hosts file cannot be deleted or modified. re-appears in a second

  • Thread starter Thread starter shaun
  • Start date Start date
S

shaun

the hosts file in the system32\drivers\etc directory
cannot be deleted, or rather if it is deleted it then
magically re-appears. This appears to be some kind of
trojan which doesn't want me to block advertising. I have
shut down all processes and services except security
accounts manager and windows management instumentation.
this behaviour is like a kind of real-time file
protection. very strange. I have never noticed a file on
my system before which re-appears instantly when deleted.
I'm running windows2000 with service pack 4. Have i been
hacked?
 
shaun said:
the hosts file in the system32\drivers\etc directory
cannot be deleted, or rather if it is deleted it then
magically re-appears. This appears to be some kind of
trojan which doesn't want me to block advertising. I have
shut down all processes and services except security
accounts manager and windows management instumentation.
this behaviour is like a kind of real-time file
protection. very strange. I have never noticed a file on
my system before which re-appears instantly when deleted.
I'm running windows2000 with service pack 4. Have i been
hacked?
Click to expand...

Sounds more like system file protection stopping you from deleting files
that are used by the system.

What does deleting a useful file have to do with stopping advertising
anyway?
 
Replacing the hosts file with a hosts file full of
advertising websites prevents these ads from ever
appearing. check out
http://www.mvps.org/winhelp2002/hosts.htm
http://www.accs-net.com/hosts/what_is_hosts.html
The hosts file is only useful if you fill it up!
Normally the hosts file can be edited or deleted and then
replaced. But mine is being re-written every second or so.
Click to expand...

Right, I'm well aware of how adding stuff to it can be useful, what I'm
trying to pin down is are you having trouble modifying it (as your subject
line says) or deleting it, as your post says.

Have you tried scanning with something like Ad-Aware? Or trend's housecall
(for viruses that might have slipped past your virus scanner)
http://housecall.antivirus.com
 
HOSTS file is not part of WFP - if it keeps
reappearing and, assuming there are all type
of entries in there, I would assume either
spyware or possibly a trojan. Check your
system via combo of ad-aware / spybot for
spyware and any anti-virus program for
viruses/worms/trojans etc
 
Back
Top