windows 7 host file contents auto deleted!

gabe22 · 08 Apr 2015

My system is Dell Studio XPS L502 i7, its about 3years old

Just now .. I noticed contents of windows host file is somehow auto removed, they were there like 5minutes ago and then .. its empty, other than the localhost .. also the default hosts page texts from Microsoft isn't there.

How/why did this happen? Should I be concerned?

On a 2nd note within last 48hours, I just installed only 1 software, its this MMO: http://playragnarok2.com/ , and this happened right after installing this game, could this be related somehow?

comptech · 09 Apr 2015

reset the Hosts file back to the default
Hope this helps!!!!!!!

LMiller7 · 09 Apr 2015

Nothing in Windows ever modifies the hosts file. However you may have third party software (or malware) that does.

gabe22 · 09 Apr 2015

Ya from what II knew nothing should do that ... as for installations ...

On a 2nd note within last 48hours, I just installed only 1 software, its this MMO: http://playragnarok2.com/ , and this happened right after installing this game, could this be related somehow?

Could this be it?

badcrc · 10 Apr 2015

I'm a bit puzzled why the OP is checking the hosts file every 5 minutes. AFAIK the hosts file is a pre-DNS throwback, used to point a url (eg bbc.co.uk) to the correct numerical IP (eg 212.58.244.20). Thanks to DNS servers, this is no longer required, so hosts only has 3 uses nowadays -

1 - malware can hijack hosts to point a legit url (eg my bank) to a fake phishing site that looks like my bank
2 - some folk copy n paste a long list of dodgy sites that points them all to 127.0.0.1 so the problem sites are never accessed (these lists are available online and block pr0n etc)
3 - nefarious, piracy related activity (I won't go into details)

I'd say if the OP's host file just contains a bit of '# commented out' MS guff eg

# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

and no actual IP resolutions, eg

38.25.63.10 mybank.co.uk

he's good to go.

gabe22 · 10 Apr 2015

Thank you guys but still II'm trying to figure out what caused this and remove that junk if I can find it, any help?

Callender · 10 Apr 2015

Did you run a scan with any security software? Some security software might detect a modified HOSTS file and delete it although not usually without notification. I suppose it's possible that the installer for the game you downloaded reset your HOSTS file to ensure connectivity but it sounds unlikely.

carwiz · 10 Apr 2015

What's the date of the hosts file? That will tell you when it was last changed. If Modified Date corresponds with your newly installed software, there's a good chance it loaded something your weren't expecting.

gabe22 · 11 Apr 2015

Its the same date and almost the same time, first I installed the game (note: i was DL'ing the game for the last 36hours straight) ... didn't install or do anything on the system in this time) and then as it was causing isssues I reinstalled it just one more time .. then I removed the game as it kept failing on patch.
Next thing I know all the redirects I had on hosts file ... weren't there, and it was clean .. not even default texts that comes with windows was there, just local host was defined here, thats about it.

Ofcourse I added back all stuff I lost however I'm just trying to figure out what caused this, if its the game well ... its removed so I suppose we can blacklist it and move on ... but I wanna be certain as if its something else .. this will happen again and I don't get caught with hands behind my back.

Any help is much appreciated guys!

carwiz · 12 Apr 2015

I would certainly be running some malware scans. Typically, the host file is accessible only by the Admin account. But that's not all that's in the ETC folder. There's a service port index in there too so perhaps the game install is messing with backdoor properties. There's just no getting around the old saying; "You get what you pay for".