No hosts file, but can't paste/create one.

So I recently ran Malware bytes-anti malware and AVG Free on a friend's computer. They removed somewhere around 21 total infections. However, the hosts file(C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS) does not exist if you navigate there, even with "show hidden folders/files" marked. It also will not let me overwrite, change, modify, or do anything to the hosts file. Its as if it exists but is invisible/protected.

Thoughts?

I should also mention that doing this in command prompt

cd C:\Windows\System32\Drivers\Misc
del hosts

Returns not found error.

Edited by NpaMA, 04 June 2010 - 05:07 PM.

What I do is do a search in "My Computer" search word - ETC. When I see it, I open it and that's when I see the Hosts file which I then open with notebook.

If you have ticked 'show hidden files/folders' and your hosts file is still hidden from the Windows API, then you are probably still infected.

I recommend you re-post in the 'Am I infected? What do I do?' section. They will get you to run some other scans there that will give you better information.

Edited by marktreg, 04 June 2010 - 05:43 PM.

<<However, the hosts file(C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS) does not exist if you navigate there, even with "show hidden folders/files" marked. It also will not let me overwrite, change, modify, or do anything to the hosts file.>>

I don't understand...how can you attempt to modify a file that you cannot see/find?

Either the file exists or you it doesn't.

Google Links On Creating, Modifying, etc.

Louis

Edited by hamluis, 04 June 2010 - 05:58 PM.

I would try the automated route suggested by Microsoft.

For Windows XP, Vista, 7:
http://support.microsoft.com/kb/972034

It will ask you to restart your computer.

Jake

<<However, the hosts file(C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS) does not exist if you navigate there, even with "show hidden folders/files" marked. It also will not let me overwrite, change, modify, or do anything to the hosts file.>>

I don't understand...how can you attempt to modify a file that you cannot see/find?

Either the file exists or you it doesn't.

Google Links On Creating, Modifying, etc.

Louis

I am assuming that he was referring to the command prompt. He can attempt to delete it through the command prompt, but it will not let him. He can see the file in the command prompt, but not in windows explorer....

Jake

<does not exist if you navigate there, even with "show hidden folders/files" marked. It also will not let me overwrite, change, modify, or do anything to the hosts file.>>

I don't understand...how can you attempt to modify a file that you cannot see/find?

Either the file exists or you it doesn't.

Google Links On Creating, Modifying, etc.

Louis

I am assuming that he was referring to the command prompt. He can attempt to delete it through the command prompt, but it will not let him. He can see the file in the command prompt, but not in windows explorer....

Jake

This.

And making/copying another(good) host file displays the overwrite warning, I select yes, and it errors with access denied. Yes the user is admin, and I have tried in safe mode.

Posted in the Am I Infected? Forum: http://www.bleepingcomputer.com/forums/t/321602/unable-to-modifydeleteoverwrite-invisible-hosts-file/

Edited by NpaMA, 04 June 2010 - 06:13 PM.

Did you try the Microsoft sollution?:

I would try the automated route suggested by Microsoft.

For Windows XP, Vista, 7:
http://support.microsoft.com/kb/972034

It will ask you to restart your computer.

Alright i'll try it. thanks.

Now that you have posted in the Am I Infected forum...you should cease to make changes or tamper with your system unless directed to do so by appropriate BC Staff personnel in that forum.

To prevent well-intentioned bad advice for dealing with malware...I am closing this thread.

In the event that you are given a clean bill of health in our malware forums and you then want to reopen this thread, just send me a PM and it can be done.

Louis