19

There are a few other question with this same title but they do not solve my problem, so I am opening another one.

  • I have set the permission for the "hosts" file to full access for the current user. I have even taken the ownership. Current user is in Administrators group.

  • I have turned off UAC.

  • I have removed read only permission from the file.

    C:\Windows\System32\drivers\etc>attrib hosts
    A            C:\Windows\System32\drivers\etc\hosts
    
  • I have disabled my Panada Antivirus. I have also stopped 3 panda services from Services palette.

  • I open an elevated Command Line (run as Administrator). Run Notepad and change the file. When I try to save the file I receive the following error:

    "The process cannot access the file because it is being used by another process.

  • I check the file using "Unlocker" and the software says there is no active lock on the file.

Can anyone help?

  • 1
    Most of the time disabling an AV isn't entirely sufficient. I suggest you, uninstall Panda Antivirus, then try to edit the hosts file. – Ramhound Sep 4 '15 at 16:50
  • 2
  • 1
    David, as I mentioned Unlocker says no one has locked it. Process explorer finds no handle attached to the file. – wmac Sep 4 '15 at 20:14
  • Removing Panda did not work either. It is very strange. – wmac Sep 4 '15 at 22:00
29

My etc\hosts file was locked by ZoneAlarm Firewall

To unlock, I had to uncheck the "Lock hosts file" in ZoneAlarm firewall settings menu

enter image description here

| improve this answer | |
  • ZoneAlarm locks the file even when Firewall is stopped or we Exit from Firewall! Steps for mentioned configuration option: 1) Rightclick on Zonealarm tray icon 2) Select Show monitor 3) Firewall section "View Details" button 4) Basic Firewall section "Settings" button. 5) "Advanced settings" button – joro Aug 13 at 9:30
14

Just came across and solved this issue, after a little faffing, so thought I'd offer notes.

I used SysInternals Process Explorer, Run as Administrator, to find the process that was locking the file (by using Find > Find Handle or DLL). Note that when I ran it without Administrator permissions it couldn't see the system-level WRSA process.

In my case it was WRSA.exe, which is Webroot Secure Anywhere. Disabling the protection unlocked the file and I was able to overwrite it easily. In some versions of webroot you will have to open "Advanced Settings > Shields" and un-check the option for blocking edits to the hosts file.

It's completely right that anti-virus software should protect files such as hosts, of course. Malware loves that sort of thing.

| improve this answer | |
  • You are life saver! I had the Webroot block. Nothing had worked until your solution! Thanks! – IrfanClemson Jun 4 '18 at 17:51
  • The laptop I am working on was purchased from BestBuy. My WebRoot is littered with BestBuy logos. Windows Security, McAfee, and WebRoot. Probably more. The more the better, right? \s It's not like I really want any processing power left for things that I actually want to run. – harperville Sep 4 at 12:22
9

I could eventually find the culprit. It was a program called "Tiny Firewall" (a windows firewall rule management software) that caused the problem.

I am not exactly sure what does it do to the hosts file because none of the available software could show a lock on the file. I could find that it is somehow involved with the file using process monitor (Sysinternals). I quit the UI and stopped the process (would not allow to stop, killed the process-tree and set to manual service).

P.S.: This is a feature of Tiny Firewall (protection of hosts file) and you can simply turn it off from its settings.

| improve this answer | |
0

In my case, HOSTS file was constantly locked by svchost.exe !

The problem started since I have used the tool HostsMan. It had filled the HOSTS file with about 18 MBs of DNS numbers and domains. And my PC was suddenly offline.

So, with the tool Process Explorer, I searched for "etc\HOSTS". When you click on one entry in the search results, the corresponding locking process is highlighted in brown colour. So I found out, that HOSTS file had been locked by the process svchost.exe and sometimes by other processes as well. I waited until no other process than svchost.exe had been locking HOSTS. Then I killed the process tree of that concerning svhosts.exe! Within the few seconds, while that svhosts.exe process had not yet restarted (thus HOSTS was temporaily unlocked), I finally managed to rename HOSTS manually into anything else like "HOSTS000". Then I renamed the neighbouring file "HOSTS.back" (which is the backup with the default content) into HOSTS. Problem solved! I suddenly was online again.

Check the picture below for the DNS filters, which I had activated. I guess, Windows 10 simply was overloaded with all those 50 thousands of domain names saved into the HOSTS file.

enter image description here

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.