Solved Hosts file keeps disappearing Win 7

[WKVL]

Hi,
This is my first post on sevenforums and hopefully not the last one :sarc:

Actually my host file keeps disappearing ..... Why
Could someone give me ideas how to fix this issue.

Thanks.

 

[UsernameIssues]

You might want to try Process Monitor to see what app is removing the file.

There is nothing to install - just download/open the zip and copy the files somewhere.

Run Process Monitor as admin.
Stop the data collection via Ctrl-E
Open the filter via Ctrl+L

Once the list of default filters appear, add this new filter:
Path > contains > Windows\System32\drivers\etc\HOSTS
Click on Add.
Click on Apply.
"OK" your way out of the filters.

Start the data collection via Ctrl-E

 

[WKVL]

Hi UsernameIssues - Okay will try and report back asap. thx
-------------------------------------------------------------
Till now nothing special I think, the only one item that result in:
Date & Time: 9/3/2015 2:39:27.7894469 PM
Event Class: File System
Operation: IRP_MJ_CREATE
Result: NAME NOT FOUND
Path: C:\Windows\System32\drivers\etc\hosts.ics
TID: 5180
Duration: 0.0000264
Desired Access: Generic Read
Disposition: Open
Options: Synchronous IO Non-Alert, Non-Directory File
Attributes: N
ShareMode: Read, Write
AllocationSize: n/a

 

[Callender]

Suggest: Check your AV logs/ quarantine. You don't get any pop up warnings that your Hosts file has been deleted?

What is your AV?

Personally I use software to monitor such things and I get prompted to allow/ deny changes to Hosts file.

Also other software creates rules on Hosts file modification/ deletion.

 

[WKVL]

Hi Callender - Thanks for your suggestions.

I'm using Avast Premier 2014, checked and could not find a way to detect changes to Hosts file with avast.
So will check RegWatcher right away.

Did full scan with Avast - result issues detected.
Logs and quarantine nothing special to report.
------------------------------------------------

Few days ago I restored my Win 7 backup (about 2 months old) till now the host file is still there ......
This will tell us that there was an virus responsible for this hosts file disappearing behavior.