Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My Windows XP hosts file has been tampered with, and I can't fix it. This is particularly bad because whatever tampered with the hosts file left these:

...
188.124.7.190 www.google.com 
188.124.7.190 google.com 
188.124.7.190 google.com.au 
188.124.7.190 www.google.com.au
188.124.7.190 google.be 
188.124.7.190 www.google.be
...

If I understand this correctly the hosts file is responsible for mapping IP addresses to names, correct? It appears that someone went through the effort of mapping google (all languages), bing and yahoo all to one ip address but whatever server my google searches were being routed to has been taken down, thus cutting me off from any form of search engine whatsoever. I had to log in to Super User with my Wordpress account just so I could post this.

I've tried manually deleting those lines from the hosts file but for some reason I'm unable to save it. I'm running as Administrator right now, and I've tried this in safe mode as well, nothing I've tried works. It's worth mentioning now that I disabled System Restore. Could anyone help?

edit: I've already tried running AV and anti-malware, Spybot S&D couldn't touch the hosts file either.

share|improve this question
1  
The IP that you've found in your hosts file is assigned to a computer located Turkey. The ISP is named VITAL TEKNOLOJI TELEKOMUNIKASYON BILGISAYAR HIZMET. –  eleven81 Feb 4 '10 at 18:18
2  
count yourself lucky the server is down. Better broken searches than the broken bank account or identity you might get if you actually let your machine route any traffic through that server. –  Joel Coehoorn Aug 30 '11 at 2:53
add comment

10 Answers

up vote 0 down vote accepted

Microsoft has this tutorial for you:

How do I reset the hosts file back to the default?

If necessary, do this in Safe Mode.

share|improve this answer
    
This doesn't work either. I noticed that there is no 'hosts' file in the .../etc folder, and setting folder options to display hidden files doesn't show anything as well. Trying to create a new hosts file just gives me a 'Cannot create file, file already exists' error. –  user27210 Feb 4 '10 at 18:13
    
@cornjuliox - Run a BartPE CD and sort it out (always handy to have anyway), however, there is something seriously wrong with your system. –  Molly7244 Feb 4 '10 at 18:18
    
It looks like the right way to go is to use the fixit application, and not the manual method. Strange thing is that now it doesn't look like there's a hosts file anymore... –  user27210 Feb 4 '10 at 18:37
    
I've got a quick question before this thing is eventually locked, I'm told that its safe to delete the hosts file altogether, is that right? I could avoid this problem on brand new installs just by deleting the hosts file. –  user27210 Feb 4 '10 at 18:50
    
@cornjuliox - you can delete it alright, but a well maintained Hosts file can be quite useful. –  Molly7244 Feb 4 '10 at 19:49
add comment

You've got a virus, or some other intruder. My advice is to backup, disconnect from the Internet, reformat and reinstall your operating system. Consider your Wordpress password (and indeed, all of your other passwords you may have recently typed into that computer) compromised; whatever software is rewriting your hosts file may contain a key logger.

You might consider disconnecting that machine from the Internet to research the symptoms and see if you can conclusively determine the source of intrusion, but I would strongly advise against using the computer for anything else in the meanwhile. Until it's disconnected, consider all your actions and the contents of that machine to be visible to some hostile 3rd party.

A quick check shows that the address in question is actually serving up Google's content more or less seamlessly, with the exception that they're using a self-signed SSL certificate. I would change all of your passwords, especially for google.com and gmail.

share|improve this answer
    
+1. DNS hijackers are usually installed by exploits (make sure your browser and plugins are up to date next time; don't install plugins you don't definitely need, for example Adobe Reader's PDF plugin that has caused many, many infections over the last year). The other main source is ‘fake codec’-style social engineering attacks. –  bobince Feb 4 '10 at 18:09
add comment

This is typical of many malware apps. Do you have a good AV installed and up to date? Use other tools like Spybot Search and Destroy, Adaware amd Malwarebytes to scan. I would use all three. Double check that system restore is off and stays off. Be aware that some malware will block you from these sites and AV sites so you may have to download and install from alternate medis.

MalwareBytes

Spybot

Adaware

share|improve this answer
    
I've already tried running Spybot S&D and it couldn't access the hosts file either. –  user27210 Feb 4 '10 at 18:07
    
Have you used all three? –  Dave M Feb 4 '10 at 19:22
add comment

Note: This answer will not help you fix the problem. It is a stopgap only.

Until this is fixed, should you need to google, enter any of google's IP addresses in your address bar.

C:\>nslookup www.google.com
*** Can't find server name for address 10.2.1.3: Non-existent domain
*** Default servers are not available
Server:  UnKnown
Address:  10.2.1.3

DNS request timed out.
    timeout was 2 seconds.
Non-authoritative answer:
Name:    www.l.google.com
Addresses:  74.125.45.103, 74.125.45.104, 74.125.45.105, 74.125.45.106
          74.125.45.147, 74.125.45.99
Aliases:  www.google.com


Edit: To search, you'll need to manually build your query.

For example:

http://74.125.45.103/search?q=dns+hijack+problem
share|improve this answer
    
This gets me to Google's homepage but no farther than that. –  user27210 Feb 4 '10 at 18:16
add comment

I recommend trying to use some live Linux distributions to startup your computer - these distros run directly from the CD. They can read the Windows partition, and often write to it as well.

Be warned however that you can really mess up your computer if you don't know what you are doing or don't know how to use Linux. I can recommend Puppy Linux bas quite a user friendly distro with its own browser and other essential tools. It should be seen as a temporary solution, but may be a lifesaver!

A good feature is that you can move files and take backups from your hard drive into a USB hard drive without needing Windows.

share|improve this answer
add comment

I used winternals, found the Hosts file in C:\windows\system32\drivers\etc. proceeded to delete the file and then created a new one. Afterwards rebooted, ran all the anti malware and spyware removers.

share|improve this answer
add comment

You could try running ComboFix on your computer. This may fix the problem, some sort of malware.

share|improve this answer
add comment

Get to another computer and download the programs Combofix and SmitFraudFix. Boot into safe mode and run both. This should fix the problem.

share|improve this answer
add comment

If you have already done all the anti malware tools (and I advise you follow these steps), then the virus is most likely taken care of.

After this, if it is strictly a permission issue; it could be that the malware changed the file permissions.

Simply right click on the file and go to Properties. Go to the Security Tab and add check what is set to denied, and uncheck them as well as making sure that you have full permissions.

The defaults for the hosts file should look like this:

alt text

alt text

alt text

If it is not a permission issue, and/or if you are still having trouble after this, download Microsoft / Sysinternals Process Explorer, go to search/find and type hosts. It should be able to tell you which process is locking the file. This may be something innocent such as AV or similar, or it could be more malicious and be a result of malware still being present.

share|improve this answer
    
Thats the thing, I don't see a 'hosts' file here. its like its hidden, but setting the folders to display hidden files does nothing. –  user27210 Feb 4 '10 at 18:25
    
How about at the command line, using dir /a:s ? That would display it if it's got the system bit set. Then you could use attrib -s on it. –  Alex Feb 4 '10 at 18:43
    
This is very confusing :S Are you sure the file is there now? I see you said in another comment about deleting it... –  William Hilsum Feb 4 '10 at 19:22
add comment

Some malware creates a new rogue hosts file with attributes making it a hidden protected system file. In order to see it and delete it, uncheck Hide protected operating system files under Folder Options in the Control Panel.

Rename the file to hosts.old and reboot.

Delete the file using Malwarebytes > More Tools > File Assassin. Then create a new hosts file.

(See: How can I reset the Hosts file back to the default?)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.