Need to Change Hosts File Redirect - Detailed Help

[Guest]

Hi there:

I recently had the experience of getting a wonderful downloading virus (here's an article about it http://camtech2000.net/Newsletters/a_new_spyware_tactic.htm)

Anyway, I got rid of this thing almost entirely, but am still getting a Host File redirect whenever I log onto any webpage. The host file has a redirect link on it listed right after the local host. This is a remnant of the spyware virus. I have attempted to change the host file, but am unsuccessful. I am missing something in the process, I guess. Below I listed what I have done. Please respond with some detailed, sure-fire advice to make changes to my host file that will work.

To access the Host file I am opening it with Notepad. I then delete the bad host redirect address.

When I click SAVE after making the deletion, this message comes up:

Cannot create the C:\WINDOWS\system32\drivers\etc\hosts file.
Make sure that path and filename are correct.

Now if I click SAVE AS, I only get the option of saving it with a .txt extension. If I change the extension to 'All Files' and click on the file to replace, that doesn't work either. I can close out and then open the file again and, what do you know, the stupid redirect address is still there. This goes for the host backup files as well.

What am I doing wrong? I need some detailed steps here to get it right. Obviously it's something with the path and filename, but I have no clue at this point.

Also, there may have been some address infection with Active X. Where do I look in these files to see if anything is wrong? I read somewhere that changes to Active X can continually make changes to the host file...thus never getting rid of a the redirect.

Please help! Thanks!

 

[ceedee]

check that the hosts files isnt set to read only

also use save as to save it as txt file or whatever
then edit it as you see fit
then boot to safe mode with command prompt
delete hosts files and rename the hosts.txt to plain hosts

if som thing is still running to change the host file all the time
get hijackthis (google is your freind ) and it will either
show the culprit or post the log file it makes so we can see
it and advise you

ceedee

Hi there:

I recently had the experience of getting a wonderful downloading virus

(here's an article about it
http://camtech2000.net/Newsletters/a_new_spyware_tactic.htm)

Anyway, I got rid of this thing almost entirely, but am still getting a

Host File redirect whenever I log onto any webpage. The host file has a
redirect link on it listed right after the local host. This is a remnant of
the spyware virus. I have attempted to change the host file, but am
unsuccessful. I am missing something in the process, I guess. Below I
listed what I have done. Please respond with some detailed, sure-fire
advice to make changes to my host file that will work.

To access the Host file I am opening it with Notepad. I then delete the bad host redirect address.

When I click SAVE after making the deletion, this message comes up:

Cannot create the C:\WINDOWS\system32\drivers\etc\hosts file.
Make sure that path and filename are correct.

Now if I click SAVE AS, I only get the option of saving it with a .txt

extension. If I change the extension to 'All Files' and click on the file
to replace, that doesn't work either. I can close out and then open the
file again and, what do you know, the stupid redirect address is still
there. This goes for the host backup files as well.

What am I doing wrong? I need some detailed steps here to get it right.

Obviously it's something with the path and filename, but I have no clue at
this point.

Also, there may have been some address infection with Active X. Where do

I look in these files to see if anything is wrong? I read somewhere that
changes to Active X can continually make changes to the host file...thus
never getting rid of a the redirect.

 

[Lance Joiner]

Try posting the results here..

For instructions on how to use it; you have to post the log it
produces here:
http://www.spywareinfo.com/forums/
so experts tell you what is good and what is malware
HijackThis Log Tutorial

| Tried the whole SAVE AS procedure and went into Safe Mode to resave
host file. Didn't work. As soon as I booted in Normal mode and
checked the file, the redirect had reappeared. This happened even
after I made sure to change the properties to READ ONLY! So,
apparently, there is some file during boot up that is still changing
the host file. What do I do and where do I look?
|
| Here is the entire corrupted line in the host file:
|
| 127.0.0.1 localhost#13.159.117.235 auto.search.msn.com
|