time:01:15 AM

Posted 04 June 2010 - 05:22 PM

If you have ticked 'show hidden files/folders' and your hosts file is still hidden from the Windows API, then you are probably still infected.

I recommend you re-post in the 'Am I infected? What do I do?' section. They will get you to run some other scans there that will give you better information.

Edited by marktreg, 04 June 2010 - 05:43 PM.


#4 hamluis

hamluis

    Moderator


  • Moderator
  • 56,562 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:07:15 PM

Posted 04 June 2010 - 05:57 PM

<<However, the hosts file(C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS) does not exist if you navigate there, even with "show hidden folders/files" marked. It also will not let me overwrite, change, modify, or do anything to the hosts file.>>

I don't understand...how can you attempt to modify a file that you cannot see/find?

Either the file exists or you it doesn't.

Google Links On Creating, Modifying, etc.

Louis

Edited by hamluis, 04 June 2010 - 05:58 PM.


#5 sbdblyss

sbdblyss

  • Members
  • 58 posts
  • OFFLINE
  •  
  • Local time:06:15 PM

Posted 04 June 2010 - 06:03 PM

I would try the automated route suggested by Microsoft.

For Windows XP, Vista, 7:
http://support.microsoft.com/kb/972034

It will ask you to restart your computer.

Jake
My mind isn't quite sure what it has bargained for, but my heart is in time with, with the consistency of Your's.

#6 sbdblyss

sbdblyss

  • Members
  • 58 posts
  • OFFLINE
  •  
  • Local time:06:15 PM

Posted 04 June 2010 - 06:05 PM

<<However, the hosts file(C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS) does not exist if you navigate there, even with "show hidden folders/files" marked. It also will not let me overwrite, change, modify, or do anything to the hosts file.>>

I don't understand...how can you attempt to modify a file that you cannot see/find?

Either the file exists or you it doesn't.

Google Links On Creating, Modifying, etc.

Louis


I am assuming that he was referring to the command prompt. He can attempt to delete it through the command prompt, but it will not let him. He can see the file in the command prompt, but not in windows explorer....

Jake
My mind isn't quite sure what it has bargained for, but my heart is in time with, with the consistency of Your's.

#7 NpaMA

NpaMA
  • Topic Starter

  • Members
  • 635 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Memphis, TN
  • Local time:09:15 PM

Posted 04 June 2010 - 06:11 PM

<does not exist if you navigate there, even with "show hidden folders/files" marked. It also will not let me overwrite, change, modify, or do anything to the hosts file.>>

I don't understand...how can you attempt to modify a file that you cannot see/find?

Either the file exists or you it doesn't.

Google Links On Creating, Modifying, etc.

Louis


I am assuming that he was referring to the command prompt. He can attempt to delete it through the command prompt, but it will not let him. He can see the file in the command prompt, but not in windows explorer....

Jake

This.

And making/copying another(good) host file displays the overwrite warning, I select yes, and it errors with access denied. Yes the user is admin, and I have tried in safe mode.

Posted in the Am I Infected? Forum: http://www.bleepingcomputer.com/forums/t/321602/unable-to-modifydeleteoverwrite-invisible-hosts-file/

Edited by NpaMA, 04 June 2010 - 06:13 PM.


#8 sbdblyss

sbdblyss

  • Members
  • 58 posts
  • OFFLINE
  •  
  • Local time:06:15 PM

Posted 04 June 2010 - 06:23 PM

Did you try the Microsoft sollution?:

I would try the automated route suggested by Microsoft.

For Windows XP, Vista, 7:
http://support.microsoft.com/kb/972034

It will ask you to restart your computer.
My mind isn't quite sure what it has bargained for, but my heart is in time with, with the consistency of Your's.

#9 NpaMA

NpaMA
  • Topic Starter

  • Members
  • 635 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Memphis, TN
  • Local time:09:15 PM

Posted 04 June 2010 - 06:24 PM

Alright i'll try it. thanks.

#10 hamluis

hamluis

    Moderator


  • Moderator
  • 56,562 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:07:15 PM

Posted 04 June 2010 - 07:48 PM

Now that you have posted in the Am I Infected forum...you should cease to make changes or tamper with your system unless directed to do so by appropriate BC Staff personnel in that forum.

To prevent well-intentioned bad advice for dealing with malware...I am closing this thread.

In the event that you are given a clean bill of health in our malware forums and you then want to reopen this thread, just send me a PM and it can be done.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users