17

There are a few other question with this same title but they do not solve my problem, so I am opening another one.

  • I have set the permission for the "hosts" file to full access for the current user. I have even taken the ownership. Current user is in Administrators group.

  • I have turned off UAC.

  • I have removed read only permission from the file.

    C:\Windows\System32\drivers\etc>attrib hosts
    A            C:\Windows\System32\drivers\etc\hosts
    
  • I have disabled my Panada Antivirus. I have also stopped 3 panda services from Services palette.

  • I open an elevated Command Line (run as Administrator). Run Notepad and change the file. When I try to save the file I receive the following error:

    "The process cannot access the file because it is being used by another process.

  • I check the file using "Unlocker" and the software says there is no active lock on the file.

Can anyone help?

  • 1
    Most of the time disabling an AV isn't entirely sufficient. I suggest you, uninstall Panda Antivirus, then try to edit the hosts file. – Ramhound Sep 4 '15 at 16:50
  • 2
  • 1
    David, as I mentioned Unlocker says no one has locked it. Process explorer finds no handle attached to the file. – wmac Sep 4 '15 at 20:14
  • Removing Panda did not work either. It is very strange. – wmac Sep 4 '15 at 22:00
25

I had the same issue, my hosts file was locked by ZoneAlarm Firewall. To solve it, i had to uncheck [X] Lock Hosts File in ZoneAlarm settings

enter image description here

  • 3
    In ZoneAlarm 15, it will not work to simply turn the firewall off - You have to select Firewall/Basic Firewall/Settings/Advanced Settings - then uncheck Lock hosts file. – Gene Nov 17 '16 at 20:31
  • Thank you - I have been "destroying" Windows security settings to be able to edit this file. So, thanks to ZA I am probably MUCH worse off (aka how to restore "TrustedInstaller" as owner - my earlier solution that worked over a year ago (last time I edited hosts). Sigh! Again - Thanks!! – Michael Felt Feb 20 '17 at 7:32
11

Just came across and solved this issue, after a little faffing, so thought I'd offer notes.

I used SysInternals Process Explorer, Run as Administrator, to find the process that was locking the file (by using Find > Find Handle or DLL). Note that when I ran it without Administrator permissions it couldn't see the system-level WRSA process.

In my case it was WRSA.exe, which is Webroot Secure Anywhere. Disabling the protection unlocked the file and I was able to overwrite it easily. In some versions of webroot you will have to open "Advanced Settings > Shields" and un-check the option for blocking edits to the hosts file.

It's completely right that anti-virus software should protect files such as hosts, of course. Malware loves that sort of thing.

  • You are life saver! I had the Webroot block. Nothing had worked until your solution! Thanks! – IrfanClemson Jun 4 '18 at 17:51
9

I could eventually find the culprit. It was a program called "Tiny Firewall" (a windows firewall rule management software) that caused the problem.

I am not exactly sure what does it do to the hosts file because none of the available software could show a lock on the file. I could find that it is somehow involved with the file using process monitor (Sysinternals). I quit the UI and stopped the process (would not allow to stop, killed the process-tree and set to manual service).

P.S.: This is a feature of Tiny Firewall (protection of hosts file) and you can simply turn it off from its settings.

0

In my case, HOSTS file was constantly locked by svchost.exe !

The problem started since I have used the tool HostsMan. It had filled the HOSTS file with about 18 MBs of DNS numbers and domains. And my PC was suddenly offline.

So, with the tool Process Explorer, I searched for "etc\HOSTS". When you click on one entry in the search results, the corresponding locking process is highlighted in brown colour. So I found out, that HOSTS file had been locked by the process svchost.exe and sometimes by other processes as well. I waited until no other process than svchost.exe had been locking HOSTS. Then I killed the process tree of that concerning svhosts.exe! Within the few seconds, while that svhosts.exe process had not yet restarted (thus HOSTS was temporaily unlocked), I finally managed to rename HOSTS manually into anything else like "HOSTS000". Then I renamed the neighbouring file "HOSTS.back" (which is the backup with the default content) into HOSTS. Problem solved! I suddenly was online again.

Check the picture below for the DNS filters, which I had activated. I guess, Windows 10 simply was overloaded with all those 50 thousands of domain names saved into the HOSTS file.

enter image description here

protected by Community Nov 18 '16 at 0:28

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.