Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: When edit hosts file, it will reload with the default value.

17 Feb 2016   #1
anantodn

Win 7 Proffesional 32bit
 
 
When edit hosts file, it will reload with the default value.

Hi All,
When I edited the file hosts in the etc folder, its saved successfully, but after 10 seconds, it will revert to default value.
Any additional value will be removed.
I already tried make it read-only, change owner, disable AV, disable Windows Firewall, disable UAC.
any help will be appreciated.

Thank you,


My System SpecsSystem Spec
.
17 Feb 2016   #2
UsernameIssues

W7 Pro SP1 64bit
 
 

What antivirus (AV) app do you have? Disabling your AV app might not disable every component of the AV app. Don't disable the firewall. It has nothing to do with the HOSTS file. Turn your UAC to the highest level and leave it there.



Process Monitor might* be able to show you which app is acting on the HOSTS file.

When you first open Process Monitor, you should see the EULA.

After agreeing to that, Process Monitor should start collecting data.

Press CTRL+E to stop the data collection.

Press CTRL+X to clear the data.

Press CTRL+L to open the filter window.

Set up a filter like this:

When edit hosts file, it will reload with the default value.-filter.png

After applying that filter and close the filter window via OK.

Click on each of the three icon/buttons shown in the screenshot above to filter out registry/network/process stuff. You only want to see what is happening to a file.

Press CTRL+E to start the data collection.


Make your change to the HOSTS file via notepad (or whatever). Process Monitor should show you entries related to that change. Keep an eye on Process Monitor to see what app is changing it back.


*Some AV apps might prevent Process Monitor from seeing actions taken by some components of the AV app.


My System SpecsSystem Spec
17 Feb 2016   #3
anantodn

Win 7 Proffesional 32bit
 
 

Hi UsernameIssues,

Thank you for the prompt response.

I will try it first and will back again once its resolved.

Thank you,
My System SpecsSystem Spec
.

17 Feb 2016   #4
anantodn

Win 7 Proffesional 32bit
 
 

Quote   Quote: Originally Posted by UsernameIssues View Post
What antivirus (AV) app do you have? Disabling your AV app might not disable every component of the AV app. Don't disable the firewall. It has nothing to do with the HOSTS file. Turn your UAC to the highest level and leave it there.



Process Monitor might* be able to show you which app is acting on the HOSTS file.

When you first open Process Monitor, you should see the EULA.

After agreeing to that, Process Monitor should start collecting data.

Press CTRL+E to stop the data collection.

Press CTRL+X to clear the data.

Press CTRL+L to open the filter window.

Set up a filter like this:

Attachment 381977

After applying that filter and close the filter window via OK.

Click on each of the three icon/buttons shown in the screenshot above to filter out registry/network/process stuff. You only want to see what is happening to a file.

Press CTRL+E to start the data collection.


Make your change to the HOSTS file via notepad (or whatever). Process Monitor should show you entries related to that change. Keep an eye on Process Monitor to see what app is changing it back.


*Some AV apps might prevent Process Monitor from seeing actions taken by some components of the AV app.
Hi UsernameIssues,

here is the screenshot with the process monitor

Any advise?

Thank you,


Attached Thumbnails
When edit hosts file, it will reload with the default value.-3-2-.png  
My System SpecsSystem Spec
17 Feb 2016   #5
UsernameIssues

W7 Pro SP1 64bit
 
 

I'm not sure when the change was made or by what app.

One thing that might help is to not have Explorer viewing the folder (maybe it wasn't).

I tested using notepad on my HOSTS file and only two processes showed in Process Monitor: notepad and my AV.


Try this:
Close Windows Explorer.
(Don't kill the explorer process. Just close the windows.)
Right click on a shortcut to notepad and select run as admin.
Use the File > Open dialog box from within notepad to open the HOSTS file.
Make a change, but do not save.
Clear the data in Process Monitor.
Start the data collection in Process Monitor.
Close notepad - saving the file when prompted.
Watch Process Monitor to see if any app acts on the HOSTS file.


What AV are you using? (I asked earlier :-)

Is the UAC turned on now?

I'm not sure what that hnsu243.tmp process is in your screenshot. Some AV tools use tmp files like that... as do infections.
My System SpecsSystem Spec
17 Feb 2016   #6
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 

Also I notice that your HOSTS file has an ads stream attached. Did you download a HOSTS file from the internet and replace the original? If so, try removing the zone identifier.
My System SpecsSystem Spec
17 Feb 2016   #7
UsernameIssues

W7 Pro SP1 64bit
 
 

Quote   Quote: Originally Posted by Callender View Post
Also I notice that your HOSTS file has an ads stream attached. Did you download a HOSTS file from the internet and replace the original? If so, try removing the zone identifier.
Is this what you are talking about:
When edit hosts file, it will reload with the default value.-zi.png


My System SpecsSystem Spec
17 Feb 2016   #8
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 

Yes it is but now I'm thinking that it's just a zone identifier check rather than an attached ads stream.
My System SpecsSystem Spec
17 Feb 2016   #9
UsernameIssues

W7 Pro SP1 64bit
 
 

Agreed. That is just a check and no zone identifiers were found :-)
My System SpecsSystem Spec
22 Feb 2016   #10
anantodn

Win 7 Proffesional 32bit
 
 

Hi UsernameIssues and Callender,

Thanks for your time on when reply this issue.
This is just odd, the issue is resolved itself.
Not sure what kind of apps that make this issue happened before.

Thank you,
My System SpecsSystem Spec
Reply

 When edit hosts file, it will reload with the default value.




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Problem modifying hosts file, change file permissions?
Hi all,win7 Home Premium 64 bit. I'm having difficulties modifying my hosts file. Following guidance from this forum, I open Notepad++ as administrator & can navigate to and open the hosts file. But the "Save" option is greyed out, so I can't save directly to the original location. I can Save As...
General Discussion
Hosts file ignored and replaced with hosts.original
Hello. I am trying to use the hosts file. However both pings and web addresses still bypass the hosts file. I noticed that there is another file in the C:\Windows\System32\drivers\etc directory called 'hosts.original'. When ever I delete this file, it reappears seconds later. I have made sure that...
General Discussion
Hosts File
Hey, I was wondering, is there any internet performance gain if you put a commonly used website's IP (like Google) in your Hosts file, so it doesn't need to ask a DNS server? I mean, because I have 30 websites I go on at least 10 times each day, and it lags when I open all of them :D Thanks!
General Discussion
How to edit the Hosts file in 7
Hi people :) I need help here, I have some older applications that wont work unless i change their 'update ip', (dont know what its called), in the hosts file. I have found numerous ideas on how to edit in the hosts file, but none of them has worked so far. When I run Notepad as...
Network & Sharing
HOSTS File - Create a "Edit HOSTS file" Shortcut
How to Create a "Edit HOSTS file" Shortcut in Windows 7 and Vista The HOSTS file is a .txt file used in Vista and Windows 7 to map hostnames to IP addresses. Your computer checks this file first to resolve any network names to its corresponding IP address before it tries to check the Internet....
Tutorials


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 07:35.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App