HOSTS file not working

[Kyle Herrmann]

I have several users whose HOSTS file seems to be ignored when they change
it. Any entry they add is like it isn't even there.

I have run AdAware and HiJackThis on it, but discovered nothing besides the
Alexa spyware.

Anyone have any ideas besides spyware as to why the HOSTS file would be
ignored?

Thanks for any suggestions.

 

[Chuck]

I have several users whose HOSTS file seems to be ignored when they change
it. Any entry they add is like it isn't even there.

I have run AdAware and HiJackThis on it, but discovered nothing besides the
Alexa spyware.

Anyone have any ideas besides spyware as to why the HOSTS file would be
ignored?

Thanks for any suggestions.

Kyle,

Spyware would be my guess too. Remember HijackThis is pretty useless without
expert interpretation. Did you post your HJT log somewhere? Can you provide a
link to your post(s)?

The location of the hosts files isn't magical - and some spyware can hijack it
by changing the location. This article tells how to find the hosts file on your
system, using the registry entry:
http://support.microsoft.com/?id=314053

You'll be looking at registry key
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
value DataBasePath.

Kyle, please don't contribute to the spread and success of email address mining
viruses. Posting your email address openly will get you more unwanted email,
than wanted email. Learn to munge your email address properly, to keep yourself
a bit safer when posting to open forums. Protect yourself and the rest of the
internet - read this article.
http://www.mailmsg.com/SPAM_munging.htm

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Kyle Herrmann]

Thanks for the info.

I had checked the registry setting and it was setup correctly. Could they
edit the registry in another location to override the proper registry entry?

I haven't posted the Hijack this log, but I will when I get a chance to look
at the machine again.

Of course, if anyone has any other ideas, I would love to hear them.

Thanks Chuck.

I have several users whose HOSTS file seems to be ignored when they change
it. Any entry they add is like it isn't even there.

I have run AdAware and HiJackThis on it, but discovered nothing besides the
Alexa spyware.

Anyone have any ideas besides spyware as to why the HOSTS file would be
ignored?

Thanks for any suggestions.

Kyle,

Spyware would be my guess too. Remember HijackThis is pretty useless without
expert interpretation. Did you post your HJT log somewhere? Can you provide a
link to your post(s)?

The location of the hosts files isn't magical - and some spyware can hijack it
by changing the location. This article tells how to find the hosts file on your
system, using the registry entry:
http://support.microsoft.com/?id=314053

You'll be looking at registry key
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
value DataBasePath.

Kyle, please don't contribute to the spread and success of email address mining
viruses. Posting your email address openly will get you more unwanted email,
than wanted email. Learn to munge your email address properly, to keep yourself
a bit safer when posting to open forums. Protect yourself and the rest of the
internet - read this article.
http://www.mailmsg.com/SPAM_munging.htm

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Hans-Georg Michna]

Of course, if anyone has any other ideas, I would love to hear them.

Kyle,

before looking into details, first make sure you're actually
looking at the HOSTS file, not at HOSTS.SAM. The latter is only
a sample file which has no effect.

Hans-Georg

 

[Chuck]

Thanks for the info.

I had checked the registry setting and it was setup correctly. Could they
edit the registry in another location to override the proper registry entry?

I haven't posted the Hijack this log, but I will when I get a chance to look
at the machine again.

Of course, if anyone has any other ideas, I would love to hear them.

Thanks Chuck.

Kyle,

DNS resolution is affected by the LSP / Winsock subsystem.
http://support.microsoft.com/?id=318584
http://support.microsoft.com/?id=811259

Give LSP-Fix and WinsockXPFix <http://www.cexx.org/lspfix.htm>, or WinsockFix
<http://www.tacktech.com/display.cfm?ttid=257> a shot.

If XP SP2, Start - Run - "cmd". Type "netsh winsock reset catalog" into the
command window.

If no help yet, reset TCP/IP.
http://support.microsoft.com/?id=299357

Start - Run - "cmd". Type "netsh int ip reset c:\netsh.txt" into the command
window.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[James Egan]

Anyone have any ideas besides spyware as to why the HOSTS file would be
ignored?

If you're testing it using a web browser, make sure the local browser
cache is cleared.


Jim.

 

[Jack]

Hi
This page has some info about the Host file.
Read it may be a Bell will Strike: http://www.ezlan.net/host.htm
Jack (MVP-Networking).