Windows 10 hosts file used by another process

Question

There are a few other question with this same title but they do not solve my problem, so I am opening another one.

• I have set the permission for the "hosts" file to full access for the current user. I have even taken the ownership. Current user is in Administrators group.

• I have turned off UAC.

• I have removed read only permission from the file.

  C:\Windows\System32\drivers\etc>attrib hosts
  A            C:\Windows\System32\drivers\etc\hosts
  

• I have disabled my Panada Antivirus. I have also stopped 3 panda services from Services palette.

• I open an elevated Command Line (run as Administrator). Run Notepad and change the file. When I try to save the file I receive the following error:

  "The process cannot access the file because it is being used by another process.

• I check the file using "Unlocker" and the software says there is no active lock on the file.

Can anyone help?

Answer 1

My etc\hosts file was locked by ZoneAlarm Firewall

To unlock, I had to uncheck the "Lock hosts file" in ZoneAlarm firewall settings menu

Answer 2

Just came across and solved this issue, after a little faffing, so thought I'd offer notes.

I used SysInternals Process Explorer, Run as Administrator, to find the process that was locking the file (by using Find > Find Handle or DLL). Note that when I ran it without Administrator permissions it couldn't see the system-level WRSA process.

In my case it was WRSA.exe, which is Webroot Secure Anywhere. Disabling the protection unlocked the file and I was able to overwrite it easily. In some versions of webroot you will have to open "Advanced Settings > Shields" and un-check the option for blocking edits to the hosts file.

It's completely right that anti-virus software should protect files such as hosts, of course. Malware loves that sort of thing.

Answer 3

I could eventually find the culprit. It was a program called "Tiny Firewall" (a windows firewall rule management software) that caused the problem.

I am not exactly sure what does it do to the hosts file because none of the available software could show a lock on the file. I could find that it is somehow involved with the file using process monitor (Sysinternals). I quit the UI and stopped the process (would not allow to stop, killed the process-tree and set to manual service).

P.S.: This is a feature of Tiny Firewall (protection of hosts file) and you can simply turn it off from its settings.

Answer 4

In my case, HOSTS file was constantly locked by svchost.exe !

The problem started since I have used the tool HostsMan. It had filled the HOSTS file with about 18 MBs of DNS numbers and domains. And my PC was suddenly offline.

So, with the tool Process Explorer, I searched for "etc\HOSTS". When you click on one entry in the search results, the corresponding locking process is highlighted in brown colour. So I found out, that HOSTS file had been locked by the process svchost.exe and sometimes by other processes as well. I waited until no other process than svchost.exe had been locking HOSTS. Then I killed the process tree of that concerning svhosts.exe! Within the few seconds, while that svhosts.exe process had not yet restarted (thus HOSTS was temporaily unlocked), I finally managed to rename HOSTS manually into anything else like "HOSTS000". Then I renamed the neighbouring file "HOSTS.back" (which is the backup with the default content) into HOSTS. Problem solved! I suddenly was online again.

Check the picture below for the DNS filters, which I had activated. I guess, Windows 10 simply was overloaded with all those 50 thousands of domain names saved into the HOSTS file.

Answer 5

based off the answer by @gloschtla I wrote a little batch file. it took about 15 minutes of execution. what it does is it tries to rename the hosts file and if it fails, it waits for one second and tries again.

@echo off
:start
timeout /t 1
ren hosts hosts.old
if errorlevel 1 goto start
echo done!