Undeletable lines in HOSTS file

  • Thread starter Thread starter David
  • Start date Start date
D

David

I've got four lines in my HOSTS file that
are "undeletable":

127.0.0.1 IE3.Proxy.AOL.com
127.0.0.1 www.proxy.cs.com
204.244.184.143 SafeWeb.com
204.244.184.143 WWW.SafeWeb.com

If I delete these lines, or even modify them, they are
reinserted at the end of the file within a few seconds
after I save it. If I rename the file, a new HOSTS file
containing just these lines is created within a few
seconds.

An interesting twist is that the IP address associated
with safeweb.com (in the HOSTS file) is NOT the IP
address for safeweb.com. It's the IP address for a
different, unrelated company, called safe.com. Before I
realized this, I visited safeweb.com (or so I thought)
and contacted the support people there and asked them if
they had a clue why this was happening. Of course, they
(safe.com) wondered why I was asking THEM. They directed
me to safeweb.com, but of course I can't go there because
the HOSTS file has the wrong IP address! I finally found
another of their web sites, safewebinc.com, and contacted
their support people, and they don't have a clue.

I suspected a virus, but NAV doesn't find anything. My
PCs are very clean systems, recently built from a clean
disk, and with all of the XP updates installed. This all
started when I was trying to find out why IE can't open
html files on my hard disk if they have javascript in
them. I was going through a troubleshooting checklist I
found, and uncovered this strange behavior.

Any ideas???
 
David said:
I've got four lines in my HOSTS file that
are "undeletable":

127.0.0.1 IE3.Proxy.AOL.com
127.0.0.1 www.proxy.cs.com
204.244.184.143 SafeWeb.com
204.244.184.143 WWW.SafeWeb.com

If I delete these lines, or even modify them, they are
reinserted at the end of the file within a few seconds
after I save it. If I rename the file, a new HOSTS file
containing just these lines is created within a few
seconds.

An interesting twist is that the IP address associated
with safeweb.com (in the HOSTS file) is NOT the IP
address for safeweb.com. It's the IP address for a
different, unrelated company, called safe.com. Before I
realized this, I visited safeweb.com (or so I thought)
and contacted the support people there and asked them if
they had a clue why this was happening. Of course, they
(safe.com) wondered why I was asking THEM. They directed
me to safeweb.com, but of course I can't go there because
the HOSTS file has the wrong IP address! I finally found
another of their web sites, safewebinc.com, and contacted
their support people, and they don't have a clue.

I suspected a virus, but NAV doesn't find anything. My
PCs are very clean systems, recently built from a clean
disk, and with all of the XP updates installed. This all
started when I was trying to find out why IE can't open
html files on my hard disk if they have javascript in
them. I was going through a troubleshooting checklist I
found, and uncovered this strange behavior.

Any ideas???
Click to expand...

David, I am experiencing this same behavior with my home Win98 system.
A co-worker suggested removing those lines from the hosts file and
setting the hosts file as read-only. You'll only have a few seconds to
set the property, but it may be worth a try to see what app is trying
to write to the file. I haven't had a chance to try it myself yet.
Also, I cannot guarantee that my home system is clean from viruses or
other strange little apps.

Please post back if you discover anything else.
Jay
 
Back
Top