There are a few other question with this same title but they do not solve my problem, so I am opening another one.

  • I have set the permission for the "hosts" file to full access for the current user. I have even taken the ownership. Current user is in Administrators group.

  • I have turned off UAC.

  • I have removed read only permission from the file.

    C:\Windows\System32\drivers\etc>attrib hosts
    A            C:\Windows\System32\drivers\etc\hosts
  • I have disabled my Panada Antivirus. I have also stopped 3 panda services from Services palette.

  • I open an elevated Command Line (run as Administrator). Run Notepad and change the file. When I try to save the file I receive the following error:

    "The process cannot access the file because it is being used by another process.

  • I check the file using "Unlocker" and the software says there is no active lock on the file.

Can anyone help?

  • 1
    Most of the time disabling an AV isn't entirely sufficient. I suggest you, uninstall Panda Antivirus, then try to edit the hosts file.
    – Ramhound
    Sep 4, 2015 at 16:50
  • 3
  • 1
    David, as I mentioned Unlocker says no one has locked it. Process explorer finds no handle attached to the file.
    – wmac
    Sep 4, 2015 at 20:14
  • Removing Panda did not work either. It is very strange.
    – wmac
    Sep 4, 2015 at 22:00

5 Answers 5


My etc\hosts file was locked by ZoneAlarm Firewall

To unlock, I had to uncheck the "Lock hosts file" in ZoneAlarm firewall settings menu

enter image description here

  • ZoneAlarm locks the file even when Firewall is stopped or we Exit from Firewall! Steps for mentioned configuration option: 1) Rightclick on Zonealarm tray icon 2) Select Show monitor 3) Firewall section "View Details" button 4) Basic Firewall section "Settings" button. 5) "Advanced settings" button
    – JRr
    Aug 13, 2020 at 9:30

Just came across and solved this issue, after a little faffing, so thought I'd offer notes.

I used SysInternals Process Explorer, Run as Administrator, to find the process that was locking the file (by using Find > Find Handle or DLL). Note that when I ran it without Administrator permissions it couldn't see the system-level WRSA process.

In my case it was WRSA.exe, which is Webroot Secure Anywhere. Disabling the protection unlocked the file and I was able to overwrite it easily. In some versions of webroot you will have to open "Advanced Settings > Shields" and un-check the option for blocking edits to the hosts file.

It's completely right that anti-virus software should protect files such as hosts, of course. Malware loves that sort of thing.

  • You are life saver! I had the Webroot block. Nothing had worked until your solution! Thanks! Jun 4, 2018 at 17:51
  • The laptop I am working on was purchased from BestBuy. My WebRoot is littered with BestBuy logos. Windows Security, McAfee, and WebRoot. Probably more. The more the better, right? \s It's not like I really want any processing power left for things that I actually want to run. Sep 4, 2020 at 12:22
  • 1
    I just wanted to add a comment that there is a difference between the implementation of Webroot on Windows Home and Webroot on Windows Professional. I have no problem saving my hosts file in an elevated notepad/notepad++ in Windows Professional. It appears that I have to uncheck the Advanced > Shields > "Prevent any program from modifying the HOSTs file" checkbox to be able to modify my hosts file in Windows Home.
    – jlavallet
    Mar 16, 2021 at 13:33

I could eventually find the culprit. It was a program called "Tiny Firewall" (a windows firewall rule management software) that caused the problem.

I am not exactly sure what does it do to the hosts file because none of the available software could show a lock on the file. I could find that it is somehow involved with the file using process monitor (Sysinternals). I quit the UI and stopped the process (would not allow to stop, killed the process-tree and set to manual service).

P.S.: This is a feature of Tiny Firewall (protection of hosts file) and you can simply turn it off from its settings.


In my case, HOSTS file was constantly locked by svchost.exe !

The problem started since I have used the tool HostsMan. It had filled the HOSTS file with about 18 MBs of DNS numbers and domains. And my PC was suddenly offline.

So, with the tool Process Explorer, I searched for "etc\HOSTS". When you click on one entry in the search results, the corresponding locking process is highlighted in brown colour. So I found out, that HOSTS file had been locked by the process svchost.exe and sometimes by other processes as well. I waited until no other process than svchost.exe had been locking HOSTS. Then I killed the process tree of that concerning svhosts.exe! Within the few seconds, while that svhosts.exe process had not yet restarted (thus HOSTS was temporaily unlocked), I finally managed to rename HOSTS manually into anything else like "HOSTS000". Then I renamed the neighbouring file "HOSTS.back" (which is the backup with the default content) into HOSTS. Problem solved! I suddenly was online again.

Check the picture below for the DNS filters, which I had activated. I guess, Windows 10 simply was overloaded with all those 50 thousands of domain names saved into the HOSTS file.

enter image description here


based off the answer by @gloschtla I wrote a little batch file. it took about 15 minutes of execution. what it does is it tries to rename the hosts file and if it fails, it waits for one second and tries again.

@echo off
timeout /t 1
ren hosts hosts.old
if errorlevel 1 goto start
echo done! 
  • solved my issued, many thanks. Important to note that batch file should be opened from a CMD terminal (in admin mode of course), and not by double clicking on the batch file when it's in the folder. In process explorer I ended up just clicking many times for a duration of 10 minutes or so to kill svchost.exe. Each time it restarted, but then at some point the batch file managed to rename hosts file, and the job was done!
    – Daan
    Jul 28, 2023 at 11:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .