The Hosts file - what it is, where it is located in Windows, what a webmaster should do with it and how to remove virus entries from it. Hosts file: eliminating the consequences of a virus attack

One of the suggested methods was to check the hosts file. Then this issue was covered briefly, but now we will consider it in more detail.

Virus programs very often edit the hosts file, writing certain commands. As a result, access to Odnoklassniki or VKontakte may be lost (sometimes the user opens the “left” VKontakte website with a request to send an SMS to unblock the page), the antivirus will stop updating, or the Internet connection will disappear altogether. It also happens that instead of one site, another one loads. For example, you open the start page of Yandex or Google, and an advertising site appears.

In all these cases, cleaning the hosts file is required. If the reason is the appearance of ad viruses or blocking access in it, then the problem will disappear. How to clean the hosts file? This can be done in 2 ways: manually and using programs. And below are instructions on how to fix the hosts file using each of these methods.

How to clear the hosts file manually

Manual cleaning is very simple, as you will now see for yourself.

To clear the hosts file, click Win + R and copy the line into the window that appears: notepad %SystemRoot%\system32\drivers\etc\hosts. As a result, notepad will launch with the contents of this file.

There is another way to open it:

Ready. This is what the hosts file should look like:

First there are explanations from the Windows developers about what this file is. Then a couple of examples are given on how to correctly write commands. Comments are written in plain text and do not perform any action (this is indicated by the hash icon # at the beginning of all lines).

But in your case, there will most likely be a lot more text. And without the hash mark, of course. For example, like this:

Line 127.0.0.1 denies access to the specified website. In the example above, these are Odnoklassniki, Mail.ru and the Kaspersky portal. If other numbers are written there, then there is a redirection to some kind of fake site.

To clean the hosts file, you need to remove these extra lines. But be sure to look at what the original version should look like so as not to erase anything unnecessary.

By the way, sometimes these extra lines are hidden at the very bottom. That is, when you open the file, it seems that there is nothing there, but if you scroll to the bottom, you can find several virus commands.

Then save the accepted changes. To do this, click File – Save in the notepad.

Restart your computer or laptop – and the problem with ad viruses or site blocking should disappear. If that was the reason, of course.

What to do if you do not have rights to edit the hosts file? Copy it to your desktop, delete the extra lines, save the changes, and then put it in the same folder and replace the previous version. And then restart your PC.

If the problem persists, first check to see if the changes to the host file have been saved. After all, this is a fairly common mistake of inexperienced users.

This is how you can clean hosts in Windows 7, 8 and 10. The instructions are universal for all operating systems, so its version does not matter here.

How to fix the hosts file via AVZ

You can also clear hosts automatically. AVZ is perfect for this - a powerful anti-virus utility that helps clean your PC from viruses and all sorts of advertising nonsense. This program will find the file, even if it is hidden or completely renamed. It's free and you can download it.

To open AVZ, select the shortcut, right-click and run it as administrator.

After this:

The AVZ utility will clean the host file, after which all you have to do is restart your laptop or computer. Everything will take 5-10 seconds. Plus, the program works on any OS: Windows 10, 8.1, 7 and XP.

Restoring the default hosts file

As a bonus, I’ll give you another method - official instructions from Microsoft on how to restore the hosts file. You can get acquainted with it. This option is suitable for those who accidentally deleted the hosts file and want to restore it. The instructions are also universal and suitable for Windows 7, 8 and 10.

That's all. Now you know how to clean the hosts file manually or through the AVZ program. As you can see, it is not difficult and takes a maximum of 5 minutes of time.

And if in the future you have problems accessing your favorite sites or ad viruses appear in your browser, don’t be lazy to check this file. It is quite possible that there are extra lines that need to be deleted.

After some calm, a wave of questions began again on the topic “The page does not open..”, “I can’t log into the site...”. There is only one rule here - start checking from the hosts file.

Let's start with the fact that each site has a text name and a corresponding unique digital code. Usually we write the text address of the site in the address bar, because it’s more convenient for us. As soon as we enter the name of the site, a special DNS server immediately converts this name into a digital code - an IP address.

The hosts file is designed to speed up access to the site bypassing the DNS server. That is, if we ourselves enter a pair of IP address and site name here, then there will be no access to the DNS server.

Now you understand that if you register this pair incorrectly, then the transition will not go where you expected or nowhere at all.

This feature is used by malware by adding incorrect pairs to hosts - IP address and site name.

Fixing the hosts file.

The hosts file is text and is easy to fix yourself. It is located at

C:/windows/system32/etc

ATTENTION! In a folder etc In addition to the hosts file, there are other files that are intended for setting up the network. These are networks, protocol, services, hosts, lmhosts.sam. DO NOT DELETE this folder at all!

You can fix the hosts file with:

Microsoft Fix it utilities - go to the website of its creators and do it with two clicks.
AVZ utilities - this is written in great detail.
when checking your computer using the free CureIt utility - .
manual correction.

When fixing the hosts file, you should be aware that there are pitfalls. Virus writers use simple but quite effective tricks to slip us a fictitious hosts file. Therefore, if you cannot open the site and are going to check the hosts file, be extremely careful.

Which hosts file are you editing?

If you check your hosts and either don't find it at all or think it's correct, do some additional analysis. You will need additional skill, a little more than normal notepad skills. But nothing complicated.

This section contains the most common tricks that attackers use to try to prevent the user from editing the hosts file.

Trick 1 - Registry Redirection

If you cannot log into the site and your hosts file is correct or you do not find hosts in the C:\windows\system32\drivers\etc\ folder, then the virus has changed the location of the file in the registry key.

To get rid of the virus, follow these steps:
1. Start - Run - regedit.exe.
2. In the Registry Editor window, find the branch -
\HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
3. In the tab Parameters A menu will appear on the right side of the window with the file name, its type and value. Check the parameter value DataBasePath. Must be %SystemRoot%\System32\drivers\etc. If this is not the case, then right-click on this line and select Change, and enter the correct value.

Even if you have hosts where you need it, the operating system uses the file whose path is specified by the DataBasePath parameter.

Trick 2 - inserting blank lines.

To make it more difficult to detect extra lines in the hosts file, they are written to the very end of the file after a large number of empty lines.

At first glance, such a file looks normal and at a quick glance we may not notice anything, but we should always pay attention to the scroll bar slider in Notepad:

If the slider is present, then you need to move it down to view the entire contents of the file. This often turns out to be useful because... At the bottom of the file we can find some unpleasant surprises:

Trick 3 - hiding the file.

The hosts file is assigned the attribute Hidden, and it becomes invisible - there is no hosts file. And since by default hidden files and folders are not displayed in Explorer, the user may not find this file, and therefore cannot edit it.

If you don't have a hosts file, then we need to make it visible. To do this in Windows XP we do the following: Start – Control Panel – Folder Options – View tab– set a sign Show hidden files and folders – click Ok (in Windows 7 everything is the same, but instead Folder properties the item is called Folder Options).

A false file is created without an extension, but with a similar name, for example file host. And the real hosts file is created hidden.

In this case, we again edit the false file, but the real one remains unchanged. This file (host) can also be safely deleted!

Trick 5 - changing the extension.

A false hosts file is created, which, unlike the real file, has some extension (for example.txt). And since by default extensions are not displayed for registered file types, the user and therefore we can easily confuse files and edit the wrong file.

Trick 6 - It is impossible to edit the hosts file.

And one more thing that those who are too hasty often do not pay attention to.

You have found the correct hosts file, found extra lines in it, start editing, but the changes are not saved. This is because your hosts file is assigned the “Read Only” attribute.

Trick 7 - Setting up a proxy.

I won't bother too much with proxies, just check your browser settings.

Opera: General settings (Ctrl+F12) - Advanced - Network - button Proxy

Firefox: Settings->Advanced->Network tab - Configure

By default, there is a checkbox “use system proxy settings”, switch to “No proxy”, try saving the settings and restarting the browser.

If there is a manual setup and the proxy server address is registered, but you did not install it: save the address, delete it, switch to “no proxy” mode.

Open our registry editor (use Win+R), press CTRL+F (search) and paste the saved address, then - find more... All keys with this address will need to be changed, namely, the value of our address assigned to them will need to be deleted.

Reboot Windows and check.

Using hosts for your own purposes.

Method 1 - speed up access to the site using hosts.

If we often visit a site (for example, yandex.ru), then we can add the following lines to the end of the hosts file:

87.250.250.11 yandex.ru
87.250.250.11 www.yandex.ru

The browser, having detected these lines, will not contact the DNS server, which means that the loading process of this site will be faster.

How to find out the IP of a site?

Method 2: Deny access to the site.

You can block unwanted sites by assigning against their name or local IP 127.0.0.1. or the IP of some other site.

For example, from a magazine you see that a child plays tank for hours. Lines in the hosts file like:

127.0.0.1 tankionline.com
127.0.0.1 www.tankionline.com

generally blocks access to this site (connection error message).

And a line like

81.176.66.163 kiss.ru

works more sophisticated. When you try to enter kiss.ru in the browser, a connection will occur with IP 81.176.66.163, i.e. with the Moshkov library.

As you can see, we can do the same thing as viruses, but with benefit.

You can block the most malicious banner exchange networks and other hotbeds of advertising garbage. For example a line like:

127.0.0.1 www.bannerdrive.ru

will disable loading banners from www.bannerdrive.ru. In principle, on the Internet you can find very large (up to 1 MB) hosts files in which thousands of ad servers are included (blocked).

But don’t get too carried away with this - large (from several tens of kB) hosts files require significant time to view them, which slows down the work. But you don’t need to save a lot of lines either - files up to 10 kB do not slow down anything even on old machines, and 10 kB is many hundreds of lines.

Features of editing the hosts file in Windows 8.

In Windows 8, unlike previous versions, the order of editing the hosts file has been changed. The developers paid much more attention to this issue. And this is due to more stringent requirements for system security and protection of such an important file from attacks from outside.

This protection is provided by the built-in Windows Defender antivirus - if you make any changes to the hosts file, Windows 8 will automatically delete them, protecting the system from attacks by intruders. But for more experienced and confident users, there is one way to bypass this protection.

Open the window of the defender itself. To do this, go to the start screen and bring up the Charms Bar sidebar. If you managed to dress up your system and installed Windows 8 themes such that the system has changed beyond recognition, then use the combination Win+C
Go to the search and enter the query " Defender».
Click on the line shown. A window will open in which you need to go to the “ Options", select "Excluded files and locations" and click the " Review».
Finding the path to the file C:\Windows\System32\Drivers\etc\hosts and click OK.
Now, to add this file to the protection exceptions, you need to click the " Add" and "Save changes".

Now you can start editing the file itself. However, keep in mind that you can only change the file as an administrator. To do this, enable application search - Win+C -> Search Icon -> enter the query “ Notebook«.

Launch Notepad and in the menu that appears at the bottom, select the icon with the title “ Run as Administrator».

The usual notepad will open and you can do it as usual.

In conclusion.

After you have successfully corrected your hosts, be sure to check your computer for viruses and change your mailbox passwords.

Tell friends

The Windows 7 operating system has such a file through which you can regulate your visits to sites on the Internet. Mostly people do not know about such a file, and those who know try to ignore it so as not to “perform miracles.” This file is called hosts. Let's look briefly at why it is needed.

Let it be known that when you enter the address of a website in the browser line, a special DNS server located on the Internet immediately changes it to a certain sequence of numbers. This digital series is unique for each site, and site names are needed only for ease of remembering. The hosts file is used to quickly work on the World Wide Web, bypassing requests to the DNS server. In other words, if you write a number string in the hosts file corresponding to the name of the site, then you will be taken to it directly, bypassing the DNS server. You just need to register it correctly, otherwise the site won’t load, and even if it does, it won’t be the one you want.

“Computer pests” willingly use the hosts file for their personal interests. A virus, penetrating a computer, very often changes the hosts file. Therefore, if you suddenly encounter restrictions on access to certain sites, first scan your computer to see if viruses have entered it, and only then convert the hosts to its original form.

Where is the hosts file located in Windows 7?

So, let's look at where hosts is located in Windows 7. You can find it in the Windows system folder. It is located on drive C, that is, where the system is installed. Next, find the “System 32” folder, go to “Drivers” and, finally, to “Etc”. The file we need is saved in this folder.

It also happens that you did not find the hosts file, most likely it is simply hidden and the “Do not show hidden files, folders and drives” option is indicated in the settings. In this case, you need to open the “Computer” folder and press “Alt”, an additional menu will appear at the top of the window, in it select “Tools” and “Folder Options”.
In the new window, select the “View” tab and find the item “Show hidden files, folders and drives”, put a checkmark on it. Accept the changes by clicking the “Ok” button. Now go to the “Etc” folder, the hosts file should be displayed.

Now let's look at how you can change the hosts file. Let's proceed as follows:

Where is the hosts file in Windows 10?

The hosts file in the Windows 10 operating system is located in the same place as in Windows 7, that is, on the system drive. In the “Windows” folder, then go to the “System 32” folder, go to “Drivers” and, finally, to “Etc”.

To change a file in Windows 10, you must:

Double-click on the hosts file;
In the window that appears we find “Open with”;
We find among the proposed programs “Notepad”;
Click “Ok”;
Make changes and save them.

If you are a layman in this matter, then it is better not to do anything, but ask for help from a qualified specialist.
If something prompts you to make changes yourself, then first make a copy of the file and move it to another folder. If something doesn’t work out for you, you will return a copy of the file.
If you did not copy this file and have already made changes, and then your computer starts acting up, then the Internet will help you. Download a similar file from the site and replace yours.
Before you change something, think about whether you really need to do it and how important it is for you.

Hi all! Yesterday I spent the whole evening on Skype, helping a friend solve the problem of why VKontakte would not open for him. The answer was practically on the surface, but as usually happens in such cases, we stubbornly did not notice it. The trick was that a friend, working on his website in Denver, opened Contact (with Denver running, respectively), and then turned off the computer without turning off Denver. And as a result, in the VKontakte hosts file I entered it with a local IP. Therefore, today, taking a moment, I decided to write another post, devoting it to the hosts file. In this article we will talk about what the hosts file does, what it is for, how to find it, how to edit and save it. Also, at the very bottom of the article, you can download the hosts file. I will try to describe everything in simple human language, so that even an amateur who is not particularly versed in computers can understand.

What's happenedhosts? The hosts file is a text file on your device with Internet access (computer, smartphone, etc.). The hosts file contains a database of domain names. Every time you write this or that website address in your browser, a request is initially made to the hosts file, and then only a request is made to the DNS (external servers located on the Internet). And if you block this or that address in the hosts file, then it will no longer be possible to access it from this computer. That's probably all the hosts file does.

How to find a filehosts? The hosts file is located in different places in different operating systems. Below is a table of how it can be found in the most popular OS

Everything below, until the next paragraph, is dedicated to those who do not know what to do with this table. And so, if for you this is Filka’s letter written in Chinese, then most likely you have Windows. Here, based on this OS, I will explain how to find the hosts file.

Go to My Computer. Click on the address bar (see screenshot) and paste this phrase there: C:\Windows\system32\drivers\etc. This is the path to the hosts file. Then press Enter.

We get to the system folder. Find the hosts file. All! You can congratulate yourself, you are a Computer Genius! 😉

If you have any problems, or you have a different axis, and you don’t know what and how to do, then write in the comments, I will be happy to answer. And we move on.

How to open a filehosts? Since we have found the hosts file, now we need to open it somehow. There is nothing complicated about this. Opens hosts with any text editor. I use Notepad++, but you can open it with any other one. Even with regular Notepad, built into Windows by default.

What should be in the hosts file? Nothing extra. But seriously, a clean hosts file should look like this:

# Copyright (c) 1993-2009 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a "#" symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host # localhost name resolution is handled within DNS itself. # 127.0.0.1 localhost # ::1 localhost

If you write in English, then, as you can see, the file itself describes in detail what the hosts file does, what should be in it and how to change it. I also want to remind you that at the end of the article you can download the hosts file, so there is no need to copy it from here.

But it is unlikely that you will see exactly such a file. Most likely, there will be other lines in your hosts file. For example, if you use Adobe products, then at the end you will find something like:

127.0.0.1 adobe-dns.adobe.com 127.0.0.1 adobe-dns-2.adobe.com 127.0.0.1 adobe-dns-3.adobe.com

Now let's get to the fun part:

Editinghosts. And so, now we will learn how to change the hosts file. First, let's understand what certain symbols mean in it. It’s very easy, at the first grade level (my student goes to the second grade and edits this file once or twice).

Everything marked with a “#” is a comment. We don't take them into account. Those. you can put "#" and write whatever you want. This will not be taken into account by the computer. But, as soon as you move to a new line, if you don’t put “#” again, the computer will start taking your line into account. Let's say it again, the line with “#” is a comment and is not taken into account by the computer.

In the desert, lines in hosts are ignored. You need to put them only for your convenience, so as not to get confused later.

The numbers 127.0.0.1 are the local IP address. What are IP addresses, this is a whole article to write. Therefore, now the main thing for us to remember is that any Internet address after 127.0.0.1 will be ignored, and you will not be able to access it on the Internet.

For example, having a line like:

127.0.0.1 google.ru

You will not be able to access the Google search engine. Thus, you can deny access to any site by simply entering the url of the unwanted site after the local IP address.

These lines must be entered at the end of the file. Each new site address must start on a new line.

Sometimes it happens that some programs change this file, mainly Virtual Servers or viruses. But, if virtual servers return hosts to their original state after they are closed, then viruses maliciously edit hosts. In any case, the result is the same: you cannot get to this or that site. Therefore, if you cannot access any site, check the hosts file, perhaps access is denied in it.

Now I will reveal one terrible secret. Social networks and some other sites are often blocked at work. Often, ISPs block users using the method described above. But you already know how to change the hosts file 😉

By the way, if you want to deny your child access to certain sites, then you can easily edit the hosts file, indicating the addresses of unwanted resources in it. As a result, your hosts file will look like this:

That's it, after we have edited the hosts file, we can safely save it.

If you are editing an existing file, then save the hosts as a regular document. For example, by pressing the buttons Ctrl+S or File -> Save.

Restoring the default hosts file in Windows 7

File hosts establishes a correspondence between the IP server and the site domain. A request to this file takes precedence over calls to DNS servers. Unlike DNS, the contents of the file are controlled by the computer administrator.

Today, a large number of malware use the file hosts to block access to websites of popular portals or social networks. Often, instead of blocking sites, malware redirects the user to pages that look similar to popular resources (social networks, email services, etc.), where an inattentive user enters credentials, which thus get to the attackers. It is also possible to block access to the websites of antivirus software companies.

Default file host located here C:\Windows\System32\drivers\etc The file has no extension, but can be opened with Notepad. To change the contents of a file in Notepad, you must have administrator rights.

To view the file host open the menu Start, select item Execute, enter the command

and press the buttonOK.

This is what the file should look like host default.

If the file contains entries like 127.0.0.1 odnoklassniki.ru127.0.0.1 vkontakte.ru or the addresses of your sites that you cannot access, then first check your computer for “malware”, and then restore the file host

Restoring the contents of the hosts file to default

Open menu Start, select item Execute, enter the command %systemroot%\system32\drivers\etc and press the button OK.
Rename the hosts file to hosts.old.
Create a new file hosts default. To do this, follow the steps below.

Right click on an empty space in the folder %WinDir%\system32\drivers\etc, select item Create, click the element Text document, enter name hosts and press the key ENTER.
Click the button Yes to confirm that the filename will not have the extension TXT.
Open a new file hosts in a text editor. For example, open the file in " Notebook".
Copy the text below into a file.
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
#space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host