Hosts file keeps disappearing Win 7

WKVL · 03 Sep 2015

Hi,
This is my first post on sevenforums and hopefully not the last one

Actually my host file keeps disappearing ..... Why

Could someone give me ideas how to fix this issue.

Thanks.

UsernameIssues · 03 Sep 2015

You might want to try Process Monitor to see what app is removing the file.

There is nothing to install - just download/open the zip and copy the files somewhere.

Run Process Monitor as admin.
Stop the data collection via Ctrl-E
Open the filter via Ctrl+L

Once the list of default filters appear, add this new filter:
Path > contains > Windows\System32\drivers\etc\HOSTS
Click on Add.
Click on Apply.
"OK" your way out of the filters.

Start the data collection via Ctrl-E

WKVL · 03 Sep 2015

Hi UsernameIssues - Okay will try and report back asap. thx
-------------------------------------------------------------
Till now nothing special I think, the only one item that result in:
Date & Time: 9/3/2015 2:39:27.7894469 PM
Event Class: File System
Operation: IRP_MJ_CREATE
Result: NAME NOT FOUND
Path: C:\Windows\System32\drivers\etc\hosts.ics
TID: 5180
Duration: 0.0000264
Desired Access: Generic Read
Disposition: Open
Options: Synchronous IO Non-Alert, Non-Directory File
Attributes: N
ShareMode: Read, Write
AllocationSize: n/a

Callender · 03 Sep 2015

Suggest: Check your AV logs/ quarantine. You don't get any pop up warnings that your Hosts file has been deleted?

What is your AV?

Personally I use software to monitor such things and I get prompted to allow/ deny changes to Hosts file.

Also other software creates rules on Hosts file modification/ deletion.

WKVL · 06 Sep 2015

Hi Callender - Thanks for your suggestions.

I'm using Avast Premier 2014, checked and could not find a way to detect changes to Hosts file with avast.
So will check RegWatcher right away.

Did full scan with Avast - result issues detected.
Logs and quarantine nothing special to report.
------------------------------------------------

Few days ago I restored my Win 7 backup (about 2 months old) till now the host file is still there ......
This will tell us that there was an virus responsible for this hosts file disappearing behavior.