"you may want to ... search the host file ... deleting the offending line or commenting it out"
It should be noted that certain malware (e.g. the W32.Surflog.A worm),
as well as some legitimate programs (e.g., WinPatrol)
can
LOCK the hosts file, making it
READ-ONLY, and in such a case, one must remove this "impediment" first, if you're able to (i.e., W32.Surflog.A will try to resist), before changing the HOSTS file.
I think I've seen this symptom associated with malware, but I can't find the reference.
It's possible to change the directory where the hosts/lmhosts/services files are stored by editing the registry, as described in
this Microsoft article. See the section entitled "Checking the Lmhosts File".
That will leave the original files in ...\system32\drivers\etc intact, but the running copies are somewhere else. If a machine is resolving host names incorrectly, but the "hosts" file in the standard location is OK, that registry entry should be examined.
I wonder if any of the anti-malware tools check for that entry. It's not present by default.
ky331
3 Apprentice
•
15.6K Posts
0
March 15th, 2005 19:00
jwatt
4.4K Posts
0
March 15th, 2005 20:00
It's possible to change the directory where the hosts/lmhosts/services files are stored by editing the registry, as described in this Microsoft article. See the section entitled "Checking the Lmhosts File".
That will leave the original files in ...\system32\drivers\etc intact, but the running copies are somewhere else. If a machine is resolving host names incorrectly, but the "hosts" file in the standard location is OK, that registry entry should be examined.
I wonder if any of the anti-malware tools check for that entry. It's not present by default.
Jim