Results 1 to 11 of 11
  1. #1
    New Lounger
    Join Date
    Dec 2009
    Location
    Beaverton, Oregon, USA
    Posts
    7
    Thanks
    0
    Thanked 0 Times in 0 Posts
    I am trying to use the hosts file to block access to a couple of web sites. I add the lines and save the file and test it with IE8 and it blocks access to the sites just like I want.

    However later the same day or the next day, the host file no longer contains the additions that I made and IE8 can access the unwanted sites.

    It is as if something is rewriting the hosts file to contain only its original content. I have DNS Client service stopped and disabled.

    Any ideas?

  2. #2
    Super Moderator satrow's Avatar
    Join Date
    Dec 2009
    Location
    Cardiff, UK
    Posts
    4,492
    Thanks
    284
    Thanked 577 Times in 480 Posts
    Hi Stephen,

    That sounds like one of your security Apps is making the change, what have you installed in the way of security?

    You do remove the read-only attribute from the file before changing it and reset it to read-only again afterwards? Do you also have a hosts.txt file in the directory? And you have file extensions unhidden?

  3. #3
    Super Moderator
    Join Date
    Dec 2000
    Location
    Renton, Washington, USA
    Posts
    12,560
    Thanks
    0
    Thanked 4 Times in 4 Posts
    Keep a eye on the time stamp, and see if that changes.

    Now running HP Pavilion a6528p, with Win7 64 Bit OS.

  4. #4
    New Lounger
    Join Date
    Dec 2009
    Location
    Nashville, TN
    Posts
    15
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Stephen,

    Andy had some good points.

    One other question, when you notice your entries are missing do you see other entries or is it a completely blank hosts file?
    Tony Shoemaker

  5. #5
    New Lounger
    Join Date
    Dec 2009
    Location
    Beaverton, Oregon, USA
    Posts
    7
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Hi Andy, Dave and Tony,

    Thanks for the quick responses.

    I am using AVG free and Windows Firewall. I remove read-only, add my the sites I want to block, save the file and then set it to read-only. I do have file attributes unhidden and there is no hosts.txt file in the same directory.

    I just checked the file and it was changed to contain the usual text header information about the file and only the 127.0.0.1 localhost entry yesterday afternoon about 3PM.

    I appreciate everyone's help. Any other ideas?

    Thanks,

    Steve

  6. #6
    New Lounger
    Join Date
    Dec 2009
    Location
    Nashville, TN
    Posts
    15
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Steve,

    Just curious, but have you tried deleting the hosts file and recreating one?
    Tony Shoemaker

  7. #7
    Plutonium Lounger Leif's Avatar
    Join Date
    Dec 2000
    Location
    U.K.
    Posts
    14,010
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Quote Originally Posted by Stephen Marriott View Post
    I just checked the file and it was changed to contain the usual text header information about the file and only the 127.0.0.1 localhost entry yesterday afternoon about 3PM.

    I appreciate everyone's help. Any other ideas?
    Anything in your Event Viewer?

    Otherwise, Winpatrol or a free trial of ZoneAlarm Internet Security may be able to indicate what is changing it.

  8. #8
    Super Moderator satrow's Avatar
    Join Date
    Dec 2009
    Location
    Cardiff, UK
    Posts
    4,492
    Thanks
    284
    Thanked 577 Times in 480 Posts
    I've had a quick browse over at the AVG Free forum and come across a thread which may be similar (unfortunately abandoned before a result was found). A normal scenario for a security app when the hosts file has changed unexpectedly is to replace the modified file with a saved copy of the original - of course, it would normally give you some kind of warning or option but if you were AFK when this happened, it may fit the bill. Check your Resident Shield and make an exception for the hosts file or folder and test. If that does not fix it, maybe it's the potentially unwanted programs app that's behind it, much less likely but you never can tell.

    Do you have Windows Defender installed? I ask because it's often so low-profile, it's easy to forget about it.

  9. #9
    New Lounger
    Join Date
    Dec 2009
    Location
    Austin, TX
    Posts
    20
    Thanks
    0
    Thanked 1 Time in 1 Post
    Turn on Auditing via GPEDIT and then configure to audit changes to that file.

  10. #10
    New Lounger
    Join Date
    Dec 2009
    Location
    Beaverton, Oregon, USA
    Posts
    7
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Thanks to everyone for your suggestions. I decided to uninstall AVG and installed MS Security Essentials and have run a full scan. I think that MS S E found that I had changed the hosts file since it popped up with "SettingsModifier: Win/32/PossibleHostsFileHijack". Hopefully it found what has been changing the file, but the information did not identify any program that was making the change.

    I will watch the file for a while and if it changes again, I'll delet it and create a new one and try the audit.

    Thanks for all the help. I'll let you know what happens.

    Thanks,

    Steve

  11. #11
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    See if you find any help with this here.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •