Please help! Restoring default HOST files for Vista

blahhh

Ok, I got a virus, that stupid security shield one.

I used this website to get rid of it http://free-pc-guides.com/virus-removal-guides/how-to-uninstall-remove-my-security-shield-virus-removal-guide-03250

Worked great, except for the "Host permission fixer", download no longer exists. I tried getting into it by the notepad and run as administrator, but the only host file I get is a sample.. And to be honest I'm not great with computers so I'm afraid of deleting something and breaking the whole thing altogether

My internet is really fecked up and I badly need it! Any help appreciated

bhickey

There is a Vista hosts file that you can download on that page. Download it and copy it to the C:\Windows\System32\drivers\etc folder.

blahhh

But nothing comes up when I click on any of those download links

CrinkElite

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost


#this is my hosts file for 7, as you can see everything is commented out
#so I'd say you'd be grand with just a blank notepad file called hosts.
#It's not a text file though, in properties under file type it just says "File"

blahhh

I'm literally tearing my hair out...

When i got into >system32>driver>etc There is NO Host folder. It is hidden for some reason, I have checked the control panel and allowed for hidden items to be seen, made no difference.

However when I type "Host" into file name under "etc" folder, the thing comes up in notepad, it doesn't look right, it has google and yahoo in there, but then when I delete the abnormal looking stuff or even put default host file in, it won't let me save changes!! even though I'm logged in as admin....I want to cry

CrinkElite

It's backup and re-install time. (IMHO)

Google and Yahoo should not be in your hosts file. The hosts file is antiquated and should not be used in normal conditions.
DNS should provide all your address resolution needs.
The presence of the Yahoo and Google entries suggest to me a malicious attempt to redirect your search queries.

bhickey

blahhh wrote: »

When i got into >system32>driver>etc There is NO Host folder. It is hidden for some reason, I have checked the control panel and allowed for hidden items to be seen, made no difference.

Windows hides a lot of file information by default and it can be useful to unhide some or all this information when troubleshooting :

• Do not show hidden files and folders
• Hide extensions for known file types
• Hide protected operating system files

The 'hosts' file thought should be visible anyway (on XP at least).

However when I type "Host" into file name under "etc" folder, the thing comes up in notepad, it doesn't look right, it has google and yahoo in there, but then when I delete the abnormal looking stuff or even put default host file in, it won't let me save changes!! even though I'm logged in as admin....I want to cry

Now don't cry and stop pulling your hair out. Locate the 'hosts' file in Windows Explorer and right-click on it. Then click on Properties and look for 'Attributes'. If the Read-only and Hidden attributes are ticked then untick them. Now you should be able to open/delete/rename/overwrite the 'hosts' file as you wish.

If that doesn't work then repeat the above in Safe Mode.

If the 'hosts' file issue is the only remaining trace of any virus then you should be sorted.

MarkR

If possible, you could try system restore. It's reversible, and should solve your problem. Might still have the virus though. Download malwarebytes and run that also to get rid of any crap off your computer, along with some form of antivirus.

Start>All Programs>Accessories>System Tools>System Restore

Restore my computer to an earlier time
Pick a date in bold back when things are working, and follow the on screen instructions.

I'm always a fan of a back up, format, and reinstall, but try this maybe. :-)

somebody_else

blahhh - host is a file not a folder !
go to system32>driver>etc and right click anywhere inside of this folder and create new text file - name it host and that is it.
Then You can check if file looks like text icon - it shouldn't !!!

it should be host but not host.txt !!!

Tom

Cuddlesworth

I got that on a pc in here recently. Its a new gen of that virus. Rkill actually kicks it back on, as do a number of the fix's. In the end I had to terminate the process over the network, install process explorer and locate and destroy the files and reg keys associated with the app/malware myself. If its the same generation of the virus you have just gotten I would just reinstall xp. That was the nastiest infection I have seen in a long time.

yoyo

Type notepad in the start menu, dont click enter but rightclick the notepad exe and choose run as adinistrator. Then copy the file as shown above into notepad, go to save and save the file in the drivers/etc folder as "hosts", do this by changing the dropdown in notepads file save dialog to all files, thats all there is too it... If there is a hosts file in there, right click the etc/ folder icon and choose properties, then click security, click advanced, choose your user name & give it "full control", youll be able to edit the file then more than likely)

Nick

blahhh

Hey thanks for the replies.

I fixed it...after trying everything, I don't know what actually fixed it though. I think it may have been a command I entered in the "command prompt" that allowed me to save changes to HOST file in notepad though.

Cuddlesworth, the virus was on my laptop for sometime, because I remember seeing a "security sheild" icon on my desktop, but didn't know where it came from. Then saturday night a pop-up appeared saying I had a virus and needed to remove them, however it was a pop-up from "security shield". Then my internet was lalooed... and I found out that was the souce. But my legit ant-virus things didn't detect any virus!!? Even when I found it myself in the host file..

I hope it's all gone now. My HOST file is still invisible. I can still access it though by tying "HOSTS" into "file name" under "etc" folder. This is what it now looks like:

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
::1 localhost

tricky D

A better HOSTS file to use is MVP Hosts. All you need to do is save that page as HOSTS with no file extension, in the >system32>driver>etc folder overwriting the previous one. This will help you avoid many of the latest malicious sites. The default HOSTS does not do this.

However, your problems may not yet be resolved. Some of these things hang around in the recesses of machines and pop up again. Your best course of action is to read the "I think I have a virus" - Please Read & Try BEFORE Posting (Updated 12/02/2010) sticky and carry out as many of the instructions in that thread, then post the relevant logs here in a new thread. Someone will be along to help but only once you do those tasks.

softdancomputer

Unzip the attached to system32/drivers/etc
Its a standard host file with Spybot S&D immunisation applied.

blahhh

Hey guys, when I try to paste either of those HOSTS files into "etc" folder it won't allow it.

It says "You'll need administrators permission to copy folder", I press "continue", a window pops up saying "Windows needs your permission..." I press "continue", but another pop says permission is needed, I press "Try again" but nope.

The items in the etc folder :
lmhosts.sam
networks
protocol
services

HOSTS is not listed, so I can't alter it in the folder to gain permission if you get me...

I'll try copy and paste the HOSTS file you sent to my HOSTS file though, see if it will save changes..

_Whimsical_

http://www.bleepingcomputer.com/virus-removal/remove-security-tool

There's some info in there on the Host file thing. I was going to try it because I've had this virus too but my lcd screen has packed it in so I'm stuck .

Let me know how you get on and if you have any tips.

bhickey

From here :

Changing your hosts file in Vista

By default, if you try to modify your hosts file in Vista, it will not let you save it. It tells you that you don't have permission. To successfully modify the hosts file, run notepad.exe as an administrator and open the file.

1) Browse to Start -> All Programs -> Accessories
2) Right click "Notepad" and select "Run as administrator"
3) Click "Continue" on the UAC prompt
4) Click File -> Open
5) Browse to "C:\Windows\System32\Drivers\etc"
6) Change the file filter drop down box from "Text Documents (*.txt)" to "All Files (*.*)"
7) Select "hosts" and click "Open"
8) Make the needed changes and close Notepad. Save when prompted.

If this doesn't work then try the same process in Safe Mode.

blahhh

bhickey... I've done that a million times.. But it WON'T allow me to save changes (yes i'm logged in as admin).

Also I can't get into safe mode, I've tried 5 times now.

Just going to have to spend money I don't have on getting it fixed

bhickey

blahhh wrote: »

Also I can't get into safe mode, I've tried 5 times now.

Why can't you get into Safe Mode?

Another tack is to boot from a live CD (for example Ubuntu) and try to access the file that way.

blahhh

Ok, I got the original HOSTS file in the etc folder (yay), now when I try to change it, to block sites etc.. When I save it, it saves as a text file... how do I just save over the original basically and replace it with a nice new non virus HOST file. I copied that mvps one, but obviously it's not saving right for me.

The safe mode is probably not working, because anything I press is delayed by about 20 seconds, so when I press F8, it's taking too long to make a connection (i'm guessing)

yoyo

blahhh wrote: »

Ok, I got the original HOSTS file in the etc folder (yay), now when I try to change it, to block sites etc.. When I save it, it saves as a text file... how do I just save over the original basically and replace it with a nice new non virus HOST file. I copied that mvps one, but obviously it's not saving right for me.

The safe mode is probably not working, because anything I press is delayed by about 20 seconds, so when I press F8, it's taking too long to make a connection (i'm guessing)

You need to save it as type "all files" and just name it hosts, not hosts.txt

Nick

bhickey

blahhh wrote: »

The safe mode is probably not working, because anything I press is delayed by about 20 seconds, so when I press F8, it's taking too long to make a connection (i'm guessing)

Unlikely. Just keep tapping (a couple of times a second) the F8 key from when the computer's BIOS screen appears. You're basically trying to catch the moment just before Windows starts to kiad.

blahhh

I am saving it under "all files" with the name "hosts" but it automatically saves then as host.txt

bhickey

blahhh wrote: »

I am saving it under "all files" with the name "hosts" but it automatically saves then as host.txt

Well can't you delete/rename the 'hosts' file and then rename 'host.txt' to 'hosts'?

blahhh

bhickey wrote: »

Unlikely. Just keep tapping (a couple of times a second) the F8 key from when the computer's BIOS screen appears. You're basically trying to catch the moment just before Windows starts to kiad.

I did that five times sure.

blahhh

It says "This file is set to read only"

I then go into the properties of the original Host, and it won't allow me to uncheck read only..

I.am.withered

bhickey

If you have the original hosts file now then what's the problem?

blahhh

I want to replace it with this one http://www.mvps.org/winhelp2002/hosts.txt

Also my internet is not working right, everything takes ages to load, keeps saying "not responding"