Why is there no hosts file? Original hosts for Windows operating systems

Home / Mobile devices

The hosts file is a rather vulnerable place in the Windows operating system. This file becomes the number one target for almost all viruses and Trojans that manage to infect a computer.
Task this file store a list of domains and their corresponding IP addresses. The operating system uses this list to convert domains to IP addresses and vice versa.

Every time you enter the address of the site you need into the address bar of your browser, a request is made to convert the domain to an IP address. Currently, this translation is performed by a service called DNS. But, at the dawn of the development of the Internet, the hosts file was the only way to associate a symbolic name (domain) with a specific IP address.
Even now, this file has a direct impact on the transformation of symbolic names. If you add an entry to the hosts file that will associate the IP address with the domain, then such an entry will work perfectly. This is exactly what the developers of viruses, Trojans and other malware.

As for the file structure, the hosts file is normal text file no extension. That is, this file is not called hosts.txt, but simply hosts. To edit it, you can use the regular text editor Notepad.

The standard hosts file consists of several lines that begin with the “#” character. Such lines are not taken into account by the operating system and are simply comments.

Also in standard file hosts there is an entry “127.0.0.1 localhost”. This entry means that when you access the localhost symbolic name, you will be accessing your own computer.

Fraud with the hosts file

There are two classic ways to benefit from making changes to the hosts file. Firstly, you can use it to block access to sites and servers antivirus programs.

For example, having infected a computer, the virus addsin the hosts file the following entry: “127.0.0.1 kaspersky.com”. When you try to open the kaspersky.com website, the operating system will connect to the IP address 127.0.0.1. Naturally, this is an incorrect IP address. This leads to the fact that Access to this site is completely blocked.As a result, the user of the infected computer cannot download antivirus or antivirus database updates.

In addition, virus developers can use another technique. By adding entries to the hosts file, they can redirect users to a fake site.


For example, having infected a computer, the virus adds the following entry to the hosts file: “90.80.70.60 vkontakte.ru.” Where “90.80.70.60” is the IP address of the attacker’s server. As a result, when trying to access a well-known site, the user ends up on a site that looks exactly the same, but is located on someone else’s server. As a result of such actions, scammers can obtain user logins, passwords and other personal information.


So, in case of any suspicion of virus infection or site substitution, the first thing you need to do is check the HOSTS file.

The malware disguises modification of the hosts file as follows:

To make it difficult to detect lines added by a virus, they are written to the end of the file

After a large empty area formed as a result of repeated line feeds;

After this, the original hosts file is assigned the Hidden attribute (by default hidden files and the folders are not visible);

A false hosts file is created, which, unlike the real hosts file (which has no extension), has the extension .txt (by default, extensions are not displayed for registered file types):

Where is the hosts file located?

Depending on the operating system version Windows file hosts can be located in different folders. For example, if you use Windows XP, Windows Vista, Windows 7 or Windows 8, then the file is located in the folderWINDOWS\system32\drivers\etc\


IN operating systems ah Windows NT and Windows 2000 this file is in the folder WINNT\system32\drivers\etc\


Editing the hosts file

You can edit the file hosts and in Notepad, delete unnecessary lines, or add your own.
In order to edit the hosts file, you need to launch Notepad in Administrator mode, and then open the file C:\Windows\System32\drivers\etc\hosts in it.

How to clean the hosts file

So, point by point.

Click "Start".

Choose "All programs".

Then select the item "Standard".

On "Notepad" click right click the mouse and select the item "Run as administrator."

In the notepad window that opens, select the File menu, then "Open..."

In the window that opens, select “Computer” on the left side of the window.

Then open the disk WITH:.

Windows directory.

System32 directory.

Drivers directory.

Catalog etc.

When you open the etc directory, you will see an empty directory. In the lower right corner of the window, select "All files".

Select the hosts file and click the button "Open".

Check for the necessary content: at the beginning there are explanatory comments from Microsoft about what this file is and how to use it. Then there are several examples of how to enter various commands. All this is just plain text and does not carry any functions! We skip it and reach the end. Next should come the teams themselves. Unlike comments (i.e. plain text) they must begin not from the "#" sign, and from specific numbers, indicating the IP address.

Any commands in your hosts file after the following lines can be malicious:

  • On Windows XP: 127.0.0.1 localhost
  • On Windows Vista: ::1 localhost
  • On Windows 7/8: # ::1 localhost

As you can see, host files are slightly different in different operating systems.

In order not to clean up anything unnecessary, you need to know how the commands are deciphered. There is nothing complicated here. At the beginning of each command there is digital ip address, then (separated by a space) the letter associated with it domain name , and after it there may be a small comment after the "#" sign.

Remember! All commands starting from numbers 127.0.0.1(except, 127.0.0.1 localhos t) block access to various sites and Internet services. Which ones exactly, look in the next column following these numbers.
Teams having at the beginning any other numbers ip addresses, redirect(redirect) to fraudulent sites instead of official ones. Which sites have been replaced with fraudulent ones, also look in each column following these numbers.
Thus, it will not be difficult to guess which commands in your hosts file are malicious! If something is still not clear, look at the screenshot below.

Please keep this point in mind. Many virus commands can be hidden far at the very bottom of the file by cunning Internet attackers, so take the time to scroll the slider all the way down!

After you do the cleanup, don't forget to save all changes ( "File" --> "Save"). If you opened the hosts file from the Notepad program itself, when saving changes, in the column "File type" be sure to select an option "All files", otherwise notepad, instead of saving in the hosts file, will only make it text copy of hosts.txt, which is not a system file and does not perform any functions!

After a successful save, do not forget to restart your computer.


How to block sites in hosts

So, the hosts file is already open and you see that it is built in the form of a regular text document.

At the beginning you will see comments (plain text that does not provide any functionality) starting with the symbol "#" . They may be followed by some functional commands prescribed by the system.

But we don't need them. We skip them and get to the very end of the document. Let's make a retreat. And now, here, we can already write the commands we need!

When finished working with the file, open the File menu, select "Save".


To understand how to correctly enter commands for blocking web resources, you need to know that each PC has its own so-called. loopback address, which sends any request back to itself. For any computers running Windows systems, Linux or Mac this address is always the same - 127.0.0.1 . Now, with the help of just this IP address, you can block any request to an unwanted site so that it is sent not to the requested resource, but to brotherly to the local computer.

This command in hosts is written as follows: " 127.0.0.1 domain name to block "Here are real examples: 127.0.0.1 mega-porno.ru, 127.0.0.1 odnoklassniki.ru, 127.0.0.1 vk.com etc.

That's it. Now access to all unwanted sites is securely blocked. The main thing is to resave the hosts file after making changes! Detailed instructions see above.

Restoring the hosts file after a virus infection

As already mentioned, today large number malware is using the file hosts to block access to websites of popular portals or social networks. Often, instead of blocking sites, malware redirects the user to pages that look similar to popular resources (social networks, email services, etc.), where an inattentive user enters credentials, which thus get to the attackers.
If the file contains entries like 127.0.0.1 odnoklassniki.ru 127.0.0.1 vkontakte.ru or the addresses of your sites that you cannot access, then first check your computer for “malware”, and then restore the file hosts

Many users who have been hacked are interested in where they can download the hosts file. However, there is no need to search for and download the original hosts file. You can fix it yourself; to do this, you need to open it with a text editor and delete everything except the line except “127.0.0.1 localhost”. This will allow you to unblock access to all sites and update your antivirus.

Let's take a closer look at the process of restoring the hosts file:

1. Open the folder in which this file is located. In order not to wander through directories for a long time in search of the desired folder, you can use a little trick. Press the key combination Windows+R to open the menu "Run". In the window that opens, enter the command "%systemroot%\system32\drivers\etc"and click OK.

2. After this, a folder will open in front of you in which the hosts file is located.

3. Next you need to do backup copy current file. In case something goes wrong. If the hosts file exists, then simply rename it to hosts.old. If the hosts file is not in this folder at all, then you can skip this item.


4.Create a new one empty file hosts. To do this, click right click mouse in the etc folder and select"Create text document»

5. When the file is created, it must be renamed to hosts. When renaming, a window will appear with a warning that the file will be saved without an extension. Close the warning window by clicking OK.

6. Once the new hosts file has been created, it can be edited. To do this, open the file using Notepad.

7. Depending on the version of the operating system, the contents of the standard hosts file may differ.

This is what all, without exception, “clean” hosts files should look like.

Pay attention!

  • For Windows XP and Windows Server 2003 needs to be added "127.0.0.1 localhost"
  • Windows Vista, Windows Server 2008, Windows 7 and Windows 8 you need to add two lines: "127.0.0.1 localhost" and "::1 localhost"

If you ever find missing or, conversely, unnecessary entries in such a file, it is better to delete them quickly. Especially if they were not made by you or without your consent. Most likely, this is the result of viruses!

Restoring the default hosts file in Windows 7: Copy the text below into a file.

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host # localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

Save and close the file.

Hello friends!
In some situations it is necessary to change or restore the hosts file.

In this article I will tell you what it is intended for and how to edit it correctly. I will give an example of how using the hosts file you can speed up, redirect or block access to certain sites.

The hosts file is a special system text file that is responsible for converting symbolic domain names into their corresponding IP addresses and vice versa. In addition to the usual address, an Internet site also has an IP address.

For example, social network Odnoklassniki has an address like www.ok.ru and IP address 217.20.147.94. By the way, you can enter these numbers into the address bar of your browser and go, but you will be redirected to www.ok.ru.

It should be noted that similar domain addresses(www.ok.ru and others) were invented solely for the sake of convenience. Agree, it is much easier to remember the symbolic name (domain) ok.ru than its IP address 217.20.147.94.

However, the server (dedicated computer) on which the ok.ru website is located does not accept such symbolic treatment. To convert a host name to an IP address, the hosts file and a special domain name system (abbreviated as DNS) are used. Moreover, the hosts file has priority over DNS.

When you enter an address, the first thing it does is look at your hosts file, and only then contact the DNS server. Unlike DNS, the hosts file can be edited directly.

I believe that you now understand the importance of the hosts file and understand why most malware seeks to gain access to it.

Using the hosts file

By managing the hosts file, you can speed up access to certain sites or, conversely, limit access to them. You can organize redirection from some pages to other sites. For example, when accessing some prohibited resources, you will be redirected to the website of the Ministry of Internal Affairs.

But the greatest danger comes from malicious software, which, having gained access to the hosts file, will use it for its own malicious purposes. For example, block access to websites, social networks, or the websites of antivirus software companies.

Where is the hosts file located?

As a rule, if it is a Windows operating system (NT, 2000, XP, 2003, Vista, 7, 8), the hosts file is located in the system partition on drive C. The full address looks like this: C:\Windows\System32\drivers\etc\hosts.

There are more quick way get to the host file. To do this, press the key combination: Win + R or “Start” → “Run”. A window for entering a command will open. Enter the following command:

  • notepad %windir%\system32\drivers\etc\hosts

And here is the host file itself, which by default looks like this:

If there is no hosts file in this folder, then most likely the virus has changed its location in the registry key. Below is a registry key that specifies the path to the folder with the host file:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters \DataBasePath

In addition, the hosts file may be hidden. In this case, go to “Folder Options” → “View” and set the value to “Show hidden folders, files and drives.”

How to edit the hosts file?

The hosts file can be edited in any text editor. For example, in a standard Windows notepad.

Let's look at the editing options and get started block access to the sites mentioned above: vk.com and ok.ru.

The site or sites to which access needs to be blocked are written on a new line; first, the local IP address is indicated at the beginning of the line - 127.0.0.1 .

In our case, the entry looks like this:

127.0.0.1 vk.com
127.0.0.1 ok.ru

Save the changes. Now open the browser and try to go to the address vk.com or ok.ru. As you can see, the hosts file has done its job, and the attempt to connect to these sites failed.

You can also redirect(make a redirect) to another site. To do this, you need to know the IP address of the site where the redirection will be made, and next to it, indicate the domain from which the redirect is being made, separated by a space.

The example below shows that first I entered the IP address of the site yandex.ru (213.180.204.3), and indicated the domain vk.com separated by a space.

This means that when you try to access the vk.com website, you will be redirected to yandex.ru (213.180.204.3).

To speed up the loading of a site, you need to know its IP address and domain. This data is written in the hosts file.

It would seem that everything is simple: you need to register the necessary changes in the hosts file and click “Save”. But the system complains and does not allow you to save the desired changes. More precisely, it suggests saving it to a separate text file.

This is due to stricter security rules in the OS latest versions, and this makes sense, since many viruses try to write their lines here. IN in this case changes are made by us, and this is done purposefully.

You need to do the following. Return to the location of the hosts file and right-click to call context menu, where select “Properties”.

Go to the “Security” tab and select the user under whose name you are working.

Agree with the warning about the reduced security level. Go back and save changes.

There is an easier way to edit the hosts file - using command line. You can read it.

To restore the default hosts file settings, simply copy and paste the text below:

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a ‘#’ symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

This is how you can easily and simply by editing the hosts file, you can block access to sites or perform redirection. That's all for today.

In the next article I will tell you how to edit the hosts file if the Windows system is locked. In addition, I will answer popular questions: “Why can’t I log into Odnoklassniki?”, “Why can’t I log into VKontakte, email and other sites?” Subscribe and don’t miss the release of this article (the article has already been published, you can read it).

The article covers the following questions: where is the hosts file in Windows 7, Windows 8, Windows 10; contents of the hosts file, how to edit it; how to save the hosts file if access is denied.

Hosts file - what is it, what is it for?

What is this

hosts - a file containing a database of IP addresses and domain names corresponding to them. For example, for the popular site VKontakte the correspondence will be as follows:

87.240.131.118 vk.com

The hosts file on Windows is opened using the application Notebook.

What is it for?

Letter website addresses were invented exclusively for people, since it is easier for a person to remember. Computers find sites by numbers. Using the same VKontakte as an example: vk.com is a letter address (or they say URL), and 87.240.131.118 is a digital address (or IP address).

Check my words. Enter in the address bar of your browser
87.240.131.118
You must go to the site https://vk.com/.

All matches between IP addresses and URLs are stored on DNS servers, which the browser contacts and opens to us the desired site.

But before contacting the DNS server, the browser always checks the hosts file. In it we can prohibit the opening of sites, or replace the correspondence between the IP address and the URL.
This is what viruses do on the computer, replacing matches, adding other lines to this file, etc. For information about the lines that need to be entered into such a file, see the chapter “Like commands that need to be entered

What should the hosts file look like? Contents of the hosts file

The hosts file should have the following:

For Windows XP:

# Copyright (c) 1993-1999 MicrosoftCorp.
#

#




#space.
#


#
# For example:
#

127.0.0.1 localhost

For Windows Vista:


# Copyright (c) 1993-2006 MicrosoftCorp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host


# 127.0.0.1 localhost
# ::1 localhost

For Windows 7, 8, 8.1, 10:

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

Where is the hosts file located in Windows 7, Windows 8, Windows 10

The hosts file is located in all versions of Windows at
See screenshots:

How to open the hosts file

This file can be opened using Notepad. Find it in the start menu this application. Right-click. In the menu that appears, select “Run as administrator.” In the Notepad window that opens, through the “File” → “Open…” menu, open the hosts file, writing the file address in the address bar of the window that opens or moving from folder to folder until we find it.

How to edit the hosts file

1. Recovery

To restore a file you need:
  1. Open the file using Notepad as administrator.
  2. Copy the contents of the file from this article, paste with replacement and save.
Attention!
The file should only be opened through Notepad running as administrator. Otherwise, you will not be able to save the changes. When we save the .txt extension in the file name, we remove it.

Tricks of a modified hosts file

1. Some viruses disguise their changes after lines
127.0.0.1 localhost
::1 localhost

They leave a lot of spaces and only then add lines.

Therefore, when replacing content, select all content (hot keys CTRL+A).

2. The file is hidden
If there is no file in the specified package, then it may have been hidden and assigned the “Hidden” attribute.
In the menu View → Options → View, check the “Show hidden files, folders and drives” checkbox.




Now that the file has appeared, in the file properties, uncheck the “Hidden” checkbox.

3. Cannot be edited
The file has been assigned the Read Only attribute. In the file properties, uncheck the corresponding box.


To folder C:\Windows\System32\drivers\etc place a file with the name hosts, but with the extension .txt(hosts.txt file) or without an extension, like the hosts file, but with a different name, for example, host.

2. Change

To block access to a certain site, you need to enter the lines at the end of the content
(Skip line)
127.0.0.1 (several spaces) (Domain name to block)
127.0.0.1 (several spaces) (Name of the blocked domain from www.)

Using the example of the same VKontakte and Odnoklassniki:


Save. We check our work by entering the URL of these sites into the address bar of the browser. Sites do not open. Bingo!

This way you can block websites computer games, casino sites, pornographic sites, etc.

To redirect, we do everything as before, but we give the desired URL a different IP.

Example. Let the site https://vk.com/ open when you log in to VKontakte and Odnoklassniki
We write the lines:
(Skip line)
87.240.131.118 vk.com
87.240.131.118 www.vk.com
87.240.131.118 ok.ru
87.240.131.118 www.ok.ru

2.3. Popular sites and their IP addresses

87.240.131.118 https://vk.com/
213.180.193.3 https://ya.ru
5.61.23.5 https://ok.ru/

The Internet is full of services to determine the IP addresses of any websites. Google it.

hosts access denied - what to do

If you cannot save the file and access is denied. We do it in order, trying to save the file after each item.
  1. Open in Notepad as administrator.
  2. Copy the file to your desktop. Change it. The hosts file remaining in the folder C:\Windows\System32\drivers\etc rename it to hosts.old. Copy the hosts file you edited on your desktop to the folder C:\Windows\System32\drivers\etc.
  3. Turn off antivirus. Antivirus programs often ensure that no changes are made to this file. Add file to exceptions Windows Defender. Starting at 8 Windows versions makes sure that no one changes this file.
  4. We set access rights to the file in its properties on the “Security” tab.
  5. If you still can't remove it, go to Safe Mode and try to remove it from under it.

What happens if you delete the hosts file

Nothing will happen. Unless there are problems with your Internet connection. During connection, the IP address 127.0.0.1 will have to be specified manually. It's possible that some programs will ask for localhost instead of 127.0.0.1, which will create another problem.

Using this file, you can establish a correspondence between domain names and their IP addresses. IN general case this correspondence is determined by the DNS service (server), but if this service needs to be “bypassed,” that is, to set a non-standard (sometimes useful, and sometimes harmful) mapping, then they resort to setting it in the hosts file. This system object appeared with the advent of the Internet, when the DNS service did not yet exist, and was the only way for Windows to match the symbolic name of a site with its physical network address.

File Format

This file is a system file and is located in the system partition of the disk in the Windows\System32\drivers\etc\ folder. In format, it is a regular text file named hosts, but without a name extension. It consists of text strings and can be edited by any text editor. Each line can be either a comment (in which case its first character is #) or a matching statement in the format <имя домена>. There must be one or more spaces between the address and name. For example, the string 102.54.81.91 rh.com associates the host rh.com with its address 102.54.81.91. During his Windows installations 7 forms the standard content of this document, which looks like:

How to restore hosts

Sometimes a situation may arise when you need to restore initial state this file. It can occur either after its accidental deletion or corruption, or as a result of exposure to malware. It should be said right away that to access this file (including when restoring it) you need administrator rights. Its content can be generated manually in a text editor or downloaded from the Internet.

Editing a file

Of course, in order to edit hosts, you need to have administrator rights. You can edit it with any text editor. As an example, we use standard Notepad, which is always installed in Windows 7. You can launch it in two ways - from the command line and by directly calling Notepad:


After any changes to this document, you must reboot, otherwise its new contents will not be known to Windows 7, since they become known only during a reboot.

The benefits and harms of hosts changes

Useful changes to this file include, for example, the following:

  • Setting the IP address and domain to match in order to speed up access to the site by bypassing the DNS server.
  • Changes to block access to a specific site, for example, to block Windows authentication or the availability of updates for a program. To do this, 127.0.0.1 is specified as the IP address, which the operating system perceives as an access to this computer, and not to the real site.
  • Changes to "advertise" this computer local server, since the DNS service knows nothing about it. Of course, for this the IP address must be static.

Hosts are the main target for most malware. There are two main, one might say “classical”, ways of changing this file, which attackers resort to in order to benefit from it. These are the changes:

  • Blocking access to anti-virus program servers so that the computer cannot download such a program or update virus syndrome databases. For example, if, as a result of exposure to a virus or Trojan, a line like “127.0.0.1 esetnod32.ru” appears in the hosts, then any attempts to access the site with this antivirus will be blocked.
  • Substitution of a real website address registered on the DNS server with a fake one. Let’s say that a malicious application that has penetrated a computer writes the line “91.81.71.61 vk.com” in this file, where the address of the computer of the author of this program is specified. This is done with the goal that attempts to access everyone’s favorite site will result in a call to the attacker’s server, the interface of which completely replicates its real counterpart, but is used to collect confidential information about site users, for example, their logins and passwords.

Therefore, if there is any suspicion of the presence of viruses in the system, you should first check the status of this file, and that is why many anti-virus programs tirelessly monitor its status and notify the user of all attempts to change it.

Where is the hosts file located?? I can’t access many sites, mostly antivirus programs, friends say I have a virus on my computer, and problems are caused by it. My antivirus program is regularly updated, I heard in Windows XP, there is a hosts file and if you edit it properly, the problem will go away, but if you do it incorrectly, the Internet will completely disappear, can you tell me where it is and how to edit it?

Where is the hosts file located?

  • Note: Do you want to know how virus programs use this very important file, and also how you can use this secret weapon yourself for good purposes. What to do when the hosts file is completely missing from the system or you have two hosts files. What to do when your websites do not open: Odnoklassniki, VKontakte, mail.ru, then be sure to read our new article after reading this article.

In Windows XP and Windows 7, there is a very small and good file, with which you can control your Internet surfing, the vast majority of users personal computer they don’t know about it, and if they do, they prefer to avoid it for fear of doing something wrong; this file is called hosts. Why is it needed?

  • When you enter the name of a site, for example, mail.ru, into the address bar of your browser, know that a special DNS server located on the Internet immediately converts the name mail.ru into a set of numbers, which is a unique IP address for each site, to For example, for mail.ru it is 94.100.191.204. Since the Internet server where the mail.ru website is located does not contain names, but contains only numbers, the names were specially invented for you and me, so that we can remember them more easily. The hosts file is needed to speed up work on the Internet by bypassing access to DNS server, that is, if you and I write the following information in the hosts file 94.100.191.203 mail.ru, then the mail.ru website will load directly from us, bypassing the DNS server. But you need to register everything correctly, otherwise you won’t get anywhere at all or you’ll end up in the wrong place. This is the “wrong way” that the creators of virus programs use. Now about everything in detail!

The most important thing to remember is that a request to the hosts file in all browsers has priority over access to DNS servers. In simple words, any browser before your request always looks at the information located in the hosts file.

For example, if in the hosts file we enter other information instead of 94.100.191.203 mail.ru, for example 217.20.147.94 mail.ru, then by typing mail.ru in any browser, instead of the mail.ru mail service, we will get to the Odnoklassniki website , since the IP address 217.20.147.94 is the address of the Odnoklassniki website.

Any system administrator, and even a simple user, must guard the hosts file like the apple of his eye. Now about viruses. Virus writers, one might say, are happy to use hosts file for your own purposes. When a virus gets onto a user’s computer, it often changes the file hosts , therefore, if you have problems accessing any sites, first of all you need to check your machine for the presence of malware, and then return the file hosts pristine appearance.

The hosts file is located at the address C:\windows\system32\drivers\etc\hosts, where (C:) is a letter system partition, it is this file that decides which sites are worthy of your attention and which are not. The hosts file may be hidden; to see it, you need to enable display on the system hidden folders and files. Computer->Organize->Folder and Search Options->View, then uncheck the itemHide protected system files , and mark the pointShow hidden files and folders and drives


Open the hosts file by double clicking right mouse, when prompted to select a program to open the file, select Notepad.

Friends, if you did not find the hosts file in the C:\windows\system32\drivers\etc\ folder, it means the virus has changed the location of the file in the registry key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\DataBasePath,

By the way, you may have the hosts file where you need it, but the operating system will use the hosts file located in a completely different place. You can find out exactly where the other hosts file created by the virus is by looking at the DataBasePath value. You will need to return the correct value to the key, as in the screenshot.

So we found out where is the hosts file located, now let's learn how to edit it, if you want to simply fix the file automatically (recommended) using the Microsoft Fix it 50267 utility, then go to the website of its creators and do it with two clicks.

Here is a sample of the original hosts file, by default the file should only have one entry 127.0.0.1 localhost

You can directly copy it from me and edit the hosts file using notepad.

Original hosts file in Windows XP

# (C) Microsoft Corp., 1993-1999

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

# This file contains mappings of IP addresses to hostnames.

# Each element must be on a separate line. The IP address must

# should be in the first column and must be followed by the appropriate name.

# The IP address and hostname must be separated by at least one space.

# Additionally, some lines may contain comments

# (such as this line), they must follow the node name and be separated

# from it with the symbol "#".

# For example:

# 102.54.94.97 rhino.acme.com # origin server

# 38.25.63.10 x.acme.com # client node x

127.0.0.1 localhost

Original hosts file in Windows 7

# Copyright (c) 1993-2009 Microsoft Corp.

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

#space.

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a "#" symbol.

# For example:

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.

# 127.0.0.1 localhost

# ::1 localhost

If we want, we can deny access to some sites completely using this file. You can do this this way: after the numbers 127.0.0.1 you need to enter the domain name of this site. For example, in most cases, a virus program prohibits visiting sites that distribute anti-virus software; in the case of Kaspersky anti-virus, it will look like this:

127.0.0.1 kaspersky.ru

And you and I can use this secret weapon, for example, by protecting our children from accidentally visiting sites with certain content without resorting to programs like Parental controls, for example, let's write:

127.0.0.1 is the name of a site that you consider dangerous.

127.0.0.1 porno.ru

127.0.0.1 sex.ru

The computer will look for the addresses of these sites on the hard drive, you don’t need to enter too many addresses either, the computer will noticeably slow down.

How else can you use the hosts file? It's no secret that only digital addresses are used on the Internet. The names of sites, for example: R emontcompa.ru, were invented so that the common user would remember them more easily. The computer converts letters that we understand, but are not familiar to, into numbers using the DNS service; naturally, it takes a lot of time for the computer to contact remote DNS servers.

For fast loading of your favorite site, in the hosts file, you need to indicate its address in numbers directly, bypassing DNS service. For example, we constantly need the mail.ru mail service, since its site IP is: 94.100.191.203, we write this information in the hosts file, first enter the IP, and then the server name.

127.0.0.1 localhost

94.100.191.203 mail.ru

A space is required.

Friends, recently virus writers have come up with a trick if, for example, you open the hosts file

in a notepad, then at first glance nothing suspicious will seem to you, the contents of the hosts file will be standard,

but if you scroll the scroll arrow to the end, to the very end of the hosts file, then there you can find, for example, such malicious entries; of course, they need to be deleted.

After some time, you will need to check the hosts file again; if malicious entries are made again, it means there is something on your computer

the virus is working. Read our articles.

© 2024 ermake.ru -- About PC repair - Information portal