Solved Hosts file keeps disappearing Win 7

WKVL

New member
Local time
12:55 AM
Messages
3
Location
The Netherlands, Zandvoort
Hi,
This is my first post on sevenforums and hopefully not the last one :sarc:

Actually my host file keeps disappearing ..... Why :rolleyes:
Could someone give me ideas how to fix this issue.

Thanks.
 

My Computer My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Professional 64-bit
You might want to try Process Monitor to see what app is removing the file.

There is nothing to install - just download/open the zip and copy the files somewhere.

Run Process Monitor as admin.
Stop the data collection via Ctrl-E
Open the filter via Ctrl+L

Once the list of default filters appear, add this new filter:
Path > contains > Windows\System32\drivers\etc\HOSTS
Click on Add.
Click on Apply.
"OK" your way out of the filters.

Start the data collection via Ctrl-E
 

My Computer My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
Employer provided Dell Latitude
OS
W7 Pro SP1 64bit
CPU
i7
Memory
8GB
Graphics Card(s)
Intel HD Graphics
Hard Drives
crappy SSD
Antivirus
Employer mandated Symantec Endpoint Protection
Browser
Pale Moon 64bit, IE11 64bit & Chrome 64bit
Hi UsernameIssues - Okay will try and report back asap. thx
-------------------------------------------------------------
Till now nothing special I think, the only one item that result in:
Date & Time: 9/3/2015 2:39:27.7894469 PM
Event Class: File System
Operation: IRP_MJ_CREATE
Result: NAME NOT FOUND
Path: C:\Windows\System32\drivers\etc\hosts.ics
TID: 5180
Duration: 0.0000264
Desired Access: Generic Read
Disposition: Open
Options: Synchronous IO Non-Alert, Non-Directory File
Attributes: N
ShareMode: Read, Write
AllocationSize: n/a
 
Last edited:

My Computer My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Professional 64-bit
Suggest: Check your AV logs/ quarantine. You don't get any pop up warnings that your Hosts file has been deleted?

What is your AV?

Personally I use software to monitor such things and I get prompted to allow/ deny changes to Hosts file.

355942d1428851916-windows-7-host-file-contents-auto-deleted-regwatcher.jpg

Also other software creates rules on Hosts file modification/ deletion.

356226d1429040664-windows-7-host-file-contents-auto-deleted-hosts-2.jpg

356228d1429040696-windows-7-host-file-contents-auto-deleted-hosts-4.jpg

356229d1429040696-windows-7-host-file-contents-auto-deleted-hosts-5.jpg

356230d1429040696-windows-7-host-file-contents-auto-deleted-hosts-6.jpg

356231d1429040696-windows-7-host-file-contents-auto-deleted-hosts-7.jpg

356232d1429040696-windows-7-host-file-contents-auto-deleted-hosts-8.jpg
 

My Computer My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
ASUS
OS
Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
CPU
AMD C-60 APU with Radeon(tm) HD Graphics
Motherboard
ASUSTeK COMPUTER INC. X501U
Memory
4.00 GB
Graphics Card(s)
AMD Radeon HD 6290 Graphics
Sound Card
(1) AMD High Definition Audio Device (2) Realtek High Defi
Screen Resolution
1366 x 768 x 32 bits (4294967296 colors) @ 60 Hz
Hard Drives
Hitachi HTS545050A7E380 SATA Disk Device
Antivirus
Comodo CIS & FW, SecureAplus App Whitelisting, Threatfire
Browser
Cyberfox 64bit, Opera 64bit, Airfox
Other Info
Spy-The-Spy, HitmanPro.Alert, Norton Connect Safe, MJRegWatcher, BitDefender TrafficLight, Voodoo Shield, Zemana AntiMalware
Hi Callender - Thanks for your suggestions.

I'm using Avast Premier 2014, checked and could not find a way to detect changes to Hosts file with avast.
So will check RegWatcher right away.

Did full scan with Avast - result issues detected.
Logs and quarantine nothing special to report.
------------------------------------------------

Few days ago I restored my Win 7 backup (about 2 months old) till now the host file is still there ......
This will tell us that there was an virus responsible for this hosts file disappearing behavior.
 

My Computer My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Professional 64-bit
Back
Top